Malware analysis zapret-discord-youtube-1.9.7.zip Malicious activity

Add for printing

File name:	zapret-discord-youtube-1.9.7.zip
Full analysis:	https://app.any.run/tasks/a196255c-7a68-4f93-aa58-468fefb7903e
Verdict:	Malicious activity
Analysis date:	February 26, 2026, 22:41:12
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	windivert-sys mal-driver arch-exec arch-scr arch-doc github
Indicators:
MIME:	application/zip
File info:	Zip archive data, at least v2.0 to extract, compression method=store
MD5:	56FC869AE8CDE4D57318C4B2310D9916
SHA1:	C70FDDA61A5EBF6D5E4E47EEDCF9883FEB0C5C17
SHA256:	1093CB205650B0654C29CAE2341C8BD26CD645AA31D0682486DF58DD14486A79
SSDEEP:	49152:Pvw/Cv8X9eQS0s7eWvRlefNYLw1yD1LE6tVz64qEu1KufrHNW3FzmUS74G6+hefy:g/e8teQzUJRlSNYLeyD1DhdqCirtW3Fw

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
Google Chrome (133.0.6943.127)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (133.0.3065.92)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (136.0)
Mozilla Maintenance Service (136.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Detects Cygwin installation
  - WinRAR.exe (PID: 6980)
- Malicious driver has been detected
  - WinRAR.exe (PID: 6980)
- Starts NET.EXE for service management
  - cmd.exe (PID: 1492)
  - net.exe (PID: 1948)
SUSPICIOUS
- Executing commands from a ".bat" file
  - WinRAR.exe (PID: 6980)
  - powershell.exe (PID: 6936)
  - cmd.exe (PID: 1492)
- Starts CMD.EXE for commands execution
  - WinRAR.exe (PID: 6980)
  - cmd.exe (PID: 7656)
  - cmd.exe (PID: 2748)
  - cmd.exe (PID: 7916)
  - cmd.exe (PID: 6084)
  - cmd.exe (PID: 6424)
  - cmd.exe (PID: 6240)
  - cmd.exe (PID: 8996)
  - cmd.exe (PID: 4424)
  - cmd.exe (PID: 6360)
  - cmd.exe (PID: 1080)
  - cmd.exe (PID: 2372)
  - cmd.exe (PID: 6340)
  - cmd.exe (PID: 7288)
  - cmd.exe (PID: 6440)
  - cmd.exe (PID: 3644)
  - cmd.exe (PID: 8680)
  - cmd.exe (PID: 1676)
  - cmd.exe (PID: 7712)
  - cmd.exe (PID: 6108)
  - cmd.exe (PID: 2864)
  - cmd.exe (PID: 8636)
  - cmd.exe (PID: 2480)
  - powershell.exe (PID: 6936)
  - cmd.exe (PID: 1492)
  - cmd.exe (PID: 4072)
  - cmd.exe (PID: 6352)
  - cmd.exe (PID: 8284)
  - cmd.exe (PID: 4188)
  - cmd.exe (PID: 6216)
  - cmd.exe (PID: 7644)
  - cmd.exe (PID: 6920)
  - cmd.exe (PID: 6756)
  - cmd.exe (PID: 3548)
  - cmd.exe (PID: 8616)
  - cmd.exe (PID: 7748)
  - cmd.exe (PID: 7224)
  - cmd.exe (PID: 6936)
- Starts application with an unusual extension
  - cmd.exe (PID: 8352)
  - cmd.exe (PID: 8976)
  - cmd.exe (PID: 6924)
  - cmd.exe (PID: 7656)
  - cmd.exe (PID: 2748)
  - cmd.exe (PID: 7916)
  - cmd.exe (PID: 6084)
  - cmd.exe (PID: 6424)
  - cmd.exe (PID: 6240)
  - cmd.exe (PID: 4424)
  - cmd.exe (PID: 8996)
  - cmd.exe (PID: 6360)
  - cmd.exe (PID: 1080)
  - cmd.exe (PID: 2372)
  - cmd.exe (PID: 6340)
  - cmd.exe (PID: 7288)
  - cmd.exe (PID: 6440)
  - cmd.exe (PID: 3644)
  - cmd.exe (PID: 8680)
  - cmd.exe (PID: 1676)
  - cmd.exe (PID: 6108)
  - cmd.exe (PID: 7712)
  - cmd.exe (PID: 2864)
  - cmd.exe (PID: 2480)
  - cmd.exe (PID: 8636)
  - cmd.exe (PID: 1492)
  - cmd.exe (PID: 4188)
  - cmd.exe (PID: 6216)
  - cmd.exe (PID: 7644)
  - cmd.exe (PID: 6920)
  - cmd.exe (PID: 3548)
  - cmd.exe (PID: 6756)
  - cmd.exe (PID: 8616)
  - cmd.exe (PID: 7748)
  - cmd.exe (PID: 6936)
  - cmd.exe (PID: 7224)
- Creates file in the systems drive root
  - WinRAR.exe (PID: 6980)
- Drops a system driver (possible attempt to evade defenses)
  - WinRAR.exe (PID: 6980)
- Application launched itself
  - cmd.exe (PID: 7656)
  - cmd.exe (PID: 2748)
  - cmd.exe (PID: 7916)
  - cmd.exe (PID: 6084)
