File name:

๐Ÿ”ฎ ๏ฟฝDownloads โซฝ ๐“Ÿ๐“’ โซฝ ๐”๐‹๐“๐ˆ๐Œ๐€๐“๐„ โซฝ ๐“ข๐“”๐“ฃ๐“ค๐“Ÿ ๐Ÿ”ฎ.zip

Full analysis: https://app.any.run/tasks/935eef19-f1a2-47c0-8e30-a4c943ccb5cb
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victimsโ€™ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Trackerย ย ย ย ย >>>
Analysis date: May 17, 2025, 04:55:51
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
loader
arch-exec
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

77FEDF5464355930785DD94FF9C4939C

SHA1:

124ADB53D9C53F3182F7604A8B58D7763D242013

SHA256:

3BB92C7F5EE4A8040FFA91C218E77789C3BA50BCEEA282D04D4B0B08F1B26E5A

SSDEEP:

98304:DdGCmvidzYvTaqHBJj+eAN2dZraKcfJxpxm3aROmMt/tv9EjaNGM/E78ru1qNsvH:Mgv638+uthlHc6kypGBVt0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • Setup.exe (PID: 7204)
      • Setup.exe (PID: 7256)
      • hjksfve.exe (PID: 6972)
      • DistriCompiler89.exe (PID: 6964)
      • DistriCompiler89.exe (PID: 5244)
      • hjksfcm.exe (PID: 1072)
      • DistriCompiler89.exe (PID: 5968)
      • DistriCompiler89.exe (PID: 1512)
      • DistriCompiler89.exe (PID: 7884)
      • VirtuServer128.exe (PID: 5436)
      • DistriCompiler89.exe (PID: 2616)
      • VirtuServer128.exe (PID: 7912)

    • Steals credentials from Web Browsers

      • Setup.exe (PID: 7256)
      • Setup.exe (PID: 7204)

    • Actions looks like stealing of personal data

      • Setup.exe (PID: 7256)
      • Setup.exe (PID: 7204)
      • VirtuServer128.exe (PID: 5436)

    • Known privilege escalation attack

      • dllhost.exe (PID: 7844)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • hjksfve.exe (PID: 6972)
      • Setup.exe (PID: 7256)
      • DistriCompiler89.exe (PID: 6964)
      • DistriCompiler89.exe (PID: 5244)
      • Setup.exe (PID: 7204)
      • hjksfcm.exe (PID: 1072)
      • DistriCompiler89.exe (PID: 7884)
      • VirtuServer128.exe (PID: 5436)
      • MicrosoftEdgeWebview2Setup.exe (PID: 8024)

    • Potential Corporate Privacy Violation

      • Setup.exe (PID: 7256)
      • Setup.exe (PID: 7204)

    • Reads security settings of Internet Explorer

      • hjksfve.exe (PID: 6972)
      • hjksfcm.exe (PID: 1072)
      • VirtuServer128.exe (PID: 5436)
      • MicrosoftEdgeUpdate.exe (PID: 672)

    • Starts itself from another location

      • DistriCompiler89.exe (PID: 6964)
      • DistriCompiler89.exe (PID: 5968)

    • Drops 7-zip archiver for unpacking

      • DistriCompiler89.exe (PID: 5244)

    • Process drops legitimate windows executable

      • Setup.exe (PID: 7204)
      • VirtuServer128.exe (PID: 5436)
      • MicrosoftEdgeWebview2Setup.exe (PID: 8024)
      • MicrosoftEdgeUpdate.exe (PID: 672)

    • The process drops C-runtime libraries

      • Setup.exe (PID: 7204)

    • There is functionality for taking screenshot (YARA)

      • DistriCompiler89.exe (PID: 5244)
      • DistriCompiler89.exe (PID: 1512)
      • DistriCompiler89.exe (PID: 7884)
      • DistriCompiler89.exe (PID: 2616)

    • Connects to unusual port

      • VirtuServer128.exe (PID: 5436)

    • Starts POWERSHELL.EXE for commands execution

      • VirtuServer128.exe (PID: 5436)

    • Starts process via Powershell

      • powershell.exe (PID: 2344)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeUpdate.exe (PID: 672)

    • Disables SEHOP

      • MicrosoftEdgeUpdate.exe (PID: 672)

