File name:

๐Ÿ”ฎ ๏ฟฝDownloads โซฝ ๐“Ÿ๐“’ โซฝ ๐”๐‹๐“๐ˆ๐Œ๐€๐“๐„ โซฝ ๐“ข๐“”๐“ฃ๐“ค๐“Ÿ ๐Ÿ”ฎ.zip

Full analysis: https://app.any.run/tasks/935eef19-f1a2-47c0-8e30-a4c943ccb5cb
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victimsโ€™ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Trackerย ย ย ย ย >>>
Analysis date: May 17, 2025, 04:55:51
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
loader
arch-exec
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

77FEDF5464355930785DD94FF9C4939C

SHA1:

124ADB53D9C53F3182F7604A8B58D7763D242013

SHA256:

3BB92C7F5EE4A8040FFA91C218E77789C3BA50BCEEA282D04D4B0B08F1B26E5A

SSDEEP:

98304:DdGCmvidzYvTaqHBJj+eAN2dZraKcfJxpxm3aROmMt/tv9EjaNGM/E78ru1qNsvH:Mgv638+uthlHc6kypGBVt0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • Setup.exe (PID: 7256)
      • Setup.exe (PID: 7204)
      • hjksfve.exe (PID: 6972)
      • DistriCompiler89.exe (PID: 6964)
      • DistriCompiler89.exe (PID: 5244)
      • hjksfcm.exe (PID: 1072)
      • DistriCompiler89.exe (PID: 5968)
      • DistriCompiler89.exe (PID: 7884)
      • DistriCompiler89.exe (PID: 1512)
      • DistriCompiler89.exe (PID: 2616)
      • VirtuServer128.exe (PID: 5436)
      • VirtuServer128.exe (PID: 7912)

    • Actions looks like stealing of personal data

      • Setup.exe (PID: 7256)
      • Setup.exe (PID: 7204)
      • VirtuServer128.exe (PID: 5436)

    • Steals credentials from Web Browsers

      • Setup.exe (PID: 7256)
      • Setup.exe (PID: 7204)

    • Known privilege escalation attack

      • dllhost.exe (PID: 7844)

  • SUSPICIOUS

    • Potential Corporate Privacy Violation

      • Setup.exe (PID: 7256)
      • Setup.exe (PID: 7204)

    • Executable content was dropped or overwritten

      • Setup.exe (PID: 7256)
      • hjksfve.exe (PID: 6972)
      • DistriCompiler89.exe (PID: 6964)
      • DistriCompiler89.exe (PID: 5244)
      • Setup.exe (PID: 7204)
      • hjksfcm.exe (PID: 1072)
      • DistriCompiler89.exe (PID: 7884)
      • VirtuServer128.exe (PID: 5436)
      • MicrosoftEdgeWebview2Setup.exe (PID: 8024)

    • Reads security settings of Internet Explorer

      • hjksfve.exe (PID: 6972)
      • hjksfcm.exe (PID: 1072)
      • VirtuServer128.exe (PID: 5436)
      • MicrosoftEdgeUpdate.exe (PID: 672)

    • Starts itself from another location

      • DistriCompiler89.exe (PID: 6964)
      • DistriCompiler89.exe (PID: 5968)

    • Drops 7-zip archiver for unpacking

      • DistriCompiler89.exe (PID: 5244)

    • Process drops legitimate windows executable

      • Setup.exe (PID: 7204)
      • VirtuServer128.exe (PID: 5436)
      • MicrosoftEdgeWebview2Setup.exe (PID: 8024)
      • MicrosoftEdgeUpdate.exe (PID: 672)

    • The process drops C-runtime libraries

      • Setup.exe (PID: 7204)

    • There is functionality for taking screenshot (YARA)

      • DistriCompiler89.exe (PID: 5244)
      • DistriCompiler89.exe (PID: 1512)
      • DistriCompiler89.exe (PID: 7884)
      • DistriCompiler89.exe (PID: 2616)

    • Connects to unusual port

      • VirtuServer128.exe (PID: 5436)

    • Starts POWERSHELL.EXE for commands execution

      • VirtuServer128.exe (PID: 5436)

    • Starts process via Powershell

      • powershell.exe (PID: 2344)

    • Disables SEHOP

      • MicrosoftEdgeUpdate.exe (PID: 672)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeUpdate.exe (PID: 672)

