Malware analysis HWID Spoofer Final.zip Malicious activity

Add for printing

File name:	HWID Spoofer Final.zip
Full analysis:	https://app.any.run/tasks/a1bc0105-b181-4bcc-a29f-f9b344c64350
Verdict:	Malicious activity
Analysis date:	March 19, 2026, 20:13:08
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	auto generic amifldrv64-sys vuln-driver arch-exec arch-scr arch-doc tool
Indicators:
MIME:	application/zip
File info:	Zip archive data, at least v2.0 to extract, compression method=store
MD5:	C20D2C8EE0BBD890999AEA5DF5BE143C
SHA1:	1CAB8A73E8ED5A97020433968C677DFF28E83BC1
SHA256:	3D5A0CDA5722CDEFDCEB86E511E191C1C9D147C9AADF964F792D63E5AACFBEB8
SSDEEP:	98304:zg1JBVy3Ug0KTMEL2YKfSd9GJ2f3+jyVlldbzV9ima6ehzDTs3251JrkSFLMEXca:aQ+qcG2h9dC+7ws

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 240 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 180 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on
Elevated privileges:: off

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
Google Chrome (133.0.6943.127)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Java(TM) SE Development Kit 25.0.2 (64-bit) (25.0.2.0)
Microsoft Edge (133.0.3065.92)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (136.0)
Mozilla Maintenance Service (136.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Vulnerable driver has been detected
  - WinRAR.exe (PID: 7776)
- GENERIC has been found (auto)
  - WinRAR.exe (PID: 7776)
- Changes powershell execution policy (Unrestricted)
  - cmd.exe (PID: 1296)
- Executing a file with an untrusted certificate
  - VolumeID64.exe (PID: 1772)
SUSPICIOUS
- Drops a system driver (possible attempt to evade defenses)
  - WinRAR.exe (PID: 7776)
- The process executes Powershell scripts
  - powershell.exe (PID: 6796)
  - powershell.exe (PID: 7924)
- Bypass execution policy to execute commands
  - powershell.exe (PID: 6796)
  - powershell.exe (PID: 7924)
- Starts CMD.EXE for commands execution
  - cmd.exe (PID: 7872)
  - cmd.exe (PID: 1296)
  - cmd.exe (PID: 4284)
  - cmd.exe (PID: 3420)
  - cmd.exe (PID: 6404)
  - cmd.exe (PID: 7192)
- Uses ICACLS.EXE to modify access control lists
  - cmd.exe (PID: 7872)
  - cmd.exe (PID: 1296)
- The process executes VB scripts
  - wscript.exe (PID: 2220)
- Using short paths in the command line
  - wscript.exe (PID: 2220)
  - cmd.exe (PID: 1296)
- Executing commands from a ".bat" file
  - wscript.exe (PID: 2220)
- Runs shell command (SCRIPT)
  - wscript.exe (PID: 2220)
- Hides command output
  - cmd.exe (PID: 4284)
- Application launched itself
  - cmd.exe (PID: 1296)
- Starts POWERSHELL.EXE for commands execution
  - cmd.exe (PID: 4284)
  - cmd.exe (PID: 1296)
- Returns all items found within a container (POWERSHELL)
  - powershell.exe (PID: 5760)
  - powershell.exe (PID: 8132)
- TRACEX has been detected
  - cmd.exe (PID: 1296)
- Uses TIMEOUT.EXE to delay execution
  - cmd.exe (PID: 1296)
- Checks a user's role membership (POWERSHELL)
  - powershell.exe (PID: 7924)
- Converts a specified value to a byte (POWERSHELL)
  - powershell.exe (PID: 7924)
- Starts CMD.EXE with AutoRun commands disabled
  - cmd.exe (PID: 7192)
- Process uses IPCONFIG to clear DNS cache
  - powershell.exe (PID: 7924)
- Process uses IPCONFIG to discard the IP address configuration
  - powershell.exe (PID: 7924)
- Process uses IPCONFIG to renew DHCP configuration
  - powershell.exe (PID: 7924)
- Suspicious use of NETSH.EXE
  - powershell.exe (PID: 7924)
INFO
- Generic archive extractor
  - WinRAR.exe (PID: 7776)
- The sample compiled with english language support
  - WinRAR.exe (PID: 7776)
- Executable content was dropped or overwritten
  - WinRAR.exe (PID: 7776)
