Malware analysis build_output.zip Malicious activity | ANY.RUN

Add for printing

File name:	build_output.zip
Full analysis:	https://app.any.run/tasks/b9da41ee-8d9b-4a28-9c16-06a97113570e
Verdict:	Malicious activity
Analysis date:	October 03, 2025, 17:14:30
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/zip
File info:	Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:	1A23377F00120EDEEE62105FFDC4E952
SHA1:	36DEC3BBA800AF3162E6C8735CB8D95EE092E9BE
SHA256:	0A2F2B09C962BD8C2878DFA8819DE370EDFF992D70A33FAA3A519DB0F17B393E
SSDEEP:	98304:n115OXNhs8xpJtArk9WgRMHA/UqSJnEhefSeKEC5fpMoYRFA8YPd7ZyhS1SUfg2R:7EW9GQrzwnkJbGTbrJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 240 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 180 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (133.0.6943.127)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (133.0.3065.92)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (136.0)
Mozilla Maintenance Service (136.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Changes the autorun value in the registry
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 5836)
SUSPICIOUS
- Process drops legitimate windows executable
  - WinRAR.exe (PID: 4284)
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 1920)
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 5836)
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 5232)
  - msiexec.exe (PID: 8512)
- Reads security settings of Internet Explorer
  - Pulsar.exe (PID: 7416)
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 5232)
  - WinRAR.exe (PID: 4284)
- Executable content was dropped or overwritten
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 1920)
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 5232)
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 5836)
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 8712)
- Starts a Microsoft application from unusual location
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 5232)
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 5836)
- Searches for installed software
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 5232)
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 8324)
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 8712)
- Starts itself from another location
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 5232)
- Reads the Windows owner or organization settings
  - msiexec.exe (PID: 8512)
- The process creates files with name similar to system file names
  - msiexec.exe (PID: 8512)
- The process drops C-runtime libraries
  - msiexec.exe (PID: 8512)
- Application launched itself
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 9204)
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 8324)
- Creates file in the systems drive root
  - explorer.exe (PID: 3848)
- Uses RUNDLL32.EXE to load library
  - explorer.exe (PID: 3848)
INFO
- Reads the software policy settings
  - BackgroundTransferHost.exe (PID: 2168)
  - msiexec.exe (PID: 8512)
  - slui.exe (PID: 8180)
- Checks proxy server information
  - BackgroundTransferHost.exe (PID: 2168)
  - slui.exe (PID: 8180)
- Reads security settings of Internet Explorer
  - BackgroundTransferHost.exe (PID: 2168)
  - BackgroundTransferHost.exe (PID: 4644)
  - BackgroundTransferHost.exe (PID: 8012)
  - explorer.exe (PID: 3848)
  - BackgroundTransferHost.exe (PID: 1400)
  - BackgroundTransferHost.exe (PID: 5356)
- Manual execution by a user
  - Pulsar.exe (PID: 7416)
  - Pulsar.exe (PID: 6288)
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 8324)
- Application launched itself
  - msedge.exe (PID: 5888)
  - msedge.exe (PID: 4308)
- Executable content was dropped or overwritten
  - msedge.exe (PID: 4308)
  - msiexec.exe (PID: 8512)
  - WinRAR.exe (PID: 4284)
- Checks supported languages
  - identity_helper.exe (PID: 8988)
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 1920)
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 5232)
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 5836)
  - msiexec.exe (PID: 8512)
  - msiexec.exe (PID: 6776)
  - msiexec.exe (PID: 5944)
  - msiexec.exe (PID: 8372)
  - msiexec.exe (PID: 9004)
  - Pulsar.exe (PID: 6288)
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 8324)
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 8712)
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 9204)
  - Pulsar.exe (PID: 7416)
- Reads the computer name
  - identity_helper.exe (PID: 8988)
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 5232)
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 5836)
  - msiexec.exe (PID: 8512)
  - msiexec.exe (PID: 6776)
  - msiexec.exe (PID: 9004)
  - msiexec.exe (PID: 5944)
  - msiexec.exe (PID: 8372)
  - Pulsar.exe (PID: 6288)
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 8712)
  - Pulsar.exe (PID: 7416)
- Creates files or folders in the user directory
  - BackgroundTransferHost.exe (PID: 2168)
- Reads Environment values
  - identity_helper.exe (PID: 8988)
  - Pulsar.exe (PID: 6288)
- The sample compiled with english language support
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 1920)
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 5232)
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 5836)
  - msiexec.exe (PID: 8512)
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 8712)
- Create files in a temporary directory
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 1920)
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 5232)
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 5836)
  - Pulsar.exe (PID: 6288)
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 8712)
- Process checks computer location settings
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 5232)
  - Pulsar.exe (PID: 6288)
- Launching a file from a Registry key
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 5836)
- Creates files in the program directory
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 5836)
  - Pulsar.exe (PID: 6288)
- Creates a software uninstall entry
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 5836)
  - msiexec.exe (PID: 8512)
- Reads the machine GUID from the registry
  - windowsdesktop-runtime-9.0.9-win-x64.exe (PID: 5836)
  - msiexec.exe (PID: 8512)
  - Pulsar.exe (PID: 6288)
- Reads product name
  - Pulsar.exe (PID: 6288)
- Reads Microsoft Office registry keys
  - explorer.exe (PID: 3848)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.zip	\|	ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion:	20
ZipBitFlag:	-
ZipCompression:	Deflated
ZipModifyDate:	2025:09:06 02:28:30
ZipCRC:	0xb45d811d
ZipCompressedSize:	11147
ZipUncompressedSize:	19488
ZipFileName:	Microsoft.IdentityModel.Abstractions.dll