  - cmd.exe (PID: 6424)
  - cmd.exe (PID: 6240)
  - cmd.exe (PID: 8996)
  - cmd.exe (PID: 4424)
  - cmd.exe (PID: 6360)
  - cmd.exe (PID: 1080)
  - cmd.exe (PID: 2372)
  - cmd.exe (PID: 6340)
  - cmd.exe (PID: 7288)
  - cmd.exe (PID: 6440)
  - cmd.exe (PID: 3644)
  - cmd.exe (PID: 8680)
  - cmd.exe (PID: 6108)
  - cmd.exe (PID: 1676)
  - cmd.exe (PID: 7712)
  - cmd.exe (PID: 2864)
  - cmd.exe (PID: 8636)
  - cmd.exe (PID: 2480)
  - cmd.exe (PID: 1492)
  - cmd.exe (PID: 4072)
  - cmd.exe (PID: 6352)
  - cmd.exe (PID: 8284)
  - cmd.exe (PID: 4188)
  - cmd.exe (PID: 7644)
  - cmd.exe (PID: 6216)
  - cmd.exe (PID: 6920)
  - cmd.exe (PID: 6756)
  - cmd.exe (PID: 3548)
  - cmd.exe (PID: 8616)
  - cmd.exe (PID: 7748)
  - cmd.exe (PID: 6936)
  - cmd.exe (PID: 7224)
- Windows service management via SC.EXE
  - sc.exe (PID: 8736)
  - sc.exe (PID: 412)
  - sc.exe (PID: 7664)
  - sc.exe (PID: 7700)
  - sc.exe (PID: 1432)
  - sc.exe (PID: 8488)
  - sc.exe (PID: 7020)
  - sc.exe (PID: 3560)
  - sc.exe (PID: 8944)
  - sc.exe (PID: 1488)
  - sc.exe (PID: 936)
  - sc.exe (PID: 2456)
  - sc.exe (PID: 7620)
  - sc.exe (PID: 1792)
  - sc.exe (PID: 7244)
  - sc.exe (PID: 5896)
  - sc.exe (PID: 8460)
  - sc.exe (PID: 3628)
  - sc.exe (PID: 8408)
  - sc.exe (PID: 7712)
  - sc.exe (PID: 7768)
  - sc.exe (PID: 4144)
- Starts SC.EXE for service management
  - cmd.exe (PID: 5040)
  - cmd.exe (PID: 3236)
  - cmd.exe (PID: 6376)
  - cmd.exe (PID: 8764)
  - cmd.exe (PID: 7284)
  - cmd.exe (PID: 7372)
  - cmd.exe (PID: 4852)
  - cmd.exe (PID: 4288)
  - cmd.exe (PID: 7928)
  - cmd.exe (PID: 6796)
  - cmd.exe (PID: 7416)
  - cmd.exe (PID: 1492)
  - cmd.exe (PID: 2620)
  - cmd.exe (PID: 6936)
  - cmd.exe (PID: 3644)
  - cmd.exe (PID: 4712)
  - cmd.exe (PID: 2416)
  - cmd.exe (PID: 7700)
  - cmd.exe (PID: 4288)
- Suspicious use of NETSH.EXE
  - cmd.exe (PID: 7656)
  - cmd.exe (PID: 7916)
  - cmd.exe (PID: 6424)
  - cmd.exe (PID: 8996)
  - cmd.exe (PID: 6360)
  - cmd.exe (PID: 2372)
  - cmd.exe (PID: 7288)
  - cmd.exe (PID: 3644)
  - cmd.exe (PID: 1676)
  - cmd.exe (PID: 7712)
  - cmd.exe (PID: 8636)
  - cmd.exe (PID: 1492)
  - cmd.exe (PID: 4188)
  - cmd.exe (PID: 7644)
  - cmd.exe (PID: 3548)
  - cmd.exe (PID: 8616)
  - cmd.exe (PID: 6936)
- Using 'findstr.exe' to search for text patterns in files and output
  - cmd.exe (PID: 7656)
  - cmd.exe (PID: 5040)
  - cmd.exe (PID: 7916)
  - cmd.exe (PID: 7284)
  - cmd.exe (PID: 6424)
  - cmd.exe (PID: 3236)
  - cmd.exe (PID: 6376)
  - cmd.exe (PID: 8996)
  - cmd.exe (PID: 8764)
  - cmd.exe (PID: 6360)
  - cmd.exe (PID: 7372)
  - cmd.exe (PID: 2372)
  - cmd.exe (PID: 4852)
  - cmd.exe (PID: 7288)
  - cmd.exe (PID: 4288)
  - cmd.exe (PID: 3644)
  - cmd.exe (PID: 7928)
  - cmd.exe (PID: 1676)
  - cmd.exe (PID: 6796)
  - cmd.exe (PID: 7712)
  - cmd.exe (PID: 7416)
  - cmd.exe (PID: 8636)
  - cmd.exe (PID: 1492)
  - cmd.exe (PID: 6936)
  - cmd.exe (PID: 2620)
  - cmd.exe (PID: 3644)
  - cmd.exe (PID: 4188)
  - cmd.exe (PID: 4712)
  - cmd.exe (PID: 7644)
  - cmd.exe (PID: 3548)
  - cmd.exe (PID: 2416)
  - cmd.exe (PID: 8616)
  - cmd.exe (PID: 7700)
  - cmd.exe (PID: 6936)
  - cmd.exe (PID: 4288)
- Hides command output
  - cmd.exe (PID: 5728)
  - cmd.exe (PID: 7428)
  - cmd.exe (PID: 7924)
  - cmd.exe (PID: 1844)
  - cmd.exe (PID: 3500)
  - cmd.exe (PID: 3536)
  - cmd.exe (PID: 3208)
  - cmd.exe (PID: 2712)
  - cmd.exe (PID: 5100)
  - cmd.exe (PID: 8572)
  - cmd.exe (PID: 3440)
  - cmd.exe (PID: 4072)
  - cmd.exe (PID: 6352)
  - cmd.exe (PID: 6240)
  - cmd.exe (PID: 8284)
  - cmd.exe (PID: 6600)
  - cmd.exe (PID: 7292)