- Manual execution by a user
  - notepad.exe (PID: 4564)
  - powershell.exe (PID: 6796)
  - AMIDEWINx64.EXE (PID: 6952)
  - AMIDEWINx64.EXE (PID: 6668)
  - cmd.exe (PID: 7872)
- Reads security settings of Internet Explorer
  - notepad.exe (PID: 4564)
- Script raised an exception (POWERSHELL)
  - powershell.exe (PID: 6796)
- Checks supported languages
  - AMIDEWINx64.EXE (PID: 6668)
  - VolumeID64.exe (PID: 1772)
  - AMIDEWINx64.EXE (PID: 5768)
  - AMIDEWINx64.EXE (PID: 7624)
  - AMIDEWINx64.EXE (PID: 5304)
  - AMIDEWINx64.EXE (PID: 6768)
  - AMIDEWINx64.EXE (PID: 3340)
  - AMIDEWINx64.EXE (PID: 2120)
  - AMIDEWINx64.EXE (PID: 1268)
  - AMIDEWINx64.EXE (PID: 8124)
  - AMIDEWINx64.EXE (PID: 5712)
  - AMIDEWINx64.EXE (PID: 7576)
  - AMIDEWINx64.EXE (PID: 2332)
  - AMIDEWINx64.EXE (PID: 7300)
  - AMIDEWINx64.EXE (PID: 6412)
  - AMIDEWINx64.EXE (PID: 2368)
  - AMIDEWINx64.EXE (PID: 6508)
  - AMIDEWINx64.EXE (PID: 5240)
  - AMIDEWINx64.EXE (PID: 1352)
  - AMIDEWINx64.EXE (PID: 3460)
  - AMIDEWINx64.EXE (PID: 6720)
  - AMIDEWINx64.EXE (PID: 3212)
  - AMIDEWINx64.EXE (PID: 8092)
  - AMIDEWINx64.EXE (PID: 2392)
  - AMIDEWINx64.EXE (PID: 2676)
  - AMIDEWINx64.EXE (PID: 4336)
  - AMIDEWINx64.EXE (PID: 7928)
  - AMIDEWINx64.EXE (PID: 6792)
  - AMIDEWINx64.EXE (PID: 7432)
  - AMIDEWINx64.EXE (PID: 4272)
  - AMIDEWINx64.EXE (PID: 4260)
  - AMIDEWINx64.EXE (PID: 6084)
  - AMIDEWINx64.EXE (PID: 6532)
  - AMIDEWINx64.EXE (PID: 4112)
  - AMIDEWINx64.EXE (PID: 7788)
  - AMIDEWINx64.EXE (PID: 7340)
  - AMIDEWINx64.EXE (PID: 7800)
  - AMIDEWINx64.EXE (PID: 8016)
  - AMIDEWINx64.EXE (PID: 6520)
- Reads the computer name
  - AMIDEWINx64.EXE (PID: 6668)
  - AMIDEWINx64.EXE (PID: 7624)
  - AMIDEWINx64.EXE (PID: 5304)
  - AMIDEWINx64.EXE (PID: 5768)
  - AMIDEWINx64.EXE (PID: 6768)
  - AMIDEWINx64.EXE (PID: 3340)
  - AMIDEWINx64.EXE (PID: 1268)
  - AMIDEWINx64.EXE (PID: 2120)
  - AMIDEWINx64.EXE (PID: 2368)
  - AMIDEWINx64.EXE (PID: 8124)
  - AMIDEWINx64.EXE (PID: 5712)
  - AMIDEWINx64.EXE (PID: 7300)
  - AMIDEWINx64.EXE (PID: 7576)
  - AMIDEWINx64.EXE (PID: 2332)
  - AMIDEWINx64.EXE (PID: 6412)
  - AMIDEWINx64.EXE (PID: 6508)
  - AMIDEWINx64.EXE (PID: 5240)
  - AMIDEWINx64.EXE (PID: 6720)
  - AMIDEWINx64.EXE (PID: 2392)
  - AMIDEWINx64.EXE (PID: 1352)
  - AMIDEWINx64.EXE (PID: 3460)
  - AMIDEWINx64.EXE (PID: 3212)
  - AMIDEWINx64.EXE (PID: 8092)
  - AMIDEWINx64.EXE (PID: 2676)
  - AMIDEWINx64.EXE (PID: 4336)
  - AMIDEWINx64.EXE (PID: 6084)
  - AMIDEWINx64.EXE (PID: 7928)
  - AMIDEWINx64.EXE (PID: 4260)
  - AMIDEWINx64.EXE (PID: 4272)
  - AMIDEWINx64.EXE (PID: 7432)
  - AMIDEWINx64.EXE (PID: 6532)
  - AMIDEWINx64.EXE (PID: 6792)
  - AMIDEWINx64.EXE (PID: 4112)
  - AMIDEWINx64.EXE (PID: 7788)
  - AMIDEWINx64.EXE (PID: 7340)
  - AMIDEWINx64.EXE (PID: 6520)
  - AMIDEWINx64.EXE (PID: 8016)
  - AMIDEWINx64.EXE (PID: 7800)
- Gets the execution policy for the powershell session
  - cmd.exe (PID: 4284)
- Returns hidden items found within a container (POWERSHELL)
  - powershell.exe (PID: 2456)
  - powershell.exe (PID: 4564)
- Returns all items recursively from all subfolders (POWERSHELL)
  - powershell.exe (PID: 8132)
- Uses string replace method (POWERSHELL)
  - powershell.exe (PID: 7924)
- Gets data length (POWERSHELL)
  - powershell.exe (PID: 7924)
- Disables trace logs
  - netsh.exe (PID: 7964)
- Launching a file from a Registry key
  - netsh.exe (PID: 2092)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.zip	\|	ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion:	20
ZipBitFlag:	-
ZipCompression:	None
ZipModifyDate:	2025:07:18 12:57:12
ZipCRC:	0x00000000
ZipCompressedSize:	-
ZipUncompressedSize:	-
ZipFileName:	TraceX Final/