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

234

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

828

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=8080,i,13544996357895462867,10219432640028344986,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

—

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Microsoft Edge

Exit code:

Version:

133.0.3065.92

Modules

Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

828

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=4424,i,13544996357895462867,10219432640028344986,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

—

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

LOW

Description:

Microsoft Edge

Exit code:

Version:

133.0.3065.92

Modules

Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

1124

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=2292,i,13544996357895462867,10219432640028344986,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Microsoft Edge

Version:

133.0.3065.92

Modules

Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

1188

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --disable-quic --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6124,i,13544996357895462867,10219432640028344986,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

—

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

LOW

Description:

Microsoft Edge

Version:

133.0.3065.92

Modules

Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

1400

"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1

C:\Windows\System32\BackgroundTransferHost.exe

—

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Download/Upload Host

Exit code:

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll

1400

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=2756,i,13544996357895462867,10219432640028344986,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

—

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

LOW

Description:

Microsoft Edge

Version:

133.0.3065.92

Modules

Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

1920

"C:\Users\admin\Downloads\windowsdesktop-runtime-9.0.9-win-x64.exe"

C:\Users\admin\Downloads\windowsdesktop-runtime-9.0.9-win-x64.exe

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Microsoft Windows Desktop Runtime - 9.0.9 (x64)

Exit code:

Version:

9.0.9.35221

Modules

Images
c:\users\admin\downloads\windowsdesktop-runtime-9.0.9-win-x64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll

2016

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=7836,i,13544996357895462867,10219432640028344986,262144 --variations-seed-version --mojo-platform-channel-handle=7964 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

—

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

LOW

Description:

Microsoft Edge

Exit code:

Version:

133.0.3065.92

Modules

Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

2168

"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1

C:\Windows\System32\BackgroundTransferHost.exe

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Download/Upload Host

Exit code:

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll

2260

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3632,i,13544996357895462867,10219432640028344986,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

—

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

LOW

Description:

Microsoft Edge

Exit code:

Version:

133.0.3065.92

Modules

Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

Add for printing

Total events

41 075

Read events

40 045

Write events

968

Delete events

Modification events


(PID) Process:	(4284) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:	write	Name:	ShellExtBMP
Value:
(PID) Process:	(4284) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:	write	Name:	ShellExtIcon
Value:
(PID) Process:	(4284) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	3
Value: C:\Users\admin\Desktop\preferences.zip
(PID) Process:	(4284) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	2
Value: C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:	(4284) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	1
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:	(4284) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	0
Value: C:\Users\admin\AppData\Local\Temp\build_output.zip
(PID) Process:	(4284) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	name
Value: 120
(PID) Process:	(4284) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	size
Value: 80
(PID) Process:	(4284) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	type
Value: 120
(PID) Process:	(4284) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	mtime
Value: 100