  - cmd.exe (PID: 8648)
  - cmd.exe (PID: 1188)
  - cmd.exe (PID: 5408)
  - cmd.exe (PID: 7820)
- Starts POWERSHELL.EXE for commands execution
  - cmd.exe (PID: 5728)
  - cmd.exe (PID: 7428)
  - cmd.exe (PID: 7924)
  - cmd.exe (PID: 1844)
  - cmd.exe (PID: 3500)
  - cmd.exe (PID: 3536)
  - cmd.exe (PID: 3208)
  - cmd.exe (PID: 2712)
  - cmd.exe (PID: 5100)
  - cmd.exe (PID: 8572)
  - cmd.exe (PID: 3440)
  - cmd.exe (PID: 8532)
  - cmd.exe (PID: 9204)
  - cmd.exe (PID: 1084)
  - cmd.exe (PID: 1492)
  - cmd.exe (PID: 7292)
  - cmd.exe (PID: 8648)
  - cmd.exe (PID: 1188)
  - cmd.exe (PID: 5408)
  - cmd.exe (PID: 7820)
- The process bypasses the loading of PowerShell profile settings
  - cmd.exe (PID: 5728)
  - cmd.exe (PID: 7428)
  - cmd.exe (PID: 7924)
  - cmd.exe (PID: 1844)
  - cmd.exe (PID: 3500)
  - cmd.exe (PID: 3536)
  - cmd.exe (PID: 3208)
  - cmd.exe (PID: 2712)
  - cmd.exe (PID: 5100)
  - cmd.exe (PID: 8572)
  - cmd.exe (PID: 3440)
  - cmd.exe (PID: 8532)
  - cmd.exe (PID: 9204)
  - cmd.exe (PID: 1084)
  - cmd.exe (PID: 1492)
  - cmd.exe (PID: 7292)
  - cmd.exe (PID: 8648)
  - cmd.exe (PID: 1188)
  - cmd.exe (PID: 5408)
  - cmd.exe (PID: 7820)
- Starts process via Powershell
  - powershell.exe (PID: 6936)
- Probably obfuscated PowerShell command line is found
  - cmd.exe (PID: 9204)
  - cmd.exe (PID: 1084)
- Returns all items found within a container (POWERSHELL)
  - powershell.exe (PID: 6804)
  - powershell.exe (PID: 8572)
- Filtering the input of cmdlet (POWERSHELL)
  - powershell.exe (PID: 6804)
  - powershell.exe (PID: 8572)
- Creates or modifies Windows services
  - reg.exe (PID: 6440)
- Executes as Windows Service
  - winws.exe (PID: 6708)
- Uses REG/REGEDIT.EXE to modify registry
  - cmd.exe (PID: 1492)
- Creates a new Windows service
  - sc.exe (PID: 7000)
- Get information on the list of running processes
  - cmd.exe (PID: 1492)
- Bypass execution policy to execute commands
  - powershell.exe (PID: 4072)
INFO
- Drops script file
  - WinRAR.exe (PID: 6980)
  - cmd.exe (PID: 8352)
  - cmd.exe (PID: 8976)
  - cmd.exe (PID: 6924)
  - cmd.exe (PID: 7656)
  - cmd.exe (PID: 2748)
  - powershell.exe (PID: 1084)
  - cmd.exe (PID: 7916)
  - cmd.exe (PID: 6084)
  - powershell.exe (PID: 5992)
  - cmd.exe (PID: 6424)
  - cmd.exe (PID: 6240)
  - powershell.exe (PID: 8700)
  - cmd.exe (PID: 8996)
  - cmd.exe (PID: 4424)
  - powershell.exe (PID: 5872)
  - cmd.exe (PID: 6360)
  - cmd.exe (PID: 1080)
  - powershell.exe (PID: 4644)
  - cmd.exe (PID: 2372)
  - cmd.exe (PID: 6340)
  - powershell.exe (PID: 7644)
  - cmd.exe (PID: 7288)
  - cmd.exe (PID: 6440)
  - powershell.exe (PID: 4200)
  - cmd.exe (PID: 3644)
  - cmd.exe (PID: 8680)
  - powershell.exe (PID: 2036)
  - cmd.exe (PID: 6108)
  - cmd.exe (PID: 1676)
  - powershell.exe (PID: 4856)
  - cmd.exe (PID: 7712)
  - cmd.exe (PID: 2864)
  - powershell.exe (PID: 7964)
  - cmd.exe (PID: 8636)
  - cmd.exe (PID: 2480)
  - powershell.exe (PID: 5888)
  - cmd.exe (PID: 8532)
  - cmd.exe (PID: 1492)
  - powershell.exe (PID: 6936)
  - powershell.exe (PID: 6804)
  - powershell.exe (PID: 8572)
  - cmd.exe (PID: 5772)
  - powershell.exe (PID: 4072)
  - cmd.exe (PID: 6216)
  - cmd.exe (PID: 4188)
  - powershell.exe (PID: 3048)
  - cmd.exe (PID: 7644)
  - cmd.exe (PID: 6920)
  - cmd.exe (PID: 3548)
  - powershell.exe (PID: 6924)
  - cmd.exe (PID: 6756)
  - cmd.exe (PID: 7748)
  - powershell.exe (PID: 752)
  - cmd.exe (PID: 8616)
  - powershell.exe (PID: 1704)
  - powershell.exe (PID: 7860)
  - cmd.exe (PID: 6936)
  - cmd.exe (PID: 7224)
- Reads security settings of Internet Explorer