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

212

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

1032

"C:\WINDOWS\system32\ipconfig.exe" /renew

C:\Windows\System32\ipconfig.exe

—

powershell.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

IP Configuration Utility

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\dhcpcsvc6.dll

1268

"C:\Users\admin\Desktop\TraceX Final\tools\AMIDEWINx64.EXE" /SS

C:\Users\admin\Desktop\TraceX Final\tools\AMIDEWINx64.EXE

—

powershell.exe

User:

admin

Integrity Level:

HIGH

Exit code:

227

Modules

Images
c:\users\admin\desktop\tracex final\tools\amidewinx64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

1296

"C:\WINDOWS\System32\cmd.exe" /C "C:\Users\admin\Desktop\TRACEX~1\RUN-TR~1.BAT"

C:\Windows\System32\cmd.exe

wscript.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Windows Command Processor

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll

1352

"C:\Users\admin\Desktop\TraceX Final\tools\AMIDEWINx64.EXE" /SU

C:\Users\admin\Desktop\TraceX Final\tools\AMIDEWINx64.EXE

—

powershell.exe

User:

admin

Integrity Level:

HIGH

Exit code:

227

Modules

Images
c:\users\admin\desktop\tracex final\tools\amidewinx64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

1772

"C:\Users\admin\Desktop\TraceX Final\tools\VolumeID64.exe" -accepteula C: 08C0-1E65

C:\Users\admin\Desktop\TraceX Final\tools\VolumeID64.exe

—

cmd.exe

User:

admin

Company:

