Malware analysis zapret-discord-youtube-1.9.7.zip Malicious activity

Add for printing

File name:	zapret-discord-youtube-1.9.7.zip
Full analysis:	https://app.any.run/tasks/a196255c-7a68-4f93-aa58-468fefb7903e
Verdict:	Malicious activity
Analysis date:	February 26, 2026, 22:41:12
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	windivert-sys mal-driver arch-exec arch-scr arch-doc github
Indicators:
MIME:	application/zip
File info:	Zip archive data, at least v2.0 to extract, compression method=store
MD5:	56FC869AE8CDE4D57318C4B2310D9916
SHA1:	C70FDDA61A5EBF6D5E4E47EEDCF9883FEB0C5C17
SHA256:	1093CB205650B0654C29CAE2341C8BD26CD645AA31D0682486DF58DD14486A79
SSDEEP:	49152:Pvw/Cv8X9eQS0s7eWvRlefNYLw1yD1LE6tVz64qEu1KufrHNW3FzmUS74G6+hefy:g/e8teQzUJRlSNYLeyD1DhdqCirtW3Fw

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
Google Chrome (133.0.6943.127)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (133.0.3065.92)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (136.0)
Mozilla Maintenance Service (136.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Detects Cygwin installation
  - WinRAR.exe (PID: 6980)
- Malicious driver has been detected
  - WinRAR.exe (PID: 6980)
- Starts NET.EXE for service management
  - cmd.exe (PID: 1492)
  - net.exe (PID: 1948)
SUSPICIOUS
- Executing commands from a ".bat" file
  - WinRAR.exe (PID: 6980)
  - powershell.exe (PID: 6936)
  - cmd.exe (PID: 1492)
- Starts CMD.EXE for commands execution
  - WinRAR.exe (PID: 6980)
  - cmd.exe (PID: 7656)
  - cmd.exe (PID: 2748)
  - cmd.exe (PID: 7916)
  - cmd.exe (PID: 6424)
  - cmd.exe (PID: 6240)
  - cmd.exe (PID: 8996)
  - cmd.exe (PID: 4424)
  - cmd.exe (PID: 6084)
  - cmd.exe (PID: 6360)
  - cmd.exe (PID: 1080)
  - cmd.exe (PID: 2372)
  - cmd.exe (PID: 6340)
  - cmd.exe (PID: 7288)
  - cmd.exe (PID: 6440)
  - cmd.exe (PID: 8680)
  - cmd.exe (PID: 3644)
  - cmd.exe (PID: 1676)
  - cmd.exe (PID: 6108)
  - cmd.exe (PID: 7712)
  - cmd.exe (PID: 2864)
  - cmd.exe (PID: 8636)
  - cmd.exe (PID: 2480)
  - powershell.exe (PID: 6936)
  - cmd.exe (PID: 1492)
  - cmd.exe (PID: 4072)
  - cmd.exe (PID: 6352)
  - cmd.exe (PID: 8284)
  - cmd.exe (PID: 4188)
  - cmd.exe (PID: 6216)
  - cmd.exe (PID: 7644)
  - cmd.exe (PID: 6920)
  - cmd.exe (PID: 6756)
  - cmd.exe (PID: 3548)
  - cmd.exe (PID: 8616)
  - cmd.exe (PID: 7748)
  - cmd.exe (PID: 7224)
  - cmd.exe (PID: 6936)
- Starts application with an unusual extension
  - cmd.exe (PID: 8352)
  - cmd.exe (PID: 8976)
  - cmd.exe (PID: 6924)
  - cmd.exe (PID: 7656)
  - cmd.exe (PID: 2748)
  - cmd.exe (PID: 7916)
  - cmd.exe (PID: 6084)
  - cmd.exe (PID: 6424)
  - cmd.exe (PID: 6240)
  - cmd.exe (PID: 8996)
  - cmd.exe (PID: 4424)
  - cmd.exe (PID: 6360)
  - cmd.exe (PID: 1080)
  - cmd.exe (PID: 2372)
  - cmd.exe (PID: 6340)
  - cmd.exe (PID: 7288)
  - cmd.exe (PID: 6440)
  - cmd.exe (PID: 3644)
  - cmd.exe (PID: 8680)
  - cmd.exe (PID: 1676)
  - cmd.exe (PID: 6108)
  - cmd.exe (PID: 7712)
  - cmd.exe (PID: 2864)
  - cmd.exe (PID: 8636)
  - cmd.exe (PID: 2480)
  - cmd.exe (PID: 1492)
  - cmd.exe (PID: 4188)
  - cmd.exe (PID: 6216)
  - cmd.exe (PID: 7644)
  - cmd.exe (PID: 6920)
  - cmd.exe (PID: 3548)
  - cmd.exe (PID: 6756)
  - cmd.exe (PID: 7748)
  - cmd.exe (PID: 8616)
  - cmd.exe (PID: 7224)
  - cmd.exe (PID: 6936)
- Creates file in the systems drive root
  - WinRAR.exe (PID: 6980)
- Drops a system driver (possible attempt to evade defenses)
  - WinRAR.exe (PID: 6980)
- Application launched itself
  - cmd.exe (PID: 7656)
  - cmd.exe (PID: 2748)
  - cmd.exe (PID: 7916)
  - cmd.exe (PID: 6084)