  - WinRAR.exe (PID: 6980)
- Changes the display of characters in the console
  - cmd.exe (PID: 8352)
  - cmd.exe (PID: 8976)
  - cmd.exe (PID: 6924)
  - cmd.exe (PID: 7656)
  - cmd.exe (PID: 2748)
  - cmd.exe (PID: 7916)
  - cmd.exe (PID: 6084)
  - cmd.exe (PID: 6424)
  - cmd.exe (PID: 6240)
  - cmd.exe (PID: 8996)
  - cmd.exe (PID: 4424)
  - cmd.exe (PID: 6360)
  - cmd.exe (PID: 1080)
  - cmd.exe (PID: 2372)
  - cmd.exe (PID: 6340)
  - cmd.exe (PID: 7288)
  - cmd.exe (PID: 6440)
  - cmd.exe (PID: 3644)
  - cmd.exe (PID: 8680)
  - cmd.exe (PID: 6108)
  - cmd.exe (PID: 1676)
  - cmd.exe (PID: 7712)
  - cmd.exe (PID: 2864)
  - cmd.exe (PID: 8636)
  - cmd.exe (PID: 2480)
  - cmd.exe (PID: 1492)
  - cmd.exe (PID: 6216)
  - cmd.exe (PID: 4188)
  - cmd.exe (PID: 7644)
  - cmd.exe (PID: 6920)
  - cmd.exe (PID: 3548)
  - cmd.exe (PID: 6756)
  - cmd.exe (PID: 8616)
  - cmd.exe (PID: 7748)
  - cmd.exe (PID: 6936)
  - cmd.exe (PID: 7224)
- Checks supported languages
  - chcp.com (PID: 4856)
  - chcp.com (PID: 7476)
  - chcp.com (PID: 2248)
  - chcp.com (PID: 6360)
  - chcp.com (PID: 8004)
  - chcp.com (PID: 6072)
  - winws.exe (PID: 7104)
  - chcp.com (PID: 3152)
  - chcp.com (PID: 7540)
  - chcp.com (PID: 8732)
  - winws.exe (PID: 2760)
  - chcp.com (PID: 2248)
  - chcp.com (PID: 4852)
  - chcp.com (PID: 5768)
  - chcp.com (PID: 7620)
  - winws.exe (PID: 6200)
  - chcp.com (PID: 3560)
  - chcp.com (PID: 8048)
  - chcp.com (PID: 792)
  - winws.exe (PID: 8680)
  - chcp.com (PID: 3976)
  - chcp.com (PID: 7652)
  - winws.exe (PID: 8912)
  - chcp.com (PID: 8508)
  - chcp.com (PID: 8512)
  - chcp.com (PID: 6284)
  - winws.exe (PID: 2284)
  - chcp.com (PID: 5484)
  - chcp.com (PID: 1352)
  - chcp.com (PID: 1840)
  - chcp.com (PID: 7696)
  - chcp.com (PID: 7988)
  - winws.exe (PID: 7464)
  - chcp.com (PID: 9148)
  - winws.exe (PID: 4992)
  - chcp.com (PID: 8180)
  - chcp.com (PID: 6216)
  - chcp.com (PID: 1036)
  - chcp.com (PID: 8852)
  - winws.exe (PID: 6392)
  - chcp.com (PID: 7428)
  - winws.exe (PID: 2460)
  - chcp.com (PID: 8404)
  - chcp.com (PID: 9040)
  - chcp.com (PID: 8044)
  - winws.exe (PID: 5180)
  - chcp.com (PID: 2328)
  - chcp.com (PID: 2912)
  - chcp.com (PID: 8520)
  - chcp.com (PID: 5708)
  - chcp.com (PID: 8788)
  - chcp.com (PID: 1884)
  - chcp.com (PID: 8828)
  - chcp.com (PID: 6992)
  - chcp.com (PID: 3388)
  - winws.exe (PID: 6708)
  - chcp.com (PID: 3696)
  - chcp.com (PID: 4856)
  - chcp.com (PID: 492)
  - chcp.com (PID: 4024)
  - chcp.com (PID: 6584)
  - chcp.com (PID: 7656)
  - chcp.com (PID: 5804)
  - winws.exe (PID: 6392)
  - chcp.com (PID: 6348)
  - chcp.com (PID: 2248)
  - chcp.com (PID: 7488)
  - chcp.com (PID: 9176)
  - winws.exe (PID: 7612)
  - chcp.com (PID: 4272)
  - chcp.com (PID: 4724)
  - winws.exe (PID: 6504)
  - chcp.com (PID: 2452)
  - chcp.com (PID: 9140)
  - winws.exe (PID: 3172)
  - chcp.com (PID: 2496)
  - chcp.com (PID: 2620)
  - chcp.com (PID: 9032)
  - chcp.com (PID: 5708)
  - winws.exe (PID: 6036)
- Executable content was dropped or overwritten
  - WinRAR.exe (PID: 6980)
- The sample compiled with english language support
  - WinRAR.exe (PID: 6980)
- Manual execution by a user
  - cmd.exe (PID: 7656)
  - cmd.exe (PID: 7916)
  - cmd.exe (PID: 6424)
  - cmd.exe (PID: 8996)
  - cmd.exe (PID: 6360)
  - cmd.exe (PID: 2372)
  - cmd.exe (PID: 7288)
  - cmd.exe (PID: 3644)
  - cmd.exe (PID: 1676)
  - cmd.exe (PID: 7712)
  - cmd.exe (PID: 8636)
  - cmd.exe (PID: 8532)
  - osk.exe (PID: 8912)
  - osk.exe (PID: 4924)
  - cmd.exe (PID: 4188)
  - cmd.exe (PID: 7644)
  - cmd.exe (PID: 3548)