  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 7612)
      • DistriCompiler89.exe (PID: 5244)
      • Setup.exe (PID: 7204)
      • DistriCompiler89.exe (PID: 7884)
      • VirtuServer128.exe (PID: 5436)
      • MicrosoftEdgeUpdate.exe (PID: 672)
      • MicrosoftEdgeWebview2Setup.exe (PID: 8024)

    • Checks supported languages

      • hjksfve.exe (PID: 6972)
      • Setup.exe (PID: 7256)
      • Setup.exe (PID: 7204)
      • elevation_service.exe (PID: 4164)
      • DistriCompiler89.exe (PID: 6964)
      • DistriCompiler89.exe (PID: 5244)
      • elevation_service.exe (PID: 1052)
      • hjksfcm.exe (PID: 1072)
      • DistriCompiler89.exe (PID: 5968)
      • DistriCompiler89.exe (PID: 1512)
      • 7za.exe (PID: 5116)
      • DistriCompiler89.exe (PID: 7884)
      • DistriCompiler89.exe (PID: 2616)
      • VirtuServer128.exe (PID: 5436)
      • VirtuServer128.exe (PID: 7912)
      • 7za.exe (PID: 2268)
      • 7za.exe (PID: 2560)
      • 7za.exe (PID: 4448)
      • MicrosoftEdgeWebview2Setup.exe (PID: 8024)
      • MicrosoftEdgeUpdate.exe (PID: 672)

    • Manual execution by a user

      • Setup.exe (PID: 7256)
      • Setup.exe (PID: 7204)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7612)

    • Reads the computer name

      • Setup.exe (PID: 7256)
      • elevation_service.exe (PID: 4164)
      • hjksfve.exe (PID: 6972)
      • DistriCompiler89.exe (PID: 6964)
      • DistriCompiler89.exe (PID: 5244)
      • elevation_service.exe (PID: 1052)
      • hjksfcm.exe (PID: 1072)
      • Setup.exe (PID: 7204)
      • DistriCompiler89.exe (PID: 5968)
      • 7za.exe (PID: 5116)
      • DistriCompiler89.exe (PID: 1512)
      • DistriCompiler89.exe (PID: 7884)
      • 7za.exe (PID: 2268)
      • DistriCompiler89.exe (PID: 2616)
      • VirtuServer128.exe (PID: 5436)
      • VirtuServer128.exe (PID: 7912)
      • 7za.exe (PID: 2560)
      • 7za.exe (PID: 4448)
      • MicrosoftEdgeUpdate.exe (PID: 672)

    • Reads the machine GUID from the registry

      • Setup.exe (PID: 7256)
      • Setup.exe (PID: 7204)
      • 7za.exe (PID: 5116)
      • 7za.exe (PID: 2268)
      • VirtuServer128.exe (PID: 5436)

    • Executes as Windows Service

      • elevation_service.exe (PID: 4164)
      • elevation_service.exe (PID: 1052)

    • Process checks computer location settings

      • hjksfve.exe (PID: 6972)
      • hjksfcm.exe (PID: 1072)
      • MicrosoftEdgeUpdate.exe (PID: 672)

    • Creates files in the program directory

      • DistriCompiler89.exe (PID: 6964)
      • DistriCompiler89.exe (PID: 5244)
      • DistriCompiler89.exe (PID: 7884)
      • VirtuServer128.exe (PID: 5436)
      • MicrosoftEdgeWebview2Setup.exe (PID: 8024)

    • Create files in a temporary directory

      • DistriCompiler89.exe (PID: 5244)
      • DistriCompiler89.exe (PID: 1512)
      • DistriCompiler89.exe (PID: 7884)
      • DistriCompiler89.exe (PID: 2616)

    • Checks transactions between databases Windows and Oracle

      • 7za.exe (PID: 5116)
      • 7za.exe (PID: 2268)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 7844)

    • Checks proxy server information

      • VirtuServer128.exe (PID: 5436)
      • slui.exe (PID: 7416)
      • MicrosoftEdgeUpdate.exe (PID: 672)
      • wermgr.exe (PID: 6392)

    • Creates files or folders in the user directory

      • VirtuServer128.exe (PID: 5436)
      • wermgr.exe (PID: 6392)