  • INFO

    • Manual execution by a user

      • Setup.exe (PID: 7256)
      • Setup.exe (PID: 7204)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 7612)
      • DistriCompiler89.exe (PID: 5244)
      • Setup.exe (PID: 7204)
      • DistriCompiler89.exe (PID: 7884)
      • VirtuServer128.exe (PID: 5436)
      • MicrosoftEdgeWebview2Setup.exe (PID: 8024)
      • MicrosoftEdgeUpdate.exe (PID: 672)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7612)

    • Checks supported languages

      • Setup.exe (PID: 7256)
      • Setup.exe (PID: 7204)
      • elevation_service.exe (PID: 4164)
      • hjksfve.exe (PID: 6972)
      • DistriCompiler89.exe (PID: 6964)
      • DistriCompiler89.exe (PID: 5244)
      • elevation_service.exe (PID: 1052)
      • hjksfcm.exe (PID: 1072)
      • DistriCompiler89.exe (PID: 1512)
      • 7za.exe (PID: 5116)
      • DistriCompiler89.exe (PID: 7884)
      • 7za.exe (PID: 2268)
      • DistriCompiler89.exe (PID: 5968)
      • DistriCompiler89.exe (PID: 2616)
      • VirtuServer128.exe (PID: 5436)
      • VirtuServer128.exe (PID: 7912)
      • 7za.exe (PID: 2560)
      • 7za.exe (PID: 4448)
      • MicrosoftEdgeWebview2Setup.exe (PID: 8024)
      • MicrosoftEdgeUpdate.exe (PID: 672)

    • Reads the computer name

      • Setup.exe (PID: 7256)
      • elevation_service.exe (PID: 4164)
      • DistriCompiler89.exe (PID: 6964)
      • DistriCompiler89.exe (PID: 5244)
      • Setup.exe (PID: 7204)
      • hjksfve.exe (PID: 6972)
      • elevation_service.exe (PID: 1052)
      • hjksfcm.exe (PID: 1072)
      • DistriCompiler89.exe (PID: 1512)
      • 7za.exe (PID: 5116)
      • DistriCompiler89.exe (PID: 7884)
      • 7za.exe (PID: 2268)
      • DistriCompiler89.exe (PID: 5968)
      • DistriCompiler89.exe (PID: 2616)
      • VirtuServer128.exe (PID: 5436)
      • 7za.exe (PID: 2560)
      • VirtuServer128.exe (PID: 7912)
      • 7za.exe (PID: 4448)
      • MicrosoftEdgeUpdate.exe (PID: 672)

    • Reads the machine GUID from the registry

      • Setup.exe (PID: 7256)
      • Setup.exe (PID: 7204)
      • 7za.exe (PID: 5116)
      • 7za.exe (PID: 2268)
      • VirtuServer128.exe (PID: 5436)

    • Executes as Windows Service

      • elevation_service.exe (PID: 4164)
      • elevation_service.exe (PID: 1052)

    • Process checks computer location settings

      • hjksfve.exe (PID: 6972)
      • hjksfcm.exe (PID: 1072)
      • MicrosoftEdgeUpdate.exe (PID: 672)

    • Creates files in the program directory

      • DistriCompiler89.exe (PID: 6964)
      • DistriCompiler89.exe (PID: 5244)
      • DistriCompiler89.exe (PID: 7884)
      • VirtuServer128.exe (PID: 5436)
      • MicrosoftEdgeWebview2Setup.exe (PID: 8024)

    • Create files in a temporary directory

      • DistriCompiler89.exe (PID: 5244)
      • DistriCompiler89.exe (PID: 1512)
      • DistriCompiler89.exe (PID: 7884)
      • DistriCompiler89.exe (PID: 2616)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 7844)

    • Checks transactions between databases Windows and Oracle

      • 7za.exe (PID: 5116)
      • 7za.exe (PID: 2268)

    • Creates files or folders in the user directory

      • VirtuServer128.exe (PID: 5436)
      • wermgr.exe (PID: 6392)

    • Checks proxy server information

      • VirtuServer128.exe (PID: 5436)
      • slui.exe (PID: 7416)
      • MicrosoftEdgeUpdate.exe (PID: 672)
      • wermgr.exe (PID: 6392)