  - cmd.exe (PID: 8616)
  - cmd.exe (PID: 6936)
- Disables trace logs
  - netsh.exe (PID: 7560)
  - netsh.exe (PID: 7244)
  - powershell.exe (PID: 1084)
  - netsh.exe (PID: 4292)
  - netsh.exe (PID: 7824)
  - powershell.exe (PID: 5992)
  - netsh.exe (PID: 5484)
  - netsh.exe (PID: 5636)
  - powershell.exe (PID: 8700)
  - netsh.exe (PID: 5700)
  - netsh.exe (PID: 9020)
  - powershell.exe (PID: 5872)
  - netsh.exe (PID: 2856)
  - netsh.exe (PID: 8952)
  - powershell.exe (PID: 4644)
  - netsh.exe (PID: 8536)
  - netsh.exe (PID: 3952)
  - powershell.exe (PID: 7644)
  - netsh.exe (PID: 1188)
  - netsh.exe (PID: 5548)
  - powershell.exe (PID: 4200)
  - netsh.exe (PID: 5516)
  - netsh.exe (PID: 7004)
  - powershell.exe (PID: 2036)
  - netsh.exe (PID: 2096)
  - netsh.exe (PID: 3628)
  - powershell.exe (PID: 4856)
  - netsh.exe (PID: 9088)
  - netsh.exe (PID: 5872)
  - netsh.exe (PID: 132)
  - netsh.exe (PID: 2332)
  - powershell.exe (PID: 7964)
  - powershell.exe (PID: 5888)
  - netsh.exe (PID: 1508)
  - netsh.exe (PID: 6424)
  - netsh.exe (PID: 8388)
  - netsh.exe (PID: 416)
  - powershell.exe (PID: 3048)
  - netsh.exe (PID: 2256)
  - powershell.exe (PID: 6924)
  - netsh.exe (PID: 6720)
  - powershell.exe (PID: 752)
  - powershell.exe (PID: 1704)
  - netsh.exe (PID: 8996)
  - powershell.exe (PID: 7860)
- The sample was built using Cygwin
  - winws.exe (PID: 7104)
  - winws.exe (PID: 2760)
  - winws.exe (PID: 6200)
  - winws.exe (PID: 8680)
  - winws.exe (PID: 8912)
  - winws.exe (PID: 2284)
  - winws.exe (PID: 7464)
  - winws.exe (PID: 4992)
  - winws.exe (PID: 6392)
  - winws.exe (PID: 2460)
  - winws.exe (PID: 5180)
  - winws.exe (PID: 6392)
  - winws.exe (PID: 7612)
  - winws.exe (PID: 6504)
  - winws.exe (PID: 3172)
  - winws.exe (PID: 6036)
- Reads the computer name
  - winws.exe (PID: 7104)
  - winws.exe (PID: 2760)
  - winws.exe (PID: 6200)
  - winws.exe (PID: 8680)
  - winws.exe (PID: 8912)
  - winws.exe (PID: 2284)
  - winws.exe (PID: 7464)
  - winws.exe (PID: 4992)
  - winws.exe (PID: 6392)
  - winws.exe (PID: 2460)
  - winws.exe (PID: 5180)
  - winws.exe (PID: 6708)
  - winws.exe (PID: 6392)
  - winws.exe (PID: 7612)
  - winws.exe (PID: 6504)
  - winws.exe (PID: 3172)
  - winws.exe (PID: 6036)
- Checks proxy server information
  - powershell.exe (PID: 1084)
  - powershell.exe (PID: 5992)
  - powershell.exe (PID: 8700)
  - powershell.exe (PID: 5872)
  - powershell.exe (PID: 4644)
  - powershell.exe (PID: 7644)
  - powershell.exe (PID: 4200)
  - powershell.exe (PID: 2036)
  - powershell.exe (PID: 4856)
  - powershell.exe (PID: 7964)
  - powershell.exe (PID: 5888)
  - slui.exe (PID: 552)
  - powershell.exe (PID: 3048)
  - powershell.exe (PID: 6924)
  - powershell.exe (PID: 752)
  - powershell.exe (PID: 1704)
  - powershell.exe (PID: 7860)
- Uses string replace method (POWERSHELL)
  - powershell.exe (PID: 6804)
  - powershell.exe (PID: 8572)
- Search a value from a registry key
  - cmd.exe (PID: 6600)
  - reg.exe (PID: 9196)
- Returns hidden items found within a container (POWERSHELL)
  - conhost.exe (PID: 8240)
  - conhost.exe (PID: 6792)
  - conhost.exe (PID: 8748)
  - conhost.exe (PID: 3236)
  - conhost.exe (PID: 7448)
  - conhost.exe (PID: 3576)
  - conhost.exe (PID: 6200)
  - conhost.exe (PID: 3032)
  - conhost.exe (PID: 8004)
  - conhost.exe (PID: 5696)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.zip	\|	ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion:	20
ZipBitFlag:	-
ZipCompression:	None
ZipModifyDate:	2026:02:23 13:30:58
ZipCRC:	0x00000000
ZipCompressedSize:	-
ZipUncompressedSize:	-
ZipFileName:	bin/