Add for printing

Executable files

614

Suspicious files

369

Text files

107

Unknown types

Dropped files

PID	Process	Filename		Type
2168	BackgroundTransferHost.exe	C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\6217f412-4678-48dd-9fe6-d64f64f3c15a.down_data		—
		MD5:—	SHA256:—
2168	BackgroundTransferHost.exe	C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D		binary
		MD5:A2459D8C15651BB81784468BC907C939	SHA256:E6360479BE8038E7443DA1855F01EC552F1B602A656A2BF713C1CD760B7CB6C8
2168	BackgroundTransferHost.exe	C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D		binary
		MD5:C412EE7063DBBDEE55A81ACF4624A8B6	SHA256:7508FCF1061407BF9F150DA8510C02E078B0E8BA6C58AD6B3444EF9BEBF9E7FF
2168	BackgroundTransferHost.exe	C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\6217f412-4678-48dd-9fe6-d64f64f3c15a.6d3dd9b8-0807-4e5f-bdf4-6b640a2ccb03.down_meta		binary
		MD5:247566EE62EE1B4592CCF03D210285D9	SHA256:853E535B5F0D6B9CD508E28EAA6E44A42C7EB80D4268BCBFFE7B8322171A61FC
4284	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\build_output\ru\System.ServiceModel.Primitives.resources.dll		executable
		MD5:1F994FD1D26AFA7107805CFF4145188B	SHA256:54B54739DEFFBEEC99CBD9CAF28D1E17F507D9387EE015C43F2BD2AD0247E415
4284	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\build_output\ru\System.ServiceModel.Http.resources.dll		executable
		MD5:E57A631B514C45F0A084E417C64DD81A	SHA256:4B14EF2BBA5AF4F631647A932C6B546FA5BAC9BD75146B352E0201574C531207
4284	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\build_output\ru\System.ServiceModel.NetTcp.resources.dll		executable
		MD5:7235A3FAF0365CBBF90834249BAE9094	SHA256:37C6A7A837599D0BE0A5CE5AC6539602F8730560B6A4651A8839014601E68B1F
2168	BackgroundTransferHost.exe	C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\623563f1-2b8d-42b8-8d2c-be449839205d.up_meta_secure		binary
		MD5:53EBC2959D6337492B4FC90D624025B7	SHA256:2842DC30CA23EAC410A7063D7EADA1C244CEDB4530EF2DAA7F7626B107B7A949
2168	BackgroundTransferHost.exe	C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\623563f1-2b8d-42b8-8d2c-be449839205d.6d3dd9b8-0807-4e5f-bdf4-6b640a2ccb03.down_meta		binary
		MD5:247566EE62EE1B4592CCF03D210285D9	SHA256:853E535B5F0D6B9CD508E28EAA6E44A42C7EB80D4268BCBFFE7B8322171A61FC
4284	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\build_output\Microsoft.IdentityModel.Abstractions.dll		executable
		MD5:CAA3510E43036A0E8A9A501E0DE049C9	SHA256:70FA9D90416D867B01C9E95F5D1D530BCD1F4CC27057528CA398ADEB853BB49D