Sysinternals - www.sysinternals.com

Integrity Level:

HIGH

Description:

Set disk volume id

Exit code:

Version:

2.1

Modules

Images
c:\users\admin\desktop\tracex final\tools\volumeid64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

1776

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

powershell.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

2092

"C:\WINDOWS\system32\netsh.exe" winsock reset

C:\Windows\System32\netsh.exe

—

powershell.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Network Command Shell

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

2120

"C:\Users\admin\Desktop\TraceX Final\tools\AMIDEWINx64.EXE" /CS

C:\Users\admin\Desktop\TraceX Final\tools\AMIDEWINx64.EXE

—

powershell.exe

User:

admin

Integrity Level:

HIGH

Exit code:

227

Modules

Images
c:\users\admin\desktop\tracex final\tools\amidewinx64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

2220

"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\getadmin.vbs"

C:\Windows\System32\wscript.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Microsoft ® Windows Based Script Host

Exit code:

Version:

5.812.10240.16384

Modules

Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

2332

"C:\Users\admin\Desktop\TraceX Final\tools\AMIDEWINx64.EXE" /SU 2D1084911006D260

C:\Users\admin\Desktop\TraceX Final\tools\AMIDEWINx64.EXE

—

powershell.exe

User:

admin

Integrity Level:

HIGH

Exit code:

227

Modules

Images
c:\users\admin\desktop\tracex final\tools\amidewinx64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

Add for printing

Total events

47 050

Read events

46 584

Write events

342

Delete events

124

Modification events


(PID) Process:	(7776) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:	write	Name:	ShellExtBMP
Value:
(PID) Process:	(7776) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:	write	Name:	ShellExtIcon
Value:
(PID) Process:	(7776) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	3
Value: C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:	(7776) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	2
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:	(7776) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	1
Value: C:\Users\admin\Downloads\chromium_build 1.zip
(PID) Process:	(7776) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	0
Value: C:\Users\admin\Downloads\HWID Spoofer Final.zip
(PID) Process:	(7776) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	name
Value: 120
(PID) Process:	(7776) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	size
Value: 80
(PID) Process:	(7776) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	type
Value: 120
(PID) Process:	(7776) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	mtime
Value: 100

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
7776	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$DRa7776.33767\TraceX Final\tools\OpenVPN-2.6.14-I001-amd64.msi		—
		MD5:—	SHA256:—
7776	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$DRa7776.33767\TraceX Final\scripts\change_disk_ids.ps1		text
		MD5:2E9153EDC202D577555609C1D85C25B5	SHA256:1F8D5F2B9F325C5FF76F2DEE89B58E87A14A8A63099FAADF67DC8C4E9C79B4F5
7776	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$DRa7776.33767\TraceX Final\scripts\change_hardware_ids.ps1		text
		MD5:8933162333B954F8B77CDC3899B8B9E6	SHA256:45ACB80D0E7018581549DD2151C9A5E7FB790010ADA6CC1BF68A1BDE2C6874E4
7776	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$DRa7776.33767\TraceX Final\scripts\create_restore_point.ps1		text
		MD5:FF5F49AC8F6047E9D084035065841C06	SHA256:6C03EAF50C6E371BD73C802DAC178F90071BA4061CF05106CFD94A6017B67B3A
7776	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$DRa7776.33767\TraceX Final\Run-TraceX-HWID-Spoofer.bat		text
		MD5:4F98523504C362EF51A4C82768E8B51A	SHA256:37AF4C4519FE8FE3331D56E74FF2BE57C09A46041B32C5A3233ACC243B456945
7776	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$DRa7776.33767\TraceX Final\READ ME BEFORE YOU START.txt		text
		MD5:BCB6E28D5890E32DC0FD8B647CD85F78	SHA256:D8866F892B595753A400A63AD157715C3ABBFA11BD05A2DE09C1F2DA1FA3BA8A
7776	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$DRa7776.33767\TraceX Final\scripts\change_mac_address.ps1		text
		MD5:7C30E9DBC601CE74F051783907893CE7	SHA256:ED8DECB95BCA85A67A7B561C13BD620AEA4435F6EB0F7281ECB9C978C659ADC4
7776	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$DRa7776.33767\TraceX Final\scripts\TraceX-Helpers.ps1		text
		MD5:373620513B4D0F6F687841413CE2321D	SHA256:06CC3E5CD3FAFC24DA12DB08934CB700FCEB5EA61B448B94F0AAF2E656C0A125
7776	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$DRa7776.33767\TraceX Final\scripts\setup_vpn.ps1		text
		MD5:56FA01E2DF8C9952A5C18531CB080D88	SHA256:36F7CCA326F67CACF24D63FACAFA92E4300527946B590280DA30E99E65AB4752
7776	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$DRa7776.33767\TraceX Final\scripts\tracex_cleaner.ps1		text
		MD5:A82C7D9876943FB05EF4AFF598DB1534	SHA256:4E1D8ACD1573D5AAF3F0A3BA2643FF4AE2C21198BC6A5088D6676A6C0646D4B4