    • Reads the software policy settings

      • VirtuServer128.exe (PID: 5436)
      • slui.exe (PID: 7416)
      • MicrosoftEdgeUpdate.exe (PID: 672)
      • wermgr.exe (PID: 6392)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 672)
Find more information about signature artifacts and mapping to MITRE ATT&CKโ„ข MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: 0x0800
ZipCompression: None
ZipModifyDate: 2025:05:16 11:22:38
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: ๐Ÿ”ฎ ๏ฟฝ๏ฟฝ๏ฟฝDownloads โซฝ ๐“Ÿ๐“’ โซฝ ๐”๐‹๐“๐ˆ๐Œ๐€๐“๐„ โซฝ ๐“ข๐“”๐“ฃ๐“ค๐“Ÿ ๐Ÿ”ฎ/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
181
Monitored processes
47
Malicious processes
15
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs setup.exe setup.exe chrome.exe no specs msedge.exe no specs elevation_service.exe no specs chrome.exe no specs slui.exe msedge.exe no specs chrome.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs hjksfve.exe districompiler89.exe districompiler89.exe chrome.exe no specs msedge.exe no specs elevation_service.exe no specs chrome.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs chrome.exe no specs 7za.exe no specs msedge.exe no specs hjksfcm.exe districompiler89.exe no specs districompiler89.exe no specs conhost.exe no specs CMSTPLUA districompiler89.exe 7za.exe no specs conhost.exe no specs virtuserver128.exe districompiler89.exe no specs virtuserver128.exe no specs 7za.exe no specs conhost.exe no specs 7za.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs microsoftedgewebview2setup.exe microsoftedgeupdate.exe wermgr.exe

Process information

PID
CMD
Path
Indicators
Parent process
496"C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exeโ€”Setup.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
1
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
672"C:\Program Files (x86)\Microsoft\Temp\EUA8EA.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"C:\Program Files (x86)\Microsoft\Temp\EUA8EA.tmp\MicrosoftEdgeUpdate.exe
MicrosoftEdgeWebview2Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update
Exit code:
2147747592
Version:
1.3.195.25
Modules
Images
c:\program files (x86)\microsoft\temp\eua8ea.tmp\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
1052"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\elevation_service.exeโ€”services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\elevation_service.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\rpcrt4.dll
1072C:\Users\admin\hjksfcm.exeC:\Users\admin\hjksfcm.exe
Setup.exe
User:
admin
Company:
Oleg N. Scherbakov
Integrity Level:
MEDIUM
Description:
7z Setup SFX (x86)
Exit code:
0
Version:
1.4.0.1795
Modules
Images
c:\users\admin\hjksfcm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1180"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeโ€”Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
1
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1228"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeโ€”Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1452"C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exeโ€”Setup.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
1
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1512C:\ProgramData\Iaclientv2\DistriCompiler89.exeC:\ProgramData\Iaclientv2\DistriCompiler89.exeโ€”DistriCompiler89.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\programdata\iaclientv2\districompiler89.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\shlwapi.dll
c:\windows\syswow64\msvcrt.dll
2268"C:\ProgramData\Iaclientv2\7za.exe" "C:\ProgramData\Iaclientv2\7za.exe" a -t7z "C:\Users\admin\AppData\Roaming\app.7z" C:C:\ProgramData\Iaclientv2\7za.exeโ€”DistriCompiler89.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip Standalone Console
Exit code:
0
Version:
18.05
Modules
Images
c:\windows\system32\input.dll
c:\programdata\iaclientv2\7za.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2344powershell.exe -Command "Start-Process 'C:\ProgramData\MicrosoftEdgeWebview2Setup.exe' -ArgumentList '/silent','/install' -Wait"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeโ€”VirtuServer128.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
13ย 490
Read events
13ย 415
Write events
73
Delete events
2

Modification events

(PID) Process:(7612)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7612)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7612)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7612)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\๐Ÿ”ฎ ๏ฟฝDownloads โซฝ ๐“Ÿ๐“’ โซฝ ๐”๐‹๐“๐ˆ๐Œ๐€๐“๐„ โซฝ ๐“ข๐“”๐“ฃ๐“ค๐“Ÿ ๐Ÿ”ฎ.zip
(PID) Process:(7612)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7612)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7612)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7612)ย WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4424)ย chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(4424)ย chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
Executable files
230
Suspicious files
60
Text files
113
Unknown types
0