  - cmd.exe (PID: 6424)
  - cmd.exe (PID: 6240)
  - cmd.exe (PID: 8996)
  - cmd.exe (PID: 4424)
  - cmd.exe (PID: 6360)
  - cmd.exe (PID: 1080)
  - cmd.exe (PID: 6340)
  - cmd.exe (PID: 2372)
  - cmd.exe (PID: 7288)
  - cmd.exe (PID: 6440)
  - cmd.exe (PID: 3644)
  - cmd.exe (PID: 8680)
  - cmd.exe (PID: 1676)
  - cmd.exe (PID: 6108)
  - cmd.exe (PID: 7712)
  - cmd.exe (PID: 2864)
  - cmd.exe (PID: 8636)
  - cmd.exe (PID: 2480)
  - cmd.exe (PID: 1492)
  - cmd.exe (PID: 4072)
  - cmd.exe (PID: 6352)
  - cmd.exe (PID: 8284)
  - cmd.exe (PID: 6216)
  - cmd.exe (PID: 4188)
  - cmd.exe (PID: 7644)
  - cmd.exe (PID: 6920)
  - cmd.exe (PID: 6756)
  - cmd.exe (PID: 3548)
  - cmd.exe (PID: 8616)
  - cmd.exe (PID: 7748)
  - cmd.exe (PID: 7224)
  - cmd.exe (PID: 6936)
- Windows service management via SC.EXE
  - sc.exe (PID: 8736)
  - sc.exe (PID: 412)
  - sc.exe (PID: 7664)
  - sc.exe (PID: 7700)
  - sc.exe (PID: 1432)
  - sc.exe (PID: 8488)
  - sc.exe (PID: 7020)
  - sc.exe (PID: 3560)
  - sc.exe (PID: 8944)
  - sc.exe (PID: 1488)
  - sc.exe (PID: 936)
  - sc.exe (PID: 1792)
  - sc.exe (PID: 2456)
  - sc.exe (PID: 7620)
  - sc.exe (PID: 7244)
  - sc.exe (PID: 8460)
  - sc.exe (PID: 3628)
  - sc.exe (PID: 5896)
  - sc.exe (PID: 8408)
  - sc.exe (PID: 7712)
  - sc.exe (PID: 7768)
  - sc.exe (PID: 4144)
- Suspicious use of NETSH.EXE
  - cmd.exe (PID: 7656)
  - cmd.exe (PID: 7916)
  - cmd.exe (PID: 6424)
  - cmd.exe (PID: 8996)
  - cmd.exe (PID: 6360)
  - cmd.exe (PID: 2372)
  - cmd.exe (PID: 7288)
  - cmd.exe (PID: 3644)
  - cmd.exe (PID: 1676)
  - cmd.exe (PID: 7712)
  - cmd.exe (PID: 8636)
  - cmd.exe (PID: 1492)
  - cmd.exe (PID: 4188)
  - cmd.exe (PID: 7644)
  - cmd.exe (PID: 3548)
  - cmd.exe (PID: 8616)
  - cmd.exe (PID: 6936)
- Using 'findstr.exe' to search for text patterns in files and output
  - cmd.exe (PID: 7656)
  - cmd.exe (PID: 5040)
  - cmd.exe (PID: 7284)
  - cmd.exe (PID: 7916)
  - cmd.exe (PID: 3236)
  - cmd.exe (PID: 6424)
  - cmd.exe (PID: 6376)
  - cmd.exe (PID: 8996)
  - cmd.exe (PID: 6360)
  - cmd.exe (PID: 8764)
  - cmd.exe (PID: 2372)
  - cmd.exe (PID: 7288)
  - cmd.exe (PID: 4852)
  - cmd.exe (PID: 4288)
  - cmd.exe (PID: 3644)
  - cmd.exe (PID: 7928)
  - cmd.exe (PID: 1676)
  - cmd.exe (PID: 7712)
  - cmd.exe (PID: 6796)
  - cmd.exe (PID: 7416)
  - cmd.exe (PID: 8636)
  - cmd.exe (PID: 1492)
  - cmd.exe (PID: 6936)
  - cmd.exe (PID: 3644)
  - cmd.exe (PID: 2620)
  - cmd.exe (PID: 7372)
  - cmd.exe (PID: 4188)
  - cmd.exe (PID: 4712)
  - cmd.exe (PID: 7644)
  - cmd.exe (PID: 2416)
  - cmd.exe (PID: 3548)
  - cmd.exe (PID: 8616)
  - cmd.exe (PID: 7700)
  - cmd.exe (PID: 4288)
  - cmd.exe (PID: 6936)
- Starts SC.EXE for service management
  - cmd.exe (PID: 5040)
  - cmd.exe (PID: 7284)
  - cmd.exe (PID: 3236)
  - cmd.exe (PID: 6376)
  - cmd.exe (PID: 8764)
  - cmd.exe (PID: 7372)
  - cmd.exe (PID: 4852)
  - cmd.exe (PID: 4288)
  - cmd.exe (PID: 7928)
  - cmd.exe (PID: 6796)
  - cmd.exe (PID: 7416)
  - cmd.exe (PID: 1492)
  - cmd.exe (PID: 6936)
  - cmd.exe (PID: 2620)
  - cmd.exe (PID: 3644)
  - cmd.exe (PID: 4712)
  - cmd.exe (PID: 2416)
  - cmd.exe (PID: 7700)
  - cmd.exe (PID: 4288)
- Hides command output
  - cmd.exe (PID: 5728)
  - cmd.exe (PID: 7924)
  - cmd.exe (PID: 7428)
  - cmd.exe (PID: 1844)
  - cmd.exe (PID: 3500)
  - cmd.exe (PID: 3536)
  - cmd.exe (PID: 3208)
  - cmd.exe (PID: 2712)
  - cmd.exe (PID: 5100)
  - cmd.exe (PID: 8572)
  - cmd.exe (PID: 3440)
  - cmd.exe (PID: 4072)
  - cmd.exe (PID: 6240)
  - cmd.exe (PID: 6352)
  - cmd.exe (PID: 6600)
  - cmd.exe (PID: 8284)
  - cmd.exe (PID: 7292)
  - cmd.exe (PID: 8648)
  - cmd.exe (PID: 1188)
  - cmd.exe (PID: 5408)
  - cmd.exe (PID: 7820)
- Starts POWERSHELL.EXE for commands execution
  - cmd.exe (PID: 5728)
  - cmd.exe (PID: 7428)
  - cmd.exe (PID: 7924)
  - cmd.exe (PID: 1844)
  - cmd.exe (PID: 3500)
  - cmd.exe (PID: 3536)
  - cmd.exe (PID: 3208)
  - cmd.exe (PID: 2712)
  - cmd.exe (PID: 5100)
  - cmd.exe (PID: 8572)
  - cmd.exe (PID: 3440)
  - cmd.exe (PID: 8532)
  - cmd.exe (PID: 9204)
  - cmd.exe (PID: 1084)
  - cmd.exe (PID: 1492)
  - cmd.exe (PID: 7292)
  - cmd.exe (PID: 8648)
  - cmd.exe (PID: 1188)
  - cmd.exe (PID: 5408)
  - cmd.exe (PID: 7820)
- The process bypasses the loading of PowerShell profile settings
  - cmd.exe (PID: 5728)
  - cmd.exe (PID: 7924)
  - cmd.exe (PID: 7428)
  - cmd.exe (PID: 1844)
  - cmd.exe (PID: 3500)
  - cmd.exe (PID: 3536)
  - cmd.exe (PID: 3208)
  - cmd.exe (PID: 2712)
  - cmd.exe (PID: 5100)
  - cmd.exe (PID: 8572)
  - cmd.exe (PID: 3440)
  - cmd.exe (PID: 8532)
  - cmd.exe (PID: 9204)
  - cmd.exe (PID: 1084)
  - cmd.exe (PID: 1492)
  - cmd.exe (PID: 7292)
  - cmd.exe (PID: 8648)
  - cmd.exe (PID: 1188)
  - cmd.exe (PID: 5408)
  - cmd.exe (PID: 7820)
- Starts process via Powershell
  - powershell.exe (PID: 6936)
- Probably obfuscated PowerShell command line is found
  - cmd.exe (PID: 9204)
  - cmd.exe (PID: 1084)
- Filtering the input of cmdlet (POWERSHELL)
  - powershell.exe (PID: 6804)
  - powershell.exe (PID: 8572)
- Returns all items found within a container (POWERSHELL)
  - powershell.exe (PID: 6804)
  - powershell.exe (PID: 8572)
- Creates a new Windows service
  - sc.exe (PID: 7000)
- Executes as Windows Service
  - winws.exe (PID: 6708)
- Creates or modifies Windows services
  - reg.exe (PID: 6440)
- Uses REG/REGEDIT.EXE to modify registry
  - cmd.exe (PID: 1492)
- Bypass execution policy to execute commands
  - powershell.exe (PID: 4072)
- Get information on the list of running processes
  - cmd.exe (PID: 1492)
INFO
- Reads security settings of Internet Explorer
  - WinRAR.exe (PID: 6980)
- Checks supported languages
  - chcp.com (PID: 4856)
  - chcp.com (PID: 7476)
  - chcp.com (PID: 2248)
  - chcp.com (PID: 6072)
  - chcp.com (PID: 6360)
  - chcp.com (PID: 8004)
  - winws.exe (PID: 7104)
  - chcp.com (PID: 3152)
  - chcp.com (PID: 8732)
  - chcp.com (PID: 7540)
  - winws.exe (PID: 2760)
  - chcp.com (PID: 2248)
  - chcp.com (PID: 4852)
  - chcp.com (PID: 5768)
  - chcp.com (PID: 7620)
  - winws.exe (PID: 6200)
  - chcp.com (PID: 3560)
  - chcp.com (PID: 8048)
  - winws.exe (PID: 8680)
  - chcp.com (PID: 792)
  - chcp.com (PID: 3976)
  - chcp.com (PID: 7652)
  - chcp.com (PID: 6284)
  - winws.exe (PID: 8912)
  - chcp.com (PID: 8508)
  - chcp.com (PID: 8512)
  - winws.exe (PID: 2284)
  - chcp.com (PID: 5484)
  - chcp.com (PID: 1352)
  - chcp.com (PID: 1840)
  - winws.exe (PID: 7464)
  - chcp.com (PID: 7696)
  - chcp.com (PID: 7988)
  - chcp.com (PID: 9148)
  - winws.exe (PID: 4992)
  - chcp.com (PID: 8180)
  - winws.exe (PID: 6392)
  - chcp.com (PID: 6216)
  - chcp.com (PID: 1036)
  - chcp.com (PID: 7428)
  - chcp.com (PID: 8852)
  - winws.exe (PID: 2460)
  - chcp.com (PID: 8404)
  - chcp.com (PID: 2328)
  - chcp.com (PID: 9040)
  - chcp.com (PID: 8044)
  - winws.exe (PID: 5180)
  - chcp.com (PID: 2912)
  - chcp.com (PID: 8520)
  - chcp.com (PID: 5708)
  - chcp.com (PID: 8828)
  - chcp.com (PID: 3388)
  - chcp.com (PID: 6992)
  - chcp.com (PID: 8788)
  - chcp.com (PID: 1884)
  - winws.exe (PID: 6708)
  - chcp.com (PID: 3696)
  - chcp.com (PID: 4856)
  - chcp.com (PID: 492)
  - chcp.com (PID: 4024)
  - chcp.com (PID: 7656)
  - chcp.com (PID: 5804)
  - chcp.com (PID: 6584)
  - chcp.com (PID: 6348)
  - winws.exe (PID: 6392)
  - chcp.com (PID: 2248)
  - chcp.com (PID: 7488)
  - chcp.com (PID: 9176)
  - winws.exe (PID: 7612)
  - chcp.com (PID: 4272)
  - chcp.com (PID: 4724)
  - chcp.com (PID: 9140)
  - winws.exe (PID: 6504)
  - chcp.com (PID: 2496)
  - winws.exe (PID: 3172)
  - chcp.com (PID: 2452)
  - chcp.com (PID: 2620)
  - chcp.com (PID: 5708)
  - chcp.com (PID: 9032)
  - winws.exe (PID: 6036)
- Changes the display of characters in the console
  - cmd.exe (PID: 8976)
  - cmd.exe (PID: 8352)
  - cmd.exe (PID: 6924)
  - cmd.exe (PID: 7656)
  - cmd.exe (PID: 2748)
  - cmd.exe (PID: 7916)
  - cmd.exe (PID: 6424)
  - cmd.exe (PID: 6240)
  - cmd.exe (PID: 4424)
  - cmd.exe (PID: 8996)
  - cmd.exe (PID: 6084)
  - cmd.exe (PID: 6360)
  - cmd.exe (PID: 2372)
  - cmd.exe (PID: 1080)
  - cmd.exe (PID: 6340)
  - cmd.exe (PID: 6440)
  - cmd.exe (PID: 7288)
  - cmd.exe (PID: 3644)
  - cmd.exe (PID: 8680)
  - cmd.exe (PID: 6108)
  - cmd.exe (PID: 1676)
  - cmd.exe (PID: 7712)
  - cmd.exe (PID: 2864)
  - cmd.exe (PID: 8636)
  - cmd.exe (PID: 2480)
  - cmd.exe (PID: 1492)
  - cmd.exe (PID: 4188)
  - cmd.exe (PID: 6216)
  - cmd.exe (PID: 7644)
  - cmd.exe (PID: 6920)
  - cmd.exe (PID: 3548)
  - cmd.exe (PID: 6756)
  - cmd.exe (PID: 8616)
  - cmd.exe (PID: 7748)
  - cmd.exe (PID: 6936)
  - cmd.exe (PID: 7224)
- Drops script file
  - cmd.exe (PID: 8352)
  - cmd.exe (PID: 6924)
  - WinRAR.exe (PID: 6980)
  - cmd.exe (PID: 8976)
  - cmd.exe (PID: 7656)
  - cmd.exe (PID: 2748)
  - powershell.exe (PID: 1084)
  - cmd.exe (PID: 7916)
  - cmd.exe (PID: 6084)
  - powershell.exe (PID: 5992)
  - cmd.exe (PID: 6424)
  - cmd.exe (PID: 6240)
  - cmd.exe (PID: 8996)
  - powershell.exe (PID: 8700)
  - cmd.exe (PID: 4424)
  - powershell.exe (PID: 5872)
  - cmd.exe (PID: 6360)
  - cmd.exe (PID: 1080)
  - cmd.exe (PID: 2372)
  - powershell.exe (PID: 4644)
  - cmd.exe (PID: 6340)
  - cmd.exe (PID: 7288)
  - powershell.exe (PID: 7644)
  - powershell.exe (PID: 4200)
  - cmd.exe (PID: 6440)
  - cmd.exe (PID: 3644)
  - powershell.exe (PID: 2036)
  - cmd.exe (PID: 8680)
  - cmd.exe (PID: 6108)
  - cmd.exe (PID: 1676)
  - powershell.exe (PID: 4856)
  - cmd.exe (PID: 7712)
  - cmd.exe (PID: 2864)
  - powershell.exe (PID: 7964)
  - cmd.exe (PID: 8636)
  - powershell.exe (PID: 5888)
  - cmd.exe (PID: 2480)
  - powershell.exe (PID: 6936)
  - cmd.exe (PID: 1492)
  - cmd.exe (PID: 8532)
  - powershell.exe (PID: 6804)
  - cmd.exe (PID: 5772)
  - powershell.exe (PID: 8572)
  - cmd.exe (PID: 4188)
  - powershell.exe (PID: 4072)
  - cmd.exe (PID: 6216)
  - powershell.exe (PID: 3048)
  - powershell.exe (PID: 6924)
  - cmd.exe (PID: 6920)
  - cmd.exe (PID: 7644)
  - cmd.exe (PID: 3548)
  - cmd.exe (PID: 6756)
  - powershell.exe (PID: 752)
  - cmd.exe (PID: 8616)
  - cmd.exe (PID: 7748)
  - powershell.exe (PID: 1704)
  - cmd.exe (PID: 7224)
  - cmd.exe (PID: 6936)
  - powershell.exe (PID: 7860)
- The sample compiled with english language support
  - WinRAR.exe (PID: 6980)
- Executable content was dropped or overwritten
  - WinRAR.exe (PID: 6980)
- Manual execution by a user
  - cmd.exe (PID: 7656)
  - cmd.exe (PID: 7916)
  - cmd.exe (PID: 6424)
  - cmd.exe (PID: 8996)
  - cmd.exe (PID: 6360)
  - cmd.exe (PID: 2372)
  - cmd.exe (PID: 7288)
  - cmd.exe (PID: 3644)
  - cmd.exe (PID: 1676)
  - cmd.exe (PID: 7712)
  - cmd.exe (PID: 8636)
  - cmd.exe (PID: 8532)
  - osk.exe (PID: 8912)
  - osk.exe (PID: 4924)
  - cmd.exe (PID: 4188)
  - cmd.exe (PID: 7644)
  - cmd.exe (PID: 3548)
  - cmd.exe (PID: 8616)
  - cmd.exe (PID: 6936)
- Disables trace logs
  - netsh.exe (PID: 7560)
  - netsh.exe (PID: 7244)
  - powershell.exe (PID: 1084)
  - netsh.exe (PID: 7824)
  - netsh.exe (PID: 4292)
  - powershell.exe (PID: 5992)
  - netsh.exe (PID: 5636)
  - netsh.exe (PID: 5484)
  - powershell.exe (PID: 8700)
  - netsh.exe (PID: 9020)
  - netsh.exe (PID: 5700)
  - powershell.exe (PID: 5872)
  - netsh.exe (PID: 8952)
  - netsh.exe (PID: 2856)
  - powershell.exe (PID: 4644)
  - netsh.exe (PID: 8536)
  - netsh.exe (PID: 3952)
  - powershell.exe (PID: 7644)
  - netsh.exe (PID: 1188)
  - netsh.exe (PID: 5548)
  - powershell.exe (PID: 4200)
  - netsh.exe (PID: 5516)
  - netsh.exe (PID: 7004)
  - netsh.exe (PID: 3628)
  - netsh.exe (PID: 2096)
  - powershell.exe (PID: 2036)
  - netsh.exe (PID: 9088)
  - netsh.exe (PID: 5872)
  - powershell.exe (PID: 4856)
  - powershell.exe (PID: 7964)
  - netsh.exe (PID: 2332)
  - netsh.exe (PID: 132)
  - powershell.exe (PID: 5888)
  - netsh.exe (PID: 6424)
  - netsh.exe (PID: 1508)
  - netsh.exe (PID: 8388)
  - netsh.exe (PID: 416)
  - powershell.exe (PID: 3048)
  - netsh.exe (PID: 2256)
  - powershell.exe (PID: 6924)
  - netsh.exe (PID: 6720)
  - powershell.exe (PID: 1704)
  - netsh.exe (PID: 8996)
  - powershell.exe (PID: 752)
  - powershell.exe (PID: 7860)
- Reads the computer name
  - winws.exe (PID: 7104)
  - winws.exe (PID: 2760)
  - winws.exe (PID: 6200)
  - winws.exe (PID: 8680)
  - winws.exe (PID: 8912)
  - winws.exe (PID: 2284)
  - winws.exe (PID: 7464)
  - winws.exe (PID: 4992)
  - winws.exe (PID: 6392)
  - winws.exe (PID: 2460)
  - winws.exe (PID: 5180)
  - winws.exe (PID: 6708)
  - winws.exe (PID: 6392)
  - winws.exe (PID: 7612)
  - winws.exe (PID: 6504)
  - winws.exe (PID: 3172)
  - winws.exe (PID: 6036)
- The sample was built using Cygwin
  - winws.exe (PID: 7104)
  - winws.exe (PID: 2760)
  - winws.exe (PID: 6200)
  - winws.exe (PID: 8680)
  - winws.exe (PID: 8912)
  - winws.exe (PID: 2284)
  - winws.exe (PID: 7464)
  - winws.exe (PID: 4992)
  - winws.exe (PID: 6392)
  - winws.exe (PID: 2460)
  - winws.exe (PID: 5180)
  - winws.exe (PID: 6392)
  - winws.exe (PID: 7612)
  - winws.exe (PID: 6504)
  - winws.exe (PID: 3172)
  - winws.exe (PID: 6036)
- Checks proxy server information
  - powershell.exe (PID: 1084)
  - powershell.exe (PID: 8700)
  - powershell.exe (PID: 5872)
  - powershell.exe (PID: 5992)
  - powershell.exe (PID: 4644)
  - powershell.exe (PID: 7644)
  - powershell.exe (PID: 4200)
  - powershell.exe (PID: 2036)
  - powershell.exe (PID: 4856)
  - powershell.exe (PID: 7964)
  - slui.exe (PID: 552)
  - powershell.exe (PID: 5888)
  - powershell.exe (PID: 3048)
  - powershell.exe (PID: 6924)
  - powershell.exe (PID: 1704)
  - powershell.exe (PID: 752)
  - powershell.exe (PID: 7860)
- Uses string replace method (POWERSHELL)
  - powershell.exe (PID: 6804)
  - powershell.exe (PID: 8572)
- Search a value from a registry key
  - cmd.exe (PID: 6600)
  - reg.exe (PID: 9196)
- Returns hidden items found within a container (POWERSHELL)
  - conhost.exe (PID: 8240)
  - conhost.exe (PID: 6792)
  - conhost.exe (PID: 8748)
  - conhost.exe (PID: 3236)
  - conhost.exe (PID: 7448)
  - conhost.exe (PID: 3576)
  - conhost.exe (PID: 6200)
  - conhost.exe (PID: 3032)
  - conhost.exe (PID: 8004)
  - conhost.exe (PID: 5696)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.zip	\|	ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion:	20
ZipBitFlag:	-
ZipCompression:	None
ZipModifyDate:	2026:02:23 13:30:58
ZipCRC:	0x00000000
ZipCompressedSize:	-
ZipUncompressedSize:	-
ZipFileName:	bin/

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

678

Monitored processes

506

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

132

netsh interface tcp show global

C:\Windows\System32\netsh.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Network Command Shell

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

412

sc query "zapret"

C:\Windows\System32\sc.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Service Control Manager Configuration Tool

Exit code:

1060

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll

416

netsh interface tcp show global

C:\Windows\System32\netsh.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Network Command Shell

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

492

findstr /i "enabled"

C:\Windows\System32\findstr.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Find String (QGREP) Utility

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

492

chcp 437

C:\Windows\System32\chcp.com

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Change CodePage Utility

Exit code:

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll

508

findstr /R "^203\.0\.113\.113/32f7f81a39-5f63-5b42-9efd-1f13b5431005quot; "C:\Users\admin\Desktop\lists\ipset-all.txt"

C:\Windows\System32\findstr.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Find String (QGREP) Utility

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

508

findstr ":"

C:\Windows\System32\findstr.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Find String (QGREP) Utility

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

552

C:\WINDOWS\System32\slui.exe -Embedding

C:\Windows\System32\slui.exe

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Activation Client

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

676

"C:\Users\admin\Desktop\bin\winws.exe" --wf-tcp=80,443,2053,2083,2087,2096,8443,12 --wf-udp=443,19294-19344,50000-50100,12 --filter-udp=443 --hostlist="C:\Users\admin\Desktop\lists\list-general.txt" --hostlist="C:\Users\admin\Desktop\lists\list-general-user.txt" --hostlist-exclude="C:\Users\admin\Desktop\lists\list-exclude.txt" --hostlist-exclude="C:\Users\admin\Desktop\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\admin\Desktop\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\admin\Desktop\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\admin\Desktop\bin\quic_initial_www_google_com.bin" --new --filter-udp=19294-19344,50000-50100 --filter-l7=discord,stun --dpi-desync=fake --dpi-desync-repeats=6 --new --filter-tcp=2053,2083,2087,2096,8443 --hostlist-domains=discord.media --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\admin\Desktop\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=443 --hostlist="C:\Users\admin\Desktop\lists\list-google.txt" --ip-id=zero --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\admin\Desktop\bin\tls_clienthello_www_google_com.bin" --new --filter-tcp=80,443 --hostlist="C:\Users\admin\Desktop\lists\list-general.txt" --hostlist="C:\Users\admin\Desktop\lists\list-general-user.txt" --hostlist-exclude="C:\Users\admin\Desktop\lists\list-exclude.txt" --hostlist-exclude="C:\Users\admin\Desktop\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\admin\Desktop\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\admin\Desktop\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\admin\Desktop\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\admin\Desktop\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\admin\Desktop\bin\tls_clienthello_max_ru.bin" --new --filter-udp=443 --ipset="C:\Users\admin\Desktop\lists\ipset-all.txt" --hostlist-exclude="C:\Users\admin\Desktop\lists\list-exclude.txt" --hostlist-exclude="C:\Users\admin\Desktop\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\admin\Desktop\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\admin\Desktop\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fake-quic="C:\Users\admin\Desktop\bin\quic_initial_www_google_com.bin" --new --filter-tcp=80,443,8443 --ipset="C:\Users\admin\Desktop\lists\ipset-all.txt" --hostlist-exclude="C:\Users\admin\Desktop\lists\list-exclude.txt" --hostlist-exclude="C:\Users\admin\Desktop\lists\list-exclude-user.txt" --ipset-exclude="C:\Users\admin\Desktop\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\admin\Desktop\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\admin\Desktop\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\admin\Desktop\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\admin\Desktop\bin\tls_clienthello_max_ru.bin" --new --filter-tcp=12 --ipset="C:\Users\admin\Desktop\lists\ipset-all.txt" --ipset-exclude="C:\Users\admin\Desktop\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\admin\Desktop\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=6 --dpi-desync-any-protocol=1 --dpi-desync-cutoff=n4 --dpi-desync-fooling=ts --dpi-desync-fake-tls="C:\Users\admin\Desktop\bin\stun.bin" --dpi-desync-fake-tls="C:\Users\admin\Desktop\bin\tls_clienthello_www_google_com.bin" --dpi-desync-fake-http="C:\Users\admin\Desktop\bin\tls_clienthello_max_ru.bin" --new --filter-udp=12 --ipset="C:\Users\admin\Desktop\lists\ipset-all.txt" --ipset-exclude="C:\Users\admin\Desktop\lists\ipset-exclude.txt" --ipset-exclude="C:\Users\admin\Desktop\lists\ipset-exclude-user.txt" --dpi-desync=fake --dpi-desync-repeats=12 --dpi-desync-any-protocol=1 --dpi-desync-fake-unknown-udp="C:\Users\admin\Desktop\bin\quic_initial_www_google_com.bin" --dpi-desync-cutoff=n3

C:\Users\admin\Desktop\bin\winws.exe

—

cmd.exe

User:

admin

Integrity Level:

MEDIUM

Exit code:

3221226540

Modules

Images
c:\users\admin\desktop\bin\winws.exe
c:\windows\system32\ntdll.dll

680

C:\WINDOWS\system32\cmd.exe /S /D /c" type "C:\Users\admin\Desktop\lists\ipset-all.txt" 2>nul"

C:\Windows\System32\cmd.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Windows Command Processor

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll

Add for printing

Total events

123 308

Read events

122 145

Write events

1 149

Delete events

Modification events


(PID) Process:	(6980) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:	write	Name:	ShellExtBMP
Value:
(PID) Process:	(6980) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:	write	Name:	ShellExtIcon
Value:
(PID) Process:	(6980) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	3
Value: C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:	(6980) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	2
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:	(6980) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	1
Value: C:\Users\admin\Downloads\chromium_build 1.zip
(PID) Process:	(6980) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	0
Value: C:\Users\admin\AppData\Local\Temp\zapret-discord-youtube-1.9.7.zip
(PID) Process:	(6980) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	name
Value: 120
(PID) Process:	(6980) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	size
Value: 80
(PID) Process:	(6980) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	type
Value: 120
(PID) Process:	(6980) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	mtime
Value: 100

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
6980	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$DIa6980.31961\general (ALT).bat		text
		MD5:D355B57B5F43DF082D8337A807D4F2D1	SHA256:1C0B20341128CA2DFF78902ACF5270A071D7EA65C7694549D4269C7730B61D1E
6980	WinRAR.exe	C:\Users\admin\Desktop\bin\cygwin1.dll		executable
		MD5:A1C82ED072DC079DD7851F82D9AA7678	SHA256:103104A52E5293CE418944725DF19E2BF81AD9269B9A120D71D39028E821499B
6980	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$DIa6980.32690\general (ALT3).bat		text
		MD5:1DC3CAA65A31E27A19665C0628E90FBF	SHA256:5E50CBD4E74796A8FB42555B076CB1B7D5ABCF5FFE1227C8D82F17826732B37A
6980	WinRAR.exe	C:\Users\admin\Desktop\general (ALT3).bat		text
		MD5:1DC3CAA65A31E27A19665C0628E90FBF	SHA256:5E50CBD4E74796A8FB42555B076CB1B7D5ABCF5FFE1227C8D82F17826732B37A
6980	WinRAR.exe	C:\Users\admin\Desktop\bin\quic_initial_www_google_com.bin		binary
		MD5:312526D39958D89B1F8AB67789AB985F	SHA256:F4589C57749F956BB30538197A521D7005F8B0A8723B4707E72405E51DDAC50A
6980	WinRAR.exe	C:\Users\admin\Desktop\bin\tls_clienthello_max_ru.bin		binary
		MD5:B2B3E684CE449B60F0BC5A9028221A08	SHA256:4EE0870ABE0A0128600B0095189987BA1D210DAE8BF963BC725AFF49CF922624
6980	WinRAR.exe	C:\Users\admin\Desktop\bin\stun.bin		binary
		MD5:0357596C0E38A10A4B99DCA2032419CC	SHA256:9CD5469309780CA56C0BD97266524A48C7EE529D02C3179CFECB20B260A59641
6980	WinRAR.exe	C:\Users\admin\Desktop\bin\tls_clienthello_4pda_to.bin		binary
		MD5:E6D649DE132C3C10CB62531EF74F5B73	SHA256:EEFEAF09DDE8D69B1F176212541F63C68B314A33A335ECED99A8A29F17254DA8
6980	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$DIa6980.32301\general (ALT2).bat		text
		MD5:D43F122288FF522B2D1A3886C09495D3	SHA256:3DFAB68519B23C747A6DE957C197C467B2DBE5C932AC24713B5D5E31F18F4AF2
6980	WinRAR.exe	C:\Users\admin\Desktop\bin\winws.exe		executable
		MD5:D498E19BC7A79DD1EFCB6B928CBE9909	SHA256:AFFB4F69D2EA302A7ABCCD5325D81826E140DDAE014F1E070BC4A6C0DD555188