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

678

Monitored processes

506

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

132

netsh interface tcp show global

C:\Windows\System32\netsh.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Network Command Shell

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

412

sc query "zapret"

C:\Windows\System32\sc.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Service Control Manager Configuration Tool

Exit code:

1060

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll

416

netsh interface tcp show global

C:\Windows\System32\netsh.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Network Command Shell

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

492

findstr /i "enabled"

C:\Windows\System32\findstr.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Find String (QGREP) Utility

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

492

chcp 437

C:\Windows\System32\chcp.com

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Change CodePage Utility

Exit code:

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll

508

findstr /R "^203\.0\.113\.113/32f7f81a39-5f63-5b42-9efd-1f13b5431005quot; "C:\Users\admin\Desktop\lists\ipset-all.txt"

C:\Windows\System32\findstr.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Find String (QGREP) Utility

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

508

findstr ":"

C:\Windows\System32\findstr.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Find String (QGREP) Utility

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

552

C:\WINDOWS\System32\slui.exe -Embedding

C:\Windows\System32\slui.exe

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Activation Client

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

676

"C:\Users\admin\Desktop\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\admin\Desktop\lists\list-general.txt" --hostlist="C:\Users\admin\Desktop\lists\list-general-user.txt" --hostlist-exclude="C:\Users\admin\Desktop\lists\list-exclude.txt" --hostlist-exclude="C:\Users\admin\Desktop\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\admin\Desktop\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\admin\Desktop\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\admin\Desktop\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\admin\Desktop\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\admin\Desktop\lists\list-google.txt" --ip-id=zero --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\admin\Desktop\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\admin\Desktop\lists\list-general.txt" --hostlist="C:\Users\admin\Desktop\lists\list-general-user.txt" --hostlist-exclude="C:\Users\admin\Desktop\lists\list-exclude.txt" --hostlist-exclude="C:\Users\admin\Desktop\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\admin\Desktop\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\admin\Desktop\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\admin\Desktop\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\admin\Desktop\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\admin\Desktop\bin\tls_clienthello_max_ru.bin" --new --filter-udp=443 --ipset="C:\Users\admin\Desktop\lists\ipset-all.txt" --hostlist-exclude="C:\Users\admin\Desktop\lists\list-exclude.txt" --hostlist-exclude="C:\Users\admin\Desktop\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\admin\Desktop\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\admin\Desktop\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\admin\Desktop\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\admin\Desktop\lists\ipset-all.txt" --hostlist-exclude="C:\Users\admin\Desktop\lists\list-exclude.txt" --hostlist-exclude="C:\Users\admin\Desktop\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\admin\Desktop\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\admin\Desktop\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\admin\Desktop\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\admin\Desktop\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\admin\Desktop\bin\tls_clienthello_max_ru.bin" --new --filter-tcp=12 --ipset="C:\Users\admin\Desktop\lists\ipset-all.txt" --ipset-exclude="C:\Users\admin\Desktop\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\admin\Desktop\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\admin\Desktop\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\admin\Desktop\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\admin\Desktop\bin\tls_clienthello_max_ru.bin" --new --filter-udp=12 --ipset="C:\Users\admin\Desktop\lists\ipset-all.txt" --ipset-exclude="C:\Users\admin\Desktop\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\admin\Desktop\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\admin\Desktop\bin\quic_initial_www_google_com.bin" --dpi-desync-cutoff=n3

C:\Users\admin\Desktop\bin\winws.exe

—

cmd.exe

User:

admin

Integrity Level:

MEDIUM

Exit code:

3221226540

Modules

Images
c:\users\admin\desktop\bin\winws.exe
c:\windows\system32\ntdll.dll

680

C:\WINDOWS\system32\cmd.exe /S /D /c" type "C:\Users\admin\Desktop\lists\ipset-all.txt" 2>nul"

C:\Windows\System32\cmd.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Windows Command Processor