Dropped files

PID
Process
Filename
Type
7612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7612.7916\๐Ÿ”ฎ ๏ฟฝDownloads โซฝ ๐“Ÿ๐“’ โซฝ ๐”๐‹๐“๐ˆ๐Œ๐€๐“๐„ โซฝ ๐“ข๐“”๐“ฃ๐“ค๐“Ÿ ๐Ÿ”ฎ\Assets\attribute_entity_expansion_legacy.phpttext
MD5:BDDAB0F9DF49C5E992400C6FEA3E8C05
SHA256:6B8D13343AB442672683DD9140CB603909D4283FE937D8816BBF30A9DED3E488
7612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7612.7916\๐Ÿ”ฎ ๏ฟฝDownloads โซฝ ๐“Ÿ๐“’ โซฝ ๐”๐‹๐“๐ˆ๐Œ๐€๐“๐„ โซฝ ๐“ข๐“”๐“ฃ๐“ค๐“Ÿ ๐Ÿ”ฎ\ancestor.wmabinary
MD5:755D5796AB3AC51CC2C0063F3D49A320
SHA256:9F0CC08258FB496B7BAA3E9B2A5A443949D81115A8140A1D528C618C8331128C
7612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7612.7916\๐Ÿ”ฎ ๏ฟฝDownloads โซฝ ๐“Ÿ๐“’ โซฝ ๐”๐‹๐“๐ˆ๐Œ๐€๐“๐„ โซฝ ๐“ข๐“”๐“ฃ๐“ค๐“Ÿ ๐Ÿ”ฎ\Assets\array_merge_recursive_variation2.phpttext
MD5:A9870AEF3750DB019181C8DC6E824CF7
SHA256:FCF1B4021422199D5BDAE8E1DFC44906E096607C41951BAF190DD8E5D9DA04AE
7612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7612.7916\๐Ÿ”ฎ ๏ฟฝDownloads โซฝ ๐“Ÿ๐“’ โซฝ ๐”๐‹๐“๐ˆ๐Œ๐€๐“๐„ โซฝ ๐“ข๐“”๐“ฃ๐“ค๐“Ÿ ๐Ÿ”ฎ\Assets\bug32160.phpttext
MD5:176E9FE3ED6945A511B2F242C5523677
SHA256:B65C3E7D140E5C7D5AA58494F675CBCAD2DE031FEBCF4F5F579C7ED4F3747E2D
7612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7612.7916\๐Ÿ”ฎ ๏ฟฝDownloads โซฝ ๐“Ÿ๐“’ โซฝ ๐”๐‹๐“๐ˆ๐Œ๐€๐“๐„ โซฝ ๐“ข๐“”๐“ฃ๐“ค๐“Ÿ ๐Ÿ”ฎ\Assets\bug34137.phpttext
MD5:635307C8FB4FEA3C524E5D26E98AC3D0
SHA256:9E47D9EEDE49B9DFAF27A3A923890D409C50A44BB80C64BF7AEAA98D7C16EB98
7612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7612.7916\๐Ÿ”ฎ ๏ฟฝDownloads โซฝ ๐“Ÿ๐“’ โซฝ ๐”๐‹๐“๐ˆ๐Œ๐€๐“๐„ โซฝ ๐“ข๐“”๐“ฃ๐“ค๐“Ÿ ๐Ÿ”ฎ\Assets\bug51671.phpttext
MD5:E388651554207223390A5EA399D57376
SHA256:0C2BB31F91EAD24E65BB9DCF4D8E5E811AABE3522763BC8CE99EAB05DCA4EBC6
7612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7612.7916\๐Ÿ”ฎ ๏ฟฝDownloads โซฝ ๐“Ÿ๐“’ โซฝ ๐”๐‹๐“๐ˆ๐Œ๐€๐“๐„ โซฝ ๐“ข๐“”๐“ฃ๐“ค๐“Ÿ ๐Ÿ”ฎ\Assets\bug65579.phpttext
MD5:46DEF902E1CEEE6F8ED31889A905AC38
SHA256:37E0CDCE07067A3D7564B13C99471AC13A19E5BCBC47E1071A42607EB9674862
7612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7612.7916\๐Ÿ”ฎ ๏ฟฝDownloads โซฝ ๐“Ÿ๐“’ โซฝ ๐”๐‹๐“๐ˆ๐Œ๐€๐“๐„ โซฝ ๐“ข๐“”๐“ฃ๐“ค๐“Ÿ ๐Ÿ”ฎ\Assets\bzip2.phpttext
MD5:699B2A7EC8D07CF51001CC4E0503769F
SHA256:CA1FC86743870368E7E378F5A8D061D245849308BCC486D7E0C314DBB57CB654
7612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7612.7916\๐Ÿ”ฎ ๏ฟฝDownloads โซฝ ๐“Ÿ๐“’ โซฝ ๐”๐‹๐“๐ˆ๐Œ๐€๐“๐„ โซฝ ๐“ข๐“”๐“ฃ๐“ค๐“Ÿ ๐Ÿ”ฎ\Assets\class_stdclass.phpttext
MD5:B029C8CFF836E29483E97A0E2CE88FB5
SHA256:FC6F26480830493550EE3763B8B90740205FF48ACC60289AC0342AA23B2C25BE
7612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7612.7916\๐Ÿ”ฎ ๏ฟฝDownloads โซฝ ๐“Ÿ๐“’ โซฝ ๐”๐‹๐“๐ˆ๐Œ๐€๐“๐„ โซฝ ๐“ข๐“”๐“ฃ๐“ค๐“Ÿ ๐Ÿ”ฎ\Assets\concat_002.phpttext
MD5:1AA462A66A85170C18BEA09EC429152A
SHA256:8930BDCFC75261FD13AFF475DC89100AB5B2B1DD8BF397CC0DDF529EB138D0A8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