    • Reads the software policy settings

      • VirtuServer128.exe (PID: 5436)
      • slui.exe (PID: 7416)
      • MicrosoftEdgeUpdate.exe (PID: 672)
      • wermgr.exe (PID: 6392)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 672)
Find more information about signature artifacts and mapping to MITRE ATT&CKโ„ข MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: 0x0800
ZipCompression: None
ZipModifyDate: 2025:05:16 11:22:38
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: ๐Ÿ”ฎ ๏ฟฝ๏ฟฝ๏ฟฝDownloads โซฝ ๐“Ÿ๐“’ โซฝ ๐”๐‹๐“๐ˆ๐Œ๐€๐“๐„ โซฝ ๐“ข๐“”๐“ฃ๐“ค๐“Ÿ ๐Ÿ”ฎ/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
181
Monitored processes
47
Malicious processes
15
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs setup.exe setup.exe chrome.exe no specs msedge.exe no specs elevation_service.exe no specs chrome.exe no specs slui.exe msedge.exe no specs chrome.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs hjksfve.exe districompiler89.exe districompiler89.exe chrome.exe no specs msedge.exe no specs elevation_service.exe no specs chrome.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs chrome.exe no specs 7za.exe no specs msedge.exe no specs hjksfcm.exe districompiler89.exe no specs districompiler89.exe no specs conhost.exe no specs CMSTPLUA districompiler89.exe 7za.exe no specs conhost.exe no specs virtuserver128.exe districompiler89.exe no specs virtuserver128.exe no specs 7za.exe no specs conhost.exe no specs 7za.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs microsoftedgewebview2setup.exe microsoftedgeupdate.exe wermgr.exe

Process information

PID
CMD
Path
Indicators
Parent process
496"C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exeโ€”Setup.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
1
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
672"C:\Program Files (x86)\Microsoft\Temp\EUA8EA.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"C:\Program Files (x86)\Microsoft\Temp\EUA8EA.tmp\MicrosoftEdgeUpdate.exe
MicrosoftEdgeWebview2Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update
Exit code:
2147747592
Version:
1.3.195.25
Modules
Images
c:\program files (x86)\microsoft\temp\eua8ea.tmp\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
1052"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\elevation_service.exeโ€”services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\elevation_service.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\rpcrt4.dll
1072C:\Users\admin\hjksfcm.exeC:\Users\admin\hjksfcm.exe
Setup.exe
User:
admin
Company:
Oleg N. Scherbakov
Integrity Level:
MEDIUM
Description:
7z Setup SFX (x86)
Exit code:
0
Version:
1.4.0.1795
Modules
Images
c:\users\admin\hjksfcm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1180"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeโ€”Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
1
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1228"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeโ€”Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1452"C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exeโ€”Setup.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
1
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1512C:\ProgramData\Iaclientv2\DistriCompiler89.exeC:\ProgramData\Iaclientv2\DistriCompiler89.exeโ€”DistriCompiler89.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\programdata\iaclientv2\districompiler89.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\shlwapi.dll
c:\windows\syswow64\msvcrt.dll
2268"C:\ProgramData\Iaclientv2\7za.exe" "C:\ProgramData\Iaclientv2\7za.exe" a -t7z "C:\Users\admin\AppData\Roaming\app.7z" C:C:\ProgramData\Iaclientv2\7za.exeโ€”DistriCompiler89.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip Standalone Console
Exit code:
0
Version:
18.05
Modules
Images
c:\windows\system32\input.dll
c:\programdata\iaclientv2\7za.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2344powershell.exe -Command "Start-Process 'C:\ProgramData\MicrosoftEdgeWebview2Setup.exe' -ArgumentList '/silent','/install' -Wait"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeโ€”VirtuServer128.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
13ย 490
Read events
13ย 415
Write events
73
Delete events
2

Modification events

(PID) Process:(7612)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7612)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7612)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7612)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\๐Ÿ”ฎ ๏ฟฝDownloads โซฝ ๐“Ÿ๐“’ โซฝ ๐”๐‹๐“๐ˆ๐Œ๐€๐“๐„ โซฝ ๐“ข๐“”๐“ฃ๐“ค๐“Ÿ ๐Ÿ”ฎ.zip
(PID) Process:(7612)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7612)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7612)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7612)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4424)ย chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(4424)ย chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
Executable files
230
Suspicious files
60
Text files
113
Unknown types
0

