| File name: | GenP_4.0.0_SOURCE.zip |
| Full analysis: | https://app.any.run/tasks/19b9fe22-90eb-4306-bd9f-8b4fdd8a1fb8 |
| Verdict: | Malicious activity |
| Analysis date: | April 14, 2026, 17:42:24 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract, compression method=store |
| MD5: | AFE9E5B1DB82DE8D92C87DA758889DC9 |
| SHA1: | 10FCE4494809F19F0323530494AB0FB082B6C72E |
| SHA256: | 3EBACA750E2FB9C9CDFC467FA298AB8643D43BC36E80B7147C62063F9B648340 |
| SSDEEP: | 98304:Tec9IG/klnUes6oPC2OppmC1cTX9TLqdP3xEq37sM8VVEc0125V:wSQW |
MALICIOUS
Changes powershell execution policy (Bypass)
- cmd.exe (PID: 6832)
SUSPICIOUS
Starts NET.EXE to display or manage information about active sessions
- net.exe (PID: 6804)
- cmd.exe (PID: 6832)
Bypass execution policy to execute commands
- powershell.exe (PID: 7248)
Starts CMD.EXE for commands execution
- cmd.exe (PID: 6832)
Executable content was dropped or overwritten
- tar.exe (PID: 4592)
The process creates files with name similar to system file names
- tar.exe (PID: 4592)
Starts POWERSHELL.EXE for commands execution
- cmd.exe (PID: 6832)
Checks a user's role membership (POWERSHELL)
- powershell.exe (PID: 7248)
INFO
The sample compiled with english language support
- WinRAR.exe (PID: 7260)
- tar.exe (PID: 4592)
- curl.exe (PID: 7888)
Manual execution by a user
- cmd.exe (PID: 6832)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 7260)
Generic archive extractor
- WinRAR.exe (PID: 7260)
Checks supported languages
- tar.exe (PID: 4592)
- curl.exe (PID: 7888)
Execution of CURL command
- powershell.exe (PID: 7248)
The sample compiled with german language support
- tar.exe (PID: 4592)
Reads the computer name
- curl.exe (PID: 7888)
Uses string replace method (POWERSHELL)
- powershell.exe (PID: 7248)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | None |
| ZipModifyDate: | 2026:03:16 11:15:10 |
| ZipCRC: | 0x00000000 |
| ZipCompressedSize: | - |
| ZipUncompressedSize: | - |
| ZipFileName: | GenP_4.0.0_SOURCE/ |
| ZipFileComment: | GenP-v4.0.0.exe - SHA256: 551FBEB7E5EE2F4E6B7212A95266E58E14CD4B301ECFC297E8FBBD00AD5EB8A0 |
Total processes
142
Monitored processes
10
Malicious processes
0
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1900 | C:\WINDOWS\system32\net1 session | C:\Windows\System32\net1.exe | — | net.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Net Command Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2232 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4504 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4592 | "C:\WINDOWS\system32\tar.exe" -xf "C:\Users\admin\Desktop\GenP_4.0.0_SOURCE\genp-4.0.0-src\autoit-v3.zip" -C "C:\GenP-BuildEnv\AutoIt" | C:\Windows\System32\tar.exe | powershell.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: bsdtar archive tool Version: 3.5.2 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4776 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | tar.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6804 | net session | C:\Windows\System32\net.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Net Command Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6832 | "C:\WINDOWS\System32\cmd.exe" /C "C:\Users\admin\Desktop\GenP_4.0.0_SOURCE\genp-4.0.0-src\run_build.bat" | C:\Windows\System32\cmd.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7248 | powershell.exe -ExecutionPolicy Bypass -File "C:\Users\admin\Desktop\GenP_4.0.0_SOURCE\genp-4.0.0-src\build.ps1" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7260 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\GenP_4.0.0_SOURCE.zip | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 7888 | "C:\WINDOWS\system32\curl.exe" -L -o C:\Users\admin\Desktop\GenP_4.0.0_SOURCE\genp-4.0.0-src\autoit-v3.zip https://www.autoitscript.com/files/autoit3/autoit-v3.zip --user-agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" --silent --show-error --connect-timeout 30 | C:\Windows\System32\curl.exe | powershell.exe | ||||||||||||
User: admin Company: curl, https://curl.se/ Integrity Level: HIGH Description: The curl executable Exit code: 0 Version: 8.4.0 Modules
| |||||||||||||||
Total events
9 770
Read events
9 734
Write events
23
Delete events
13
Modification events
| (PID) Process: | (7260) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (7260) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (7260) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (7260) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (7260) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Downloads\chromium_build 1.zip | |||
| (PID) Process: | (7260) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\GenP_4.0.0_SOURCE.zip | |||
| (PID) Process: | (7260) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (7260) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (7260) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (7260) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
Executable files
19
Suspicious files
29
Text files
949
Unknown types
11
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7260 | WinRAR.exe | C:\Users\admin\Desktop\GenP_4.0.0_SOURCE\GenP-4.0.0-sha256.txt | text | |
MD5:2BB27EAE842BC48A9C9A4CA9851B022E | SHA256:2C9EB7EC313B9DDB9D3522D20E6258A9CE6EEBFA07646FEAD34CBA897124F94A | |||