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll

Add for printing

Total events

123 308

Read events

122 145

Write events

1 149

Delete events

Modification events


(PID) Process:	(6980) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:	write	Name:	ShellExtBMP
Value:
(PID) Process:	(6980) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:	write	Name:	ShellExtIcon
Value:
(PID) Process:	(6980) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	3
Value: C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:	(6980) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	2
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:	(6980) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	1
Value: C:\Users\admin\Downloads\chromium_build 1.zip
(PID) Process:	(6980) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	0
Value: C:\Users\admin\AppData\Local\Temp\zapret-discord-youtube-1.9.7.zip
(PID) Process:	(6980) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	name
Value: 120
(PID) Process:	(6980) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	size
Value: 80
(PID) Process:	(6980) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	type
Value: 120
(PID) Process:	(6980) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	mtime
Value: 100

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
6980	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$DIa6980.31961\general (ALT).bat		text
		MD5:D355B57B5F43DF082D8337A807D4F2D1	SHA256:1C0B20341128CA2DFF78902ACF5270A071D7EA65C7694549D4269C7730B61D1E
6980	WinRAR.exe	C:\Users\admin\Desktop\bin\cygwin1.dll		executable
		MD5:A1C82ED072DC079DD7851F82D9AA7678	SHA256:103104A52E5293CE418944725DF19E2BF81AD9269B9A120D71D39028E821499B
6980	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$DIa6980.32690\general (ALT3).bat		text
		MD5:1DC3CAA65A31E27A19665C0628E90FBF	SHA256:5E50CBD4E74796A8FB42555B076CB1B7D5ABCF5FFE1227C8D82F17826732B37A
6980	WinRAR.exe	C:\Users\admin\Desktop\general (ALT3).bat		text
		MD5:1DC3CAA65A31E27A19665C0628E90FBF	SHA256:5E50CBD4E74796A8FB42555B076CB1B7D5ABCF5FFE1227C8D82F17826732B37A
6980	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$DIa6980.32301\general (ALT2).bat		text
		MD5:D43F122288FF522B2D1A3886C09495D3	SHA256:3DFAB68519B23C747A6DE957C197C467B2DBE5C932AC24713B5D5E31F18F4AF2
6980	WinRAR.exe	C:\Users\admin\Desktop\general (ALT10).bat		text
		MD5:409198F7C2281B7ABFA91FEC2A8F7F65	SHA256:9CE4A37AD5535B7B6316A0B8FB578D42AF87DFBE5077CDD077ED67901E603DBC
6980	WinRAR.exe	C:\Users\admin\Desktop\bin\WinDivert64.sys		executable
		MD5:89ED5BE7EA83C01D0DE33D3519944AA5	SHA256:8DA085332782708D8767BCACE5327A6EC7283C17CFB85E40B03CD2323A90DDC2
6980	WinRAR.exe	C:\Users\admin\Desktop\bin\winws.exe		executable
		MD5:D498E19BC7A79DD1EFCB6B928CBE9909	SHA256:AFFB4F69D2EA302A7ABCCD5325D81826E140DDAE014F1E070BC4A6C0DD555188
6980	WinRAR.exe	C:\Users\admin\Desktop\general (ALT).bat		text
		MD5:D355B57B5F43DF082D8337A807D4F2D1	SHA256:1C0B20341128CA2DFF78902ACF5270A071D7EA65C7694549D4269C7730B61D1E
6980	WinRAR.exe	C:\Users\admin\Desktop\general (ALT11).bat		text
		MD5:28DD9521447DB4339428553457CD1210	SHA256:C9BA68454E647C69D62A96ECA3B378E3BB60CD22CD66D759C945EE24FB073E2F