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5276	MoUsoCoreWorker.exe	GET	304	51.104.136.2:443	https://settings-win.data.microsoft.com/settings/v3.0/OneSettings/Client?OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&LocalDeviceID=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&AttrDataVer=186&OSUILocale=en-US&OSSkuId=48&App=WOSC&AppVer=&IsFlightingEnabled=0&TelemetryLevel=1&DeviceFamily=Windows.Desktop	US	—	—	whitelisted
5276	MoUsoCoreWorker.exe	GET	304	51.104.136.2:443	https://settings-win.data.microsoft.com/settings/v3.0/wsd/muse?ProcessorClockSpeed=3094&FlightIds=&UpdateOfferedDays=4294967295&BranchReadinessLevel=CB&OEMManufacturerName=DELL&IsCloudDomainJoined=0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&sku=48&ActivationChannel=Retail&AttrDataVer=186&IsMDMEnrolled=0&ProcessorCores=6&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&TotalPhysicalRAM=6144&PrimaryDiskType=4294967295&FlightingBranchName=&ChassisTypeId=1&OEMModelNumber=DELL&SystemVolumeTotalCapacity=260281&sampleId=95271487&deviceClass=Windows.Desktop&App=muse&DisableDualScan=0&AppVer=10.0&OEMSubModel=J5CR&locale=en-US&IsAlwaysOnAlwaysConnectedCapable=0&ms=0&DefaultUserRegion=244&UpdateServiceUrl=http%3A%2F%2Fneverupdatewindows10.com&osVer=10.0.19045.4046.amd64fre.vb_release.191206-1406&os=windows&deviceId=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&DeferQualityUpdatePeriodInDays=0&ring=Retail&DeferFeatureUpdatePeriodInDays=30	US	—	—	whitelisted
932	SIHClient.exe	GET	304	135.232.92.137:443	https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL	US	—	—	whitelisted
932	SIHClient.exe	GET	200	74.178.240.51:443	https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping	US	—	—	whitelisted
932	SIHClient.exe	GET	200	135.232.92.137:443	https://slscr.update.microsoft.com/sls/ping	US	—	—	whitelisted
932	SIHClient.exe	GET	304	135.232.92.137:443	https://slscr.update.microsoft.com/SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL	US	—	—	whitelisted
5316	svchost.exe	POST	200	40.126.31.71:443	https://login.live.com/RST2.srf	US	xml	1.24 Kb	whitelisted
3352	svchost.exe	GET	304	20.73.194.208:443	https://settings-win.data.microsoft.com/settings/v3.0/WSD/UpdateHealthTools?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&sampleId=s:95271487&appVer=10.0.19041.3626&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=4294967295&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=SedimentPack&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2	US	—	—	whitelisted
5316	svchost.exe	GET	200	23.11.41.157:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D	NL	binary	471 b	whitelisted
5316	svchost.exe	POST	400	40.126.31.71:443	https://login.live.com/ppsecure/deviceaddcredential.srf	US	text	203 b	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	Not routed	—	whitelisted
3352	svchost.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
5276	MoUsoCoreWorker.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
—	—	128.24.231.64:443	activation-v2.sls.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
4	System	192.168.100.255:138	—	Not routed	—	whitelisted
5316	svchost.exe	40.126.31.71:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
5316	svchost.exe	23.11.41.157:80	ocsp.digicert.com	AKAMAI-AMS	NL	whitelisted
3428	svchost.exe	172.211.123.249:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
3352	svchost.exe	184.24.77.16:80	crl.microsoft.com	AKAMAI-ASN1	NL	whitelisted
3352	svchost.exe	23.52.181.212:80	www.microsoft.com	AKAMAI-AS	US	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	40.127.240.158 51.104.136.2 20.73.194.208	whitelisted
activation-v2.sls.microsoft.com	128.24.231.64	whitelisted
google.com	142.251.37.14	whitelisted
login.live.com	40.126.31.71 20.190.159.23 20.190.159.73 40.126.31.73 20.190.159.2 20.190.159.64 20.190.159.131 40.126.31.1	whitelisted
ocsp.digicert.com	23.11.41.157	whitelisted
client.wns.windows.com	172.211.123.249	whitelisted
crl.microsoft.com	184.24.77.16 184.24.77.12 184.24.77.23 184.24.77.40 184.24.77.42 184.24.77.9 184.24.77.13 184.24.77.11 184.24.77.15 23.55.110.193 23.55.110.182	whitelisted
www.microsoft.com	23.52.181.212 88.221.169.152	whitelisted
slscr.update.microsoft.com	135.232.92.137	whitelisted
fe3cr.delivery.mp.microsoft.com	74.178.240.51	whitelisted