| 7260 | WinRAR.exe | C:\Users\admin\Desktop\GenP_4.0.0_SOURCE\genp-4.0.0-src\GenP\Skull.ico | image | |
MD5:C37B537E533890560FE52664A7F1C1A0 | SHA256:1532311559D17CF7ECC0BE72FB47EC7D0EA086C414E2280566E0803133FD1D50 | |||
| 7260 | WinRAR.exe | C:\Users\admin\Desktop\GenP_4.0.0_SOURCE\genp-4.0.0-src\UPX\upx-5.0.1-win64.zip | compressed | |
MD5:AB6A6106F9A2AF3C3A54AD878FE1355C | SHA256:33BCF25CEDD3865B26B92B7E20E3A0F2F51BDEBEDC360122D0627995CFB4C2A6 | |||
| 7260 | WinRAR.exe | C:\Users\admin\Desktop\GenP_4.0.0_SOURCE\genp-4.0.0-src\build_info.txt | text | |
MD5:FE91D47527E7EC9024F4D263A5884DE5 | SHA256:5BFF34F3B20E7489574185A1F3C1263221FFB5E1BAC4449D25520432678A8B42 | |||
| 7260 | WinRAR.exe | C:\Users\admin\Desktop\GenP_4.0.0_SOURCE\genp-4.0.0-src\WinTrust\patch_wintrust.ps1 | text | |
MD5:4C1563EB08376A1FC0979A18C1DF28FC | SHA256:A73B572BBF1DDBF7D9F5A03EA5ECF9E2C296ECBEFBC60104656F21644B20B2F2 | |||
| 7260 | WinRAR.exe | C:\Users\admin\Desktop\GenP_4.0.0_SOURCE\genp-4.0.0-src\GenP\wintrust.dll | executable | |
MD5:B7A38368A52FF07D875E6465BD7EE26A | SHA256:8C6C791E8DB8728F9A610DEF238C61BE054BFA3DE487BF6AB037130A61A3EF19 | |||
| 7248 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_dghfdzu5.pwr.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 7248 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_xzwcx1go.sg3.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 7260 | WinRAR.exe | C:\Users\admin\Desktop\GenP_4.0.0_SOURCE\genp-4.0.0-src\GenP\upx.exe | executable | |
MD5:A14ACD4E0FD7F388B6C42CDE82FEC28B | SHA256:8DEF9DABA0817636962E60878E117EE1DCBA6C3F64FB4BC13449D447385F1B5B | |||
| 7260 | WinRAR.exe | C:\Users\admin\Desktop\GenP_4.0.0_SOURCE\genp-4.0.0-src\WinTrust\wintrust.dll | executable | |
MD5:1B3BF770D4F59CA883391321A21923AE | SHA256:ECB263D1F71B514CBD3ABAE65BAC84942355E0C2B31C3C11BA35709716CAAEE4 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
24
TCP/UDP connections
38
DNS requests
20
Threats
3
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
8044 | svchost.exe | GET | 200 | 23.216.77.13:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | NL | binary | 825 b | whitelisted |
7720 | SIHClient.exe | GET | 200 | 135.232.92.97:443 | https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping | US | — | — | whitelisted |
7720 | SIHClient.exe | GET | 200 | 74.178.76.128:443 | https://slscr.update.microsoft.com/sls/ping | US | — | — | whitelisted |
8044 | svchost.exe | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | US | binary | 814 b | whitelisted |
8044 | svchost.exe | GET | 200 | 51.104.136.2:443 | https://settings-win.data.microsoft.com/settings/v3.0/WSD/WaaSAssessment?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&ring=Retail&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=10.0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=4294967295&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=WaaSAssessment&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&ServicingBranch=CB&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&HonorWUfBDeferrals=0&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2 | US | text | 5.77 Kb | whitelisted |
5532 | SearchApp.exe | GET | 200 | 204.79.197.203:80 | http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQ3L3%2F%2Fa6ADK8NraY2GXzVaYrHG4AQUb6t%2B2v%2BXQ3LsO2d33oJhNYhHQoUCEzMAAAAGb6JMMcOVb6sAAAAAAAY%3D | US | binary | 959 b | whitelisted |
5532 | SearchApp.exe | GET | 200 | 23.11.41.157:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAjTxtAB8my1oj8MfWpz%2F7Y%3D | NL | binary | 314 b | whitelisted |
5316 | svchost.exe | POST | 400 | 20.190.160.3:443 | https://login.live.com/ppsecure/deviceaddcredential.srf | US | text | 203 b | whitelisted |
5316 | svchost.exe | GET | 200 | 23.11.41.157:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D | NL | binary | 471 b | whitelisted |
5316 | svchost.exe | POST | 400 | 20.190.160.3:443 | https://login.live.com/ppsecure/deviceaddcredential.srf | US | text | 203 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | Not routed | — | whitelisted |
8044 | svchost.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
5276 | MoUsoCoreWorker.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
— | — | 128.24.231.64:443 | activation-v2.sls.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
4 | System | 192.168.100.255:138 | — | Not routed | — | whitelisted |
8044 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
8044 | svchost.exe | 23.216.77.13:80 | crl.microsoft.com | AKAMAI-ASN1 | NL | whitelisted |
8044 | svchost.exe | 88.221.169.152:80 | www.microsoft.com | AKAMAI-AS | US | whitelisted |
3428 | svchost.exe | 172.211.123.250:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
5532 | SearchApp.exe | 2.16.241.201:443 | www.bing.com | AKAMAI-ASN1 | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
activation-v2.sls.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
oneocsp.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
8044 | svchost.exe | Unknown Traffic | ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW) |
2232 | svchost.exe | Misc activity | ET HUNTING Observed DNS Query to autoitscript .com |
7888 | curl.exe | Misc activity | ET HUNTING Observed Domain (autoitscript .com) in TLS SNI |