63
DNS requests
24
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
โ€”
โ€”
whitelisted
โ€”
โ€”
GET
200
2.20.245.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
โ€”
โ€”
whitelisted
8076
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
โ€”
โ€”
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
โ€”
โ€”
whitelisted
7256
Setup.exe
GET
โ€”
172.67.221.174:80
http://h4.tattlererun.life/sh.ext.bin
unknown
โ€”
โ€”
unknown
8076
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
โ€”
โ€”
whitelisted
7256
Setup.exe
GET
โ€”
172.67.221.174:80
http://h4.tattlererun.life/shark.bin
unknown
โ€”
โ€”
unknown
7204
Setup.exe
GET
200
172.67.221.174:80
http://h4.tattlererun.life/sh.ext.bin
unknown
โ€”
โ€”
unknown
5436
VirtuServer128.exe
GET
200
18.245.38.41:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D
unknown
โ€”
โ€”
whitelisted
5436
VirtuServer128.exe
GET
200
143.204.99.128:80
http://ocsp.r2m04.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEAqlOECbKpghQnC3N5zkTKU%3D
unknown
โ€”
โ€”
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6652
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
โ€”
โ€”
โ€”
whitelisted
โ€”
โ€”
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
โ€”
โ€”
2.20.245.139:80
crl.microsoft.com
Akamai International B.V.
SE
whitelisted
5496
MoUsoCoreWorker.exe
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
4
System
192.168.100.255:138
โ€”
โ€”
โ€”
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.78
whitelisted
crl.microsoft.com
  • 2.20.245.139
  • 2.20.245.137
  • 23.216.77.28
  • 23.216.77.42
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 23.219.150.101
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.4
  • 20.190.159.68
  • 40.126.31.128
  • 20.190.159.23
  • 40.126.31.3
  • 20.190.159.73
  • 20.190.159.129
  • 40.126.31.131
  • 40.126.31.1
  • 20.190.159.130
  • 40.126.31.67
  • 40.126.31.0
  • 20.190.159.131
  • 20.190.159.128
  • 20.190.159.0
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
  • 20.83.72.98
whitelisted

Threats

PID
Process
Class
Message
7256
Setup.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7256
Setup.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
7204
Setup.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7204
Setup.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
5436
VirtuServer128.exe
Misc activity
ET TA_ABUSED_SERVICES Observed Commonly Actor Abused Online Service Domain (data-seed-prebsc-1-s1 .binance .org in TLS SNI)
2196
svchost.exe
Misc activity
ET TA_ABUSED_SERVICES DNS Query to Commonly Actor Abused Online Service (data-seed-prebsc-1-s1 .binance .org)
No debug info
Interactive malware hunting service ANY.RUN
ยฉ 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
๐Ÿ”ฎ ๏ฟฝDownloads โซฝ ๐“Ÿ๐“’ โซฝ ๐”๐‹๐“๐ˆ๐Œ๐€๐“๐„ โซฝ ๐“ข๐“”๐“ฃ๐“ค๐“Ÿ ๐Ÿ”ฎ.zip