Threats

No threats detected

Add for printing

No debug info

General Info

HWID Spoofer Final.zip

C20D2C8EE0BBD890999AEA5DF5BE143C

1CAB8A73E8ED5A97020433968C677DFF28E83BC1

3D5A0CDA5722CDEFDCEB86E511E191C1C9D147C9AADF964F792D63E5AACFBEB8

98304:zg1JBVy3Ug0KTMEL2YKfSd9GJ2f3+jyVlldbzV9ima6ehzDTs3251JrkSFLMEXca:aQ+qcG2h9dC+7ws

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Vulnerable driver has been detected

GENERIC has been found (auto)

Changes powershell execution policy (Unrestricted)

Executing a file with an untrusted certificate

SUSPICIOUS

Drops a system driver (possible attempt to evade defenses)

The process executes Powershell scripts

Bypass execution policy to execute commands

Starts CMD.EXE for commands execution

Uses ICACLS.EXE to modify access control lists

The process executes VB scripts

Using short paths in the command line

Executing commands from a ".bat" file

Runs shell command (SCRIPT)

Hides command output

Application launched itself

Starts POWERSHELL.EXE for commands execution

Returns all items found within a container (POWERSHELL)

TRACEX has been detected

Uses TIMEOUT.EXE to delay execution

Checks a user's role membership (POWERSHELL)

Converts a specified value to a byte (POWERSHELL)

Starts CMD.EXE with AutoRun commands disabled

Process uses IPCONFIG to clear DNS cache

Process uses IPCONFIG to discard the IP address configuration

Process uses IPCONFIG to renew DHCP configuration

Suspicious use of NETSH.EXE

INFO

Generic archive extractor

The sample compiled with english language support

Executable content was dropped or overwritten

Manual execution by a user

Reads security settings of Internet Explorer

Script raised an exception (POWERSHELL)

Checks supported languages

Reads the computer name

Gets the execution policy for the powershell session

Returns hidden items found within a container (POWERSHELL)

Returns all items recursively from all subfolders (POWERSHELL)

Uses string replace method (POWERSHELL)

Gets data length (POWERSHELL)

Disables trace logs

Launching a file from a Registry key

Malware configuration

Static information

TRiD

EXIF

ZIP

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information