Dropped files

PID
Process
Filename
Type
7612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7612.7916\๐Ÿ”ฎ ๏ฟฝDownloads โซฝ ๐“Ÿ๐“’ โซฝ ๐”๐‹๐“๐ˆ๐Œ๐€๐“๐„ โซฝ ๐“ข๐“”๐“ฃ๐“ค๐“Ÿ ๐Ÿ”ฎ\Assets\dllist_001.phpttext
MD5:73A3AC49D398DABAA52C15E7793802E1
SHA256:0B0F39BAAD12AEFCD39CC9BD1F9266D908F4474578541CA1DFAFFAF846A1F930
7612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7612.7916\๐Ÿ”ฎ ๏ฟฝDownloads โซฝ ๐“Ÿ๐“’ โซฝ ๐”๐‹๐“๐ˆ๐Œ๐€๐“๐„ โซฝ ๐“ข๐“”๐“ฃ๐“ค๐“Ÿ ๐Ÿ”ฎ\Assets\bug32160.phpttext
MD5:176E9FE3ED6945A511B2F242C5523677
SHA256:B65C3E7D140E5C7D5AA58494F675CBCAD2DE031FEBCF4F5F579C7ED4F3747E2D
7612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7612.7916\๐Ÿ”ฎ ๏ฟฝDownloads โซฝ ๐“Ÿ๐“’ โซฝ ๐”๐‹๐“๐ˆ๐Œ๐€๐“๐„ โซฝ ๐“ข๐“”๐“ฃ๐“ค๐“Ÿ ๐Ÿ”ฎ\Assets\bug51671.phpttext
MD5:E388651554207223390A5EA399D57376
SHA256:0C2BB31F91EAD24E65BB9DCF4D8E5E811AABE3522763BC8CE99EAB05DCA4EBC6
7612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7612.7916\๐Ÿ”ฎ ๏ฟฝDownloads โซฝ ๐“Ÿ๐“’ โซฝ ๐”๐‹๐“๐ˆ๐Œ๐€๐“๐„ โซฝ ๐“ข๐“”๐“ฃ๐“ค๐“Ÿ ๐Ÿ”ฎ\Assets\bzip2.phpttext
MD5:699B2A7EC8D07CF51001CC4E0503769F
SHA256:CA1FC86743870368E7E378F5A8D061D245849308BCC486D7E0C314DBB57CB654
7612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7612.7916\๐Ÿ”ฎ ๏ฟฝDownloads โซฝ ๐“Ÿ๐“’ โซฝ ๐”๐‹๐“๐ˆ๐Œ๐€๐“๐„ โซฝ ๐“ข๐“”๐“ฃ๐“ค๐“Ÿ ๐Ÿ”ฎ\Assets\class_stdclass.phpttext
MD5:B029C8CFF836E29483E97A0E2CE88FB5
SHA256:FC6F26480830493550EE3763B8B90740205FF48ACC60289AC0342AA23B2C25BE
7612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7612.7916\๐Ÿ”ฎ ๏ฟฝDownloads โซฝ ๐“Ÿ๐“’ โซฝ ๐”๐‹๐“๐ˆ๐Œ๐€๐“๐„ โซฝ ๐“ข๐“”๐“ฃ๐“ค๐“Ÿ ๐Ÿ”ฎ\Assets\Media\approximate.pdfpdf
MD5:55C89B1F20B11E702D840CBF4574B742
SHA256:66B1E32463EA3A105CC89EFF3CEFD4CB3BD8560AC4690BB0AB5F3AE562890EDF
7612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7612.7916\๐Ÿ”ฎ ๏ฟฝDownloads โซฝ ๐“Ÿ๐“’ โซฝ ๐”๐‹๐“๐ˆ๐Œ๐€๐“๐„ โซฝ ๐“ข๐“”๐“ฃ๐“ค๐“Ÿ ๐Ÿ”ฎ\Assets\gh16292.phpttext
MD5:ACB6A3BE5410732D95DBF265FBF40801
SHA256:16A9151BECB32CA1E2B55CC0E00FF9C41682A54145878EAAA9442C50AC8BABD2
7612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7612.7916\๐Ÿ”ฎ ๏ฟฝDownloads โซฝ ๐“Ÿ๐“’ โซฝ ๐”๐‹๐“๐ˆ๐Œ๐€๐“๐„ โซฝ ๐“ข๐“”๐“ฃ๐“ค๐“Ÿ ๐Ÿ”ฎ\Assets\dateformat_formatObject_calendar_variant5.phpttext
MD5:6944DC0EBE96C1C3BB446DA85C4F13BE
SHA256:734CC28FF9F47ACD27D2279742A2E34276AB50AC022AAE61FBA5ECA213E30317
7612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7612.7916\๐Ÿ”ฎ ๏ฟฝDownloads โซฝ ๐“Ÿ๐“’ โซฝ ๐”๐‹๐“๐ˆ๐Œ๐€๐“๐„ โซฝ ๐“ข๐“”๐“ฃ๐“ค๐“Ÿ ๐Ÿ”ฎ\Assets\ldap_connect_variation.phpttext
MD5:CFFE7B0FC03275AFF9D08D8CC950CCF5
SHA256:421F202020A790240347D4B0821DB060329290C704876E803A4DCBC113CED16D
7612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7612.7916\๐Ÿ”ฎ ๏ฟฝDownloads โซฝ ๐“Ÿ๐“’ โซฝ ๐”๐‹๐“๐ˆ๐Œ๐€๐“๐„ โซฝ ๐“ข๐“”๐“ฃ๐“ค๐“Ÿ ๐Ÿ”ฎ\Assets\bug65579.phpttext
MD5:46DEF902E1CEEE6F8ED31889A905AC38
SHA256:37E0CDCE07067A3D7564B13C99471AC13A19E5BCBC47E1071A42607EB9674862
