Find similar analyses in TI Lookup
Analysis date (UTC): 8 February 2026, 04:14Analysis environment: Windows 10 Pro, build 19044, x64

Prompt-APP-optimization-main.zip

MD5:640E90A35359EEAF7689BD3AE65171A7
SHA1:B616B70E5AB02E4BECF96CF032264562EC5F2010
SHA256:3D5649F676861CB8CEE8B66B3FD277002F4DDABE29D7C695789535C219033682

Analysis result

Threat level:Suspicious activity
Tags:
arch-execarch-docevasionlua
Full analysis:Analysis Prompt-APP-optimization-main.zip (MD5: 640E90A35359EEAF7689BD3AE65171A7) Suspicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Generic archive extractor

  • WinRAR.exe (PID: 6580)

SUSPICIOUS

Checks for external IP

  • svchost.exe (PID: 2292)

INFO

Drops script file

  • WinRAR.exe (PID: 6580)
  • WinRAR.exe (PID: 7460)
  • cmd.exe (PID: 2392)

Executable content was dropped or overwritten

  • WinRAR.exe (PID: 7460)

Manual execution by a user

  • WinRAR.exe (PID: 7460)
  • cmd.exe (PID: 2392)
  • luajit.exe (PID: 1508)

Checks supported languages

  • luajit.exe (PID: 9004)
  • luajit.exe (PID: 1508)

Reads the computer name

  • luajit.exe (PID: 9004)

Reads security settings of Internet Explorer

  • luajit.exe (PID: 9004)

Checks proxy server information

  • luajit.exe (PID: 9004)

Creates files or folders in the user directory

  • luajit.exe (PID: 9004)

Reads the machine GUID from the registry

  • luajit.exe (PID: 9004)

The process uses Lua

  • luajit.exe (PID: 9004)

Threats

PIDProcessClassMessage
8400svchost.exeUnknown TrafficET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
2292svchost.exeMisc activityINFO [ANY.RUN] External IP Check (ip-api .com)
2292svchost.exeDevice Retrieving External IP Address DetectedET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
——Misc activityET INFO Blockchain RPC Domain in DNS Lookup (polygon-rpc .com)
——Misc activityET INFO Blockchain RPC Domain in TLS SNI (polygon-rpc .com)
——A Network Trojan was detectedAV TROJAN SmartLoader CnC Activity

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN

© 2017-2026 ANY.RUN LLC. ALL RIGHTS RESERVED