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

103

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
1048	svchost.exe	GET	200	172.66.2.5:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	US	binary	471 b	whitelisted
6384	backgroundTaskHost.exe	GET	200	172.66.2.5:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	US	binary	313 b	whitelisted
8084	backgroundTaskHost.exe	GET	200	172.66.2.5:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	US	binary	471 b	whitelisted
560	backgroundTaskHost.exe	GET	200	172.66.2.5:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	US	binary	471 b	whitelisted
4308	msedge.exe	GET	200	23.43.242.147:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	CA	binary	825 b	whitelisted
7404	svchost.exe	GET	206	199.232.210.172:80	http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ddbf4492-d475-4fe4-bcde-6cbac56f6034?P1=1759848313&P2=404&P3=2&P4=QmD8hVOGallZWXdGutWtCiw%2bAuJHW0g%2bzHFnCgimyucKC6u9Hr0F7DpLKi1RTATNldFTHvn2SfOxOc6CdIyP7g%3d%3d	US	binary	1.09 Kb	whitelisted
7404	svchost.exe	GET	206	199.232.210.172:80	http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ddbf4492-d475-4fe4-bcde-6cbac56f6034?P1=1759848313&P2=404&P3=2&P4=QmD8hVOGallZWXdGutWtCiw%2bAuJHW0g%2bzHFnCgimyucKC6u9Hr0F7DpLKi1RTATNldFTHvn2SfOxOc6CdIyP7g%3d%3d	US	compressed	770 b	whitelisted
1048	svchost.exe	GET	200	172.66.2.5:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	US	binary	471 b	whitelisted
2168	BackgroundTransferHost.exe	GET	200	172.66.2.5:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	US	binary	313 b	whitelisted
1124	msedge.exe	GET	200	150.171.28.11:80	http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:nz_cjpYI6oZkDGgkv4rjCRFRW2KoWNauk7pyTyPEvUI&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855	US	text	98 b	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4644	RUXIMICS.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
6016	MoUsoCoreWorker.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5224	SearchApp.exe	2.16.241.218:443	www.bing.com	Akamai International B.V.	DE	whitelisted
1048	svchost.exe	20.190.160.2:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
1048	svchost.exe	172.66.2.5:80	ocsp.digicert.com	—	US	whitelisted
6384	backgroundTaskHost.exe	2.16.241.218:443	www.bing.com	Akamai International B.V.	DE	whitelisted
6384	backgroundTaskHost.exe	172.66.2.5:80	ocsp.digicert.com	—	US	whitelisted
3464	svchost.exe	172.211.123.248:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	FR	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	40.127.240.158 4.231.128.59	whitelisted
google.com	142.250.186.110	whitelisted
www.bing.com	2.16.241.218 2.16.241.205 2.16.241.201 2.16.241.207 95.101.142.224 95.101.142.227 95.101.142.232 95.101.142.208 104.84.152.9 95.101.142.211 95.101.142.225 95.101.142.218 95.101.142.209 95.101.142.194 95.101.142.193 95.101.142.210 95.101.142.200 95.101.142.195 104.84.152.35 104.84.152.41 104.84.152.40 95.101.142.169 104.84.152.42 95.101.142.168 95.101.142.170 104.84.152.34 104.84.152.33	whitelisted
login.live.com	20.190.160.2 20.190.160.66 40.126.32.68 40.126.32.134 20.190.160.132 40.126.32.76 20.190.160.64 20.190.160.65	whitelisted
ocsp.digicert.com	172.66.2.5 162.159.142.9	whitelisted
client.wns.windows.com	172.211.123.248	whitelisted
arc.msn.com	20.223.35.26	whitelisted
fd.api.iris.microsoft.com	20.223.35.26	whitelisted
slscr.update.microsoft.com	20.165.94.63	whitelisted
fe3cr.delivery.mp.microsoft.com	52.165.164.15	whitelisted

Threats

PID	Process	Class	Message
—	—	Unknown Traffic	ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
—	—	Potentially Bad Traffic	ET INFO Possible Chrome Plugin install

Add for printing

Process	Message
Pulsar.exe	You must install .NET to run this application. App: C:\Users\admin\AppData\Local\Temp\build_output\Pulsar.exe Architecture: x64 App host version: 9.0.8 .NET location: Not found Learn more: https://aka.ms/dotnet/app-launch-failed Download the .NET runtime: https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win-x64&os=win10&apphost_version=9.0.8
Pulsar.exe	Failed to resolve hostfxr.dll [not found]. Error code: 0x80008083

General Info

build_output.zip

1A23377F00120EDEEE62105FFDC4E952

36DEC3BBA800AF3162E6C8735CB8D95EE092E9BE

0A2F2B09C962BD8C2878DFA8819DE370EDFF992D70A33FAA3A519DB0F17B393E

98304:n115OXNhs8xpJtArk9WgRMHA/UqSJnEhefSeKEC5fpMoYRFA8YPd7ZyhS1SUfg2R:7EW9GQrzwnkJbGTbrJ

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Changes the autorun value in the registry

SUSPICIOUS

Process drops legitimate windows executable

Reads security settings of Internet Explorer

Executable content was dropped or overwritten

Starts a Microsoft application from unusual location

Searches for installed software

Starts itself from another location

Reads the Windows owner or organization settings

The process creates files with name similar to system file names

The process drops C-runtime libraries

Application launched itself

Creates file in the systems drive root

Uses RUNDLL32.EXE to load library

INFO

Reads the software policy settings

Checks proxy server information

Reads security settings of Internet Explorer

Manual execution by a user

Application launched itself

Executable content was dropped or overwritten

Checks supported languages

Reads the computer name

Creates files or folders in the user directory

Reads Environment values

The sample compiled with english language support

Create files in a temporary directory

Process checks computer location settings

Launching a file from a Registry key

Creates files in the program directory

Creates a software uninstall entry

Reads the machine GUID from the registry

Reads product name

Reads Microsoft Office registry keys

Malware configuration

Static information

TRiD

EXIF

ZIP

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files