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
63
DNS requests
24
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
โ€”
โ€”
whitelisted
โ€”
โ€”
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
โ€”
โ€”
whitelisted
8076
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
โ€”
โ€”
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
โ€”
โ€”
whitelisted
8076
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
โ€”
โ€”
whitelisted
7256
Setup.exe
GET
โ€”
172.67.221.174:80
http://h4.tattlererun.life/sh.ext.bin
unknown
โ€”
โ€”
unknown
7256
Setup.exe
GET
โ€”
172.67.221.174:80
http://h4.tattlererun.life/shark.bin
unknown
โ€”
โ€”
unknown
7204
Setup.exe
GET
200
172.67.221.174:80
http://h4.tattlererun.life/sh.ext.bin
unknown
โ€”
โ€”
unknown
5436
VirtuServer128.exe
GET
200
18.245.38.41:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D
unknown
โ€”
โ€”
whitelisted
5436
VirtuServer128.exe
GET
200
143.204.99.128:80
http://ocsp.r2m04.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEAqlOECbKpghQnC3N5zkTKU%3D
unknown
โ€”
โ€”
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6652
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
โ€”
โ€”
โ€”
whitelisted
โ€”
โ€”
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
โ€”
โ€”
2.20.245.139:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
5496
MoUsoCoreWorker.exe
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
4
System
192.168.100.255:138
โ€”
โ€”
โ€”
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.78
whitelisted
crl.microsoft.com
  • 2.20.245.139
  • 2.20.245.137
  • 23.216.77.28
  • 23.216.77.42
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 23.219.150.101
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.4
  • 20.190.159.68
  • 40.126.31.128
  • 20.190.159.23
  • 40.126.31.3
  • 20.190.159.73
  • 20.190.159.129
  • 40.126.31.131
  • 40.126.31.1
  • 20.190.159.130
  • 40.126.31.67
  • 40.126.31.0
  • 20.190.159.131
  • 20.190.159.128
  • 20.190.159.0
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
  • 20.83.72.98
whitelisted

Threats

PID
Process
Class
Message
7256
Setup.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7256
Setup.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
7204
Setup.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7204
Setup.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
5436
VirtuServer128.exe
Misc activity
ET TA_ABUSED_SERVICES Observed Commonly Actor Abused Online Service Domain (data-seed-prebsc-1-s1 .binance .org in TLS SNI)
2196
svchost.exe
Misc activity
ET TA_ABUSED_SERVICES DNS Query to Commonly Actor Abused Online Service (data-seed-prebsc-1-s1 .binance .org)
No debug info
Interactive malware hunting service ANY.RUN
ยฉ 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
๐Ÿ”ฎ ๏ฟฝDownloads โซฝ ๐“Ÿ๐“’ โซฝ ๐”๐‹๐“๐ˆ๐Œ๐€๐“๐„ โซฝ ๐“ข๐“”๐“ฃ๐“ค๐“Ÿ ๐Ÿ”ฎ.zip