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

119

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
7524	svchost.exe	GET	304	51.104.136.2:443	https://settings-win.data.microsoft.com/settings/v3.0/WSD/UpdateHealthTools?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&sampleId=s:95271487&appVer=10.0.19041.3626&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=4294967295&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=SedimentPack&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2	US	—	—	whitelisted
6768	MoUsoCoreWorker.exe	GET	304	51.104.136.2:443	https://settings-win.data.microsoft.com/settings/v3.0/OneSettings/Client?OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&LocalDeviceID=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&AttrDataVer=186&OSUILocale=en-US&OSSkuId=48&App=WOSC&AppVer=&IsFlightingEnabled=0&TelemetryLevel=1&DeviceFamily=Windows.Desktop	US	—	—	whitelisted
3192	SIHClient.exe	GET	304	74.178.76.128:443	https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL	US	—	—	whitelisted
3192	SIHClient.exe	GET	200	135.233.95.135:443	https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping	US	—	—	whitelisted
3192	SIHClient.exe	GET	200	74.178.76.128:443	https://slscr.update.microsoft.com/sls/ping	US	—	—	whitelisted
3192	SIHClient.exe	GET	304	74.178.76.128:443	https://slscr.update.microsoft.com/SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL	US	—	—	whitelisted
356	svchost.exe	POST	200	20.190.160.4:443	https://login.live.com/RST2.srf	US	binary	11.1 Kb	whitelisted
7524	svchost.exe	GET	200	23.52.181.212:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	US	binary	814 b	whitelisted
7524	svchost.exe	GET	200	23.48.23.50:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	NL	binary	825 b	whitelisted
7524	svchost.exe	GET	200	51.104.136.2:443	https://settings-win.data.microsoft.com/settings/v3.0/WSD/WaaSAssessment?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&ring=Retail&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=10.0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=4294967295&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=WaaSAssessment&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&ServicingBranch=CB&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&HonorWUfBDeferrals=0&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2	US	text	5.70 Kb	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	Not routed	—	whitelisted
7524	svchost.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
7208	RUXIMICS.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
6768	MoUsoCoreWorker.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
4	System	192.168.100.255:138	—	Not routed	—	whitelisted
7524	svchost.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
7524	svchost.exe	23.48.23.50:80	crl.microsoft.com	AKAMAI-ASN1	NL	whitelisted
7524	svchost.exe	23.52.181.212:80	www.microsoft.com	AKAMAI-AS	US	whitelisted
3412	svchost.exe	172.211.123.250:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
6768	MoUsoCoreWorker.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	51.124.78.146 51.104.136.2	whitelisted
self.events.data.microsoft.com	20.189.173.24 51.11.192.48	whitelisted
google.com	172.217.20.142	whitelisted
crl.microsoft.com	23.48.23.50 23.48.23.9 23.48.23.38 23.48.23.58 23.48.23.30 23.48.23.29 23.48.23.11 23.48.23.32 23.48.23.10 23.48.23.33 23.48.23.35 23.48.23.24 23.48.23.20 23.48.23.8 23.48.23.31 23.48.23.18	whitelisted
www.microsoft.com	23.52.181.212	whitelisted
client.wns.windows.com	172.211.123.250	whitelisted
login.live.com	20.190.160.4 40.126.32.133 40.126.32.72 20.190.160.131 40.126.32.68 20.190.160.17 20.190.160.128 20.190.160.20 40.126.31.1 40.126.31.131 40.126.31.73 20.190.159.71 20.190.159.0 20.190.159.131 20.190.159.130 40.126.31.69	whitelisted
ocsp.digicert.com	162.159.142.9 172.66.2.5 184.30.131.245	whitelisted
slscr.update.microsoft.com	74.178.76.128	whitelisted
fe3cr.delivery.mp.microsoft.com	135.233.95.135	whitelisted

Threats

PID	Process	Class	Message
7524	svchost.exe	Unknown Traffic	ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
2292	svchost.exe	Not Suspicious Traffic	INFO [ANY.RUN] Attempting to access raw user content on GitHub
1084	powershell.exe	Not Suspicious Traffic	ET INFO Windows Powershell User-Agent Usage
5992	powershell.exe	Not Suspicious Traffic	ET INFO Windows Powershell User-Agent Usage
8700	powershell.exe	Not Suspicious Traffic	ET INFO Windows Powershell User-Agent Usage
5872	powershell.exe	Not Suspicious Traffic	ET INFO Windows Powershell User-Agent Usage
4644	powershell.exe	Not Suspicious Traffic	ET INFO Windows Powershell User-Agent Usage
7644	powershell.exe	Not Suspicious Traffic	ET INFO Windows Powershell User-Agent Usage
4200	powershell.exe	Not Suspicious Traffic	ET INFO Windows Powershell User-Agent Usage
2036	powershell.exe	Not Suspicious Traffic	ET INFO Windows Powershell User-Agent Usage

Add for printing

No debug info

General Info

zapret-discord-youtube-1.9.7.zip

56FC869AE8CDE4D57318C4B2310D9916

C70FDDA61A5EBF6D5E4E47EEDCF9883FEB0C5C17

1093CB205650B0654C29CAE2341C8BD26CD645AA31D0682486DF58DD14486A79

49152:Pvw/Cv8X9eQS0s7eWvRlefNYLw1yD1LE6tVz64qEu1KufrHNW3FzmUS74G6+hefy:g/e8teQzUJRlSNYLeyD1DhdqCirtW3Fw

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Detects Cygwin installation

Malicious driver has been detected

Starts NET.EXE for service management

SUSPICIOUS

Executing commands from a ".bat" file

Starts CMD.EXE for commands execution

Starts application with an unusual extension

Creates file in the systems drive root

Drops a system driver (possible attempt to evade defenses)

Application launched itself

Windows service management via SC.EXE

Starts SC.EXE for service management

Suspicious use of NETSH.EXE

Using 'findstr.exe' to search for text patterns in files and output

Hides command output

Starts POWERSHELL.EXE for commands execution

The process bypasses the loading of PowerShell profile settings

Starts process via Powershell

Probably obfuscated PowerShell command line is found

Returns all items found within a container (POWERSHELL)

Filtering the input of cmdlet (POWERSHELL)

Creates or modifies Windows services

Executes as Windows Service

Uses REG/REGEDIT.EXE to modify registry

Creates a new Windows service

Get information on the list of running processes

Bypass execution policy to execute commands

INFO

Drops script file

Reads security settings of Internet Explorer

Changes the display of characters in the console

Checks supported languages

Executable content was dropped or overwritten

The sample compiled with english language support

Manual execution by a user

Disables trace logs

The sample was built using Cygwin

Reads the computer name

Checks proxy server information

Uses string replace method (POWERSHELL)

Search a value from a registry key

Returns hidden items found within a container (POWERSHELL)

Malware configuration

Static information

TRiD

EXIF

ZIP

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules