File name:

VVR.rar

Full analysis: https://app.any.run/tasks/4f26a124-8f92-40a6-a674-d4063fef159f
Verdict: Malicious activity
Analysis date: May 10, 2025, 03:29:07
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

638500058980D8EE387A1FF74C90A444

SHA1:

A5251BA703CF0989DBDE2EBD2FEC63140424F511

SHA256:

25D3686FA701A4A2CFEB75E9813D2273CBB60C7C0DF78C31DCA93A53108DB444

SSDEEP:

49152:fbBiU5HxsGLjP+xQPWtq8fkx66jSZTNaam2Rml5ZOt4pdfASzA2ykzmrjqx8Pc7w:zkUDnnNOtq3xFGCN2RI5ZOt4fY92ykzQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • aspex_helper.exe (PID: 7952)
      • aspex_helper.exe (PID: 7980)

    • Changes the autorun value in the registry

      • aspex_helper.exe (PID: 7952)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • aspex_helper.exe (PID: 7952)

    • Starts itself from another location

      • aspex_helper.exe (PID: 7952)

  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 1760)
      • aspex_helper.exe (PID: 7952)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1760)

    • Manual execution by a user

      • aspex_helper.exe (PID: 7952)

    • Reads the computer name

      • aspex_helper.exe (PID: 7952)
      • aspex_helper.exe (PID: 7980)

    • Checks supported languages

      • aspex_helper.exe (PID: 7952)
      • aspex_helper.exe (PID: 7980)

    • Creates files in the program directory

      • aspex_helper.exe (PID: 7952)

    • Checks proxy server information

      • aspex_helper.exe (PID: 7980)

    • Reads the software policy settings

      • aspex_helper.exe (PID: 7980)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 973773
UncompressedSize: 5131712
OperatingSystem: Win32
ArchivedFileName: VVR/aspex_helper.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
6
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe no specs rundll32.exe no specs aspex_helper.exe aspex_helper.exe

Process information

PID
CMD
Path
Indicators
Parent process
1760"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\VVR.rarC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7296C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
7340"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
7784C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
7952"C:\Users\admin\Desktop\VVR\VVR\aspex_helper.exe" C:\Users\admin\Desktop\VVR\VVR\aspex_helper.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\vvr\vvr\aspex_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7980C:\ProgramData\Microsoft\DeviceSync\Aspex\AspexHelperuHm\aspex_helper.exe 168 259 558C:\ProgramData\Microsoft\DeviceSync\Aspex\AspexHelperuHm\aspex_helper.exe
aspex_helper.exe
User:
admin
Integrity Level:
MEDIUM
Version:
1.0.0.0
Modules
Images
c:\programdata\microsoft\devicesync\aspex\aspexhelperuhm\aspex_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
2 134
Read events
2 108
Write events
13
Delete events
13

Modification events

(PID) Process:(1760) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(1760) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(1760) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(1760) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\VVR.rar
(PID) Process:(1760) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1760) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1760) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1760) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1760) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(1760) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
4
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
1760WinRAR.exeC:\Users\admin\Desktop\VVR\VVR\aspex_helper.exeexecutable
MD5:E3929989E95DDD72EEB619FE5E415550
SHA256:FF2BA3AE5FB195918FFAA542055E800FFB34815645D39377561A3ABDFDEA2239
1760WinRAR.exeC:\Users\admin\Desktop\VVR\VVR\RBGUIFramework.dllexecutable
MD5:141781E2FE4BEAA6D6C00C65A678CFD0
SHA256:CCBF3CF6A762B662C2B1FE90E3DD5762046CD79112F005BA785A8444CFC8F2D7
7952aspex_helper.exeC:\ProgramData\Microsoft\DeviceSync\Aspex\AspexHelperuHm\aspex_log.datbinary
MD5:379E513294DADD39BFF03706E8EE5CB7
SHA256:84E2DF98A0B0BF78461ED15C65362DAF4B87E67B7CCDC1BA93A0F9073F75512D
1760WinRAR.exeC:\Users\admin\Desktop\VVR\VVR\aspex_log.datbinary
MD5:379E513294DADD39BFF03706E8EE5CB7
SHA256:84E2DF98A0B0BF78461ED15C65362DAF4B87E67B7CCDC1BA93A0F9073F75512D
7952aspex_helper.exeC:\ProgramData\Microsoft\DeviceSync\Aspex\AspexHelperuHm\aspex_helper.exeexecutable
MD5:E3929989E95DDD72EEB619FE5E415550
SHA256:FF2BA3AE5FB195918FFAA542055E800FFB34815645D39377561A3ABDFDEA2239
7952aspex_helper.exeC:\ProgramData\Microsoft\DeviceSync\Aspex\AspexHelperuHm\RBGUIFramework.dllexecutable
MD5:141781E2FE4BEAA6D6C00C65A678CFD0
SHA256:CCBF3CF6A762B662C2B1FE90E3DD5762046CD79112F005BA785A8444CFC8F2D7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
23
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.20:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8012
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
8012
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6724
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.20:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.74:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.238
whitelisted
crl.microsoft.com
  • 23.216.77.20
  • 23.216.77.25
  • 23.216.77.28
  • 23.216.77.19
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 2.23.246.101
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.32.74
  • 20.190.160.128
  • 20.190.160.131
  • 20.190.160.64
  • 20.190.160.2
  • 40.126.32.76
  • 20.190.160.130
  • 20.190.160.66
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
kentscaffolders.com
  • 188.114.96.3
  • 188.114.97.3
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
VVR.rar