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

119

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
7524	svchost.exe	GET	304	51.104.136.2:443	https://settings-win.data.microsoft.com/settings/v3.0/WSD/UpdateHealthTools?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&sampleId=s:95271487&appVer=10.0.19041.3626&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=4294967295&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=SedimentPack&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2	unknown	—	—	whitelisted
6768	MoUsoCoreWorker.exe	GET	304	51.104.136.2:443	https://settings-win.data.microsoft.com/settings/v3.0/OneSettings/Client?OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&LocalDeviceID=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&AttrDataVer=186&OSUILocale=en-US&OSSkuId=48&App=WOSC&AppVer=&IsFlightingEnabled=0&TelemetryLevel=1&DeviceFamily=Windows.Desktop	unknown	—	—	whitelisted
3192	SIHClient.exe	GET	304	74.178.76.128:443	https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL	unknown	—	—	whitelisted
3192	SIHClient.exe	GET	200	135.233.95.135:443	https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping	unknown	—	—	whitelisted
3192	SIHClient.exe	GET	200	74.178.76.128:443	https://slscr.update.microsoft.com/sls/ping	unknown	—	—	whitelisted
3192	SIHClient.exe	GET	304	74.178.76.128:443	https://slscr.update.microsoft.com/SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL	unknown	—	—	whitelisted
7524	svchost.exe	GET	200	51.104.136.2:443	https://settings-win.data.microsoft.com/settings/v3.0/WSD/WaaSAssessment?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&ring=Retail&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=10.0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=4294967295&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=WaaSAssessment&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&ServicingBranch=CB&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&HonorWUfBDeferrals=0&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2	unknown	text	5.70 Kb	whitelisted
7524	svchost.exe	GET	200	23.48.23.50:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
7524	svchost.exe	GET	200	23.52.181.212:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
356	svchost.exe	POST	200	20.190.160.4:443	https://login.live.com/RST2.srf	unknown	binary	11.1 Kb	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	Not routed	—	whitelisted
7524	svchost.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
7208	RUXIMICS.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
6768	MoUsoCoreWorker.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
4	System	192.168.100.255:138	—	Not routed	—	whitelisted
7524	svchost.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
7524	svchost.exe	23.48.23.50:80	crl.microsoft.com	AKAMAI-ASN1	NL	whitelisted
7524	svchost.exe	23.52.181.212:80	www.microsoft.com	AKAMAI-AS	US	whitelisted
3412	svchost.exe	172.211.123.250:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
6768	MoUsoCoreWorker.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	51.124.78.146 51.104.136.2	whitelisted
self.events.data.microsoft.com	20.189.173.24 51.11.192.48	whitelisted
google.com	172.217.20.142	whitelisted
crl.microsoft.com	23.48.23.50 23.48.23.9 23.48.23.38 23.48.23.58 23.48.23.30 23.48.23.29 23.48.23.11 23.48.23.32 23.48.23.10 23.48.23.33 23.48.23.35 23.48.23.24 23.48.23.20 23.48.23.8 23.48.23.31 23.48.23.18	whitelisted
www.microsoft.com	23.52.181.212	whitelisted
client.wns.windows.com	172.211.123.250	whitelisted
login.live.com	20.190.160.4 40.126.32.133 40.126.32.72 20.190.160.131 40.126.32.68 20.190.160.17 20.190.160.128 20.190.160.20 40.126.31.1 40.126.31.131 40.126.31.73 20.190.159.71 20.190.159.0 20.190.159.131 20.190.159.130 40.126.31.69	whitelisted
ocsp.digicert.com	162.159.142.9 172.66.2.5 184.30.131.245	whitelisted
slscr.update.microsoft.com	74.178.76.128	whitelisted
fe3cr.delivery.mp.microsoft.com	135.233.95.135	whitelisted

Threats

PID	Process	Class	Message
7524	svchost.exe	Unknown Traffic	ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
2292	svchost.exe	Not Suspicious Traffic	INFO [ANY.RUN] Attempting to access raw user content on GitHub
1084	powershell.exe	Not Suspicious Traffic	ET INFO Windows Powershell User-Agent Usage
5992	powershell.exe	Not Suspicious Traffic	ET INFO Windows Powershell User-Agent Usage
8700	powershell.exe	Not Suspicious Traffic	ET INFO Windows Powershell User-Agent Usage
5872	powershell.exe	Not Suspicious Traffic	ET INFO Windows Powershell User-Agent Usage
4644	powershell.exe	Not Suspicious Traffic	ET INFO Windows Powershell User-Agent Usage
7644	powershell.exe	Not Suspicious Traffic	ET INFO Windows Powershell User-Agent Usage
4200	powershell.exe	Not Suspicious Traffic	ET INFO Windows Powershell User-Agent Usage
2036	powershell.exe	Not Suspicious Traffic	ET INFO Windows Powershell User-Agent Usage

Add for printing

No debug info

General Info

zapret-discord-youtube-1.9.7.zip

56FC869AE8CDE4D57318C4B2310D9916

C70FDDA61A5EBF6D5E4E47EEDCF9883FEB0C5C17

1093CB205650B0654C29CAE2341C8BD26CD645AA31D0682486DF58DD14486A79

49152:Pvw/Cv8X9eQS0s7eWvRlefNYLw1yD1LE6tVz64qEu1KufrHNW3FzmUS74G6+hefy:g/e8teQzUJRlSNYLeyD1DhdqCirtW3Fw

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Detects Cygwin installation

Malicious driver has been detected

Starts NET.EXE for service management

SUSPICIOUS

Executing commands from a ".bat" file

Starts CMD.EXE for commands execution

Starts application with an unusual extension

Creates file in the systems drive root

Drops a system driver (possible attempt to evade defenses)

Application launched itself

Windows service management via SC.EXE

Suspicious use of NETSH.EXE

Using 'findstr.exe' to search for text patterns in files and output

Starts SC.EXE for service management

Hides command output

Starts POWERSHELL.EXE for commands execution

The process bypasses the loading of PowerShell profile settings

Starts process via Powershell

Probably obfuscated PowerShell command line is found

Filtering the input of cmdlet (POWERSHELL)

Returns all items found within a container (POWERSHELL)

Creates a new Windows service

Executes as Windows Service

Creates or modifies Windows services

Uses REG/REGEDIT.EXE to modify registry

Bypass execution policy to execute commands

Get information on the list of running processes

INFO

Reads security settings of Internet Explorer

Checks supported languages

Changes the display of characters in the console

Drops script file

The sample compiled with english language support

Executable content was dropped or overwritten

Manual execution by a user

Disables trace logs

Reads the computer name

The sample was built using Cygwin

Checks proxy server information

Uses string replace method (POWERSHELL)

Search a value from a registry key

Returns hidden items found within a container (POWERSHELL)

Malware configuration

Static information

TRiD

EXIF

ZIP

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules