File name:

autoonline.zip

Full analysis: https://app.any.run/tasks/1a01ca3e-f03d-4c4b-ac44-7363d5d351a5
Verdict: No threats detected
Analysis date: April 18, 2020, 16:01:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

9705F818E9FCA27029D07F638ECECCDB

SHA1:

6963391C5515B5912DC3A5AAE750845C2594B3C5

SHA256:

3F6E983D3C8E8B5DB34996FB4A0F8766F92FE7717641C0D20AC0B11A240F1073

SSDEEP:

6144:dwSevT5WvWMHi8N62By09k0SYZhx80rR2GPyBeFU6mxuvJqLDY1LxS4FkoSktftP:QrMRtk0605s0PyBN6TvJKDY1lFlxtP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Writes to a desktop.ini file (may be used to cloak folders)

      • WinRAR.exe (PID: 3148)

    • Executed via COM

      • prevhost.exe (PID: 1392)

  • INFO

    • Manual execution by user

      • Bots 0.3.7-R2 [samp] by ZOOPI.exe (PID: 1784)
      • Bots 0.3.7-R2 [samp] by ZOOPI.exe (PID: 2568)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2018:05:24 16:31:02
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: Bots 0.3.7-R2 [samp] by ZOOPI/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
64
Monitored processes
24
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs bots 0.3.7-r2 [samp] by zoopi.exe no specs bot.exe bot.exe bot.exe bot.exe bot.exe bot.exe bot.exe bot.exe bot.exe bot.exe prevhost.exe no specs bots 0.3.7-r2 [samp] by zoopi.exe no specs bot.exe bot.exe bot.exe bot.exe bot.exe bot.exe bot.exe bot.exe bot.exe bot.exe

Process information

PID
CMD
Path
Indicators
Parent process
988"C:\Users\admin\Desktop\Bots 0.3.7-R2 [samp] by ZOOPI\Bot.exe" C:\Users\admin\Desktop\Bots 0.3.7-R2 [samp] by ZOOPI\Bot.exe
Bots 0.3.7-R2 [samp] by ZOOPI.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
Modules
Images
c:\users\admin\desktop\bots 0.3.7-r2 [samp] by zoopi\bot.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\advapi32.dll
1392C:\Windows\system32\prevhost.exe {914FEED8-267A-4BAA-B8AA-21E233792679} -EmbeddingC:\Windows\system32\prevhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Preview Handler Surrogate Host
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\prevhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
1524"C:\Users\admin\Desktop\Bots 0.3.7-R2 [samp] by ZOOPI\Bot.exe" C:\Users\admin\Desktop\Bots 0.3.7-R2 [samp] by ZOOPI\Bot.exe
Bots 0.3.7-R2 [samp] by ZOOPI.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
Modules
Images
c:\users\admin\desktop\bots 0.3.7-r2 [samp] by zoopi\bot.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\advapi32.dll
1784"C:\Users\admin\Desktop\Bots 0.3.7-R2 [samp] by ZOOPI\Bots 0.3.7-R2 [samp] by ZOOPI.exe" C:\Users\admin\Desktop\Bots 0.3.7-R2 [samp] by ZOOPI\Bots 0.3.7-R2 [samp] by ZOOPI.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Bots
Exit code:
0
Version:
2.0.0
Modules
Images
c:\users\admin\desktop\bots 0.3.7-r2 [samp] by zoopi\bots 0.3.7-r2 [samp] by zoopi.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1940"C:\Users\admin\Desktop\Bots 0.3.7-R2 [samp] by ZOOPI\Bot.exe" C:\Users\admin\Desktop\Bots 0.3.7-R2 [samp] by ZOOPI\Bot.exe
Bots 0.3.7-R2 [samp] by ZOOPI.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
Modules
Images
c:\users\admin\desktop\bots 0.3.7-r2 [samp] by zoopi\bot.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\advapi32.dll
2312"C:\Users\admin\Desktop\Bots 0.3.7-R2 [samp] by ZOOPI\Bot.exe" C:\Users\admin\Desktop\Bots 0.3.7-R2 [samp] by ZOOPI\Bot.exe
Bots 0.3.7-R2 [samp] by ZOOPI.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
Modules
Images
c:\users\admin\desktop\bots 0.3.7-r2 [samp] by zoopi\bot.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\advapi32.dll
2356"C:\Users\admin\Desktop\Bots 0.3.7-R2 [samp] by ZOOPI\Bot.exe" C:\Users\admin\Desktop\Bots 0.3.7-R2 [samp] by ZOOPI\Bot.exe
Bots 0.3.7-R2 [samp] by ZOOPI.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
Modules
Images
c:\users\admin\desktop\bots 0.3.7-r2 [samp] by zoopi\bot.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\advapi32.dll
2428"C:\Users\admin\Desktop\Bots 0.3.7-R2 [samp] by ZOOPI\Bot.exe" C:\Users\admin\Desktop\Bots 0.3.7-R2 [samp] by ZOOPI\Bot.exe
Bots 0.3.7-R2 [samp] by ZOOPI.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
Modules
Images
c:\users\admin\desktop\bots 0.3.7-r2 [samp] by zoopi\bot.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\advapi32.dll
2432"C:\Users\admin\Desktop\Bots 0.3.7-R2 [samp] by ZOOPI\Bot.exe" C:\Users\admin\Desktop\Bots 0.3.7-R2 [samp] by ZOOPI\Bot.exe
Bots 0.3.7-R2 [samp] by ZOOPI.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
Modules
Images
c:\users\admin\desktop\bots 0.3.7-r2 [samp] by zoopi\bot.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\advapi32.dll
2568"C:\Users\admin\Desktop\Bots 0.3.7-R2 [samp] by ZOOPI\Bots 0.3.7-R2 [samp] by ZOOPI.exe" C:\Users\admin\Desktop\Bots 0.3.7-R2 [samp] by ZOOPI\Bots 0.3.7-R2 [samp] by ZOOPI.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Bots
Exit code:
0
Version:
2.0.0
Modules
Images
c:\users\admin\desktop\bots 0.3.7-r2 [samp] by zoopi\bots 0.3.7-r2 [samp] by zoopi.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
688
Read events
661
Write events
27
Delete events
0

Modification events

(PID) Process:(3148) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3148) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3148) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3148) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\autoonline.zip
(PID) Process:(3148) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3148) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3148) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3148) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3148) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(3148) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\AppData\Local\Temp
Executable files
0
Suspicious files
0
Text files
20
Unknown types
0

Dropped files

PID
Process
Filename
Type
3148WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3148.4625\Bots 0.3.7-R2 [samp] by ZOOPI\Bot.exe —
MD5:—
SHA256:—
3148WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3148.4625\Bots 0.3.7-R2 [samp] by ZOOPI\Bots 0.3.7-R2 [samp] by ZOOPI.exe —
MD5:—
SHA256:—
3148WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3148.4625\Bots 0.3.7-R2 [samp] by ZOOPI\desktop.ini —
MD5:—
SHA256:—
3148WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3148.4625\Bots 0.3.7-R2 [samp] by ZOOPI\NickNames.txt —
MD5:—
SHA256:—
1784Bots 0.3.7-R2 [samp] by ZOOPI.exeC:\Users\admin\Desktop\Bots 0.3.7-R2 [samp] by ZOOPI\Bot.xmltext
MD5:—
SHA256:—
2568Bots 0.3.7-R2 [samp] by ZOOPI.exeC:\Users\admin\Desktop\Bots 0.3.7-R2 [samp] by ZOOPI\Bot.xmltext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
63
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3948
Bot.exe
193.70.126.129:4028
—
OVH SAS
PL
unknown
2432
Bot.exe
193.70.126.129:4028
—
OVH SAS
PL
unknown
1524
Bot.exe
193.70.126.129:4028
—
OVH SAS
PL
unknown
3344
Bot.exe
193.70.126.129:4028
—
OVH SAS
PL
unknown
3684
Bot.exe
193.70.126.129:4028
—
OVH SAS
PL
unknown
2884
Bot.exe
193.70.126.129:4028
—
OVH SAS
PL
unknown
4004
Bot.exe
193.70.126.129:4028
—
OVH SAS
PL
unknown
2612
Bot.exe
193.70.126.129:4028
—
OVH SAS
PL
unknown
3284
Bot.exe
193.70.126.129:4028
—
OVH SAS
PL
unknown
2312
Bot.exe
193.70.126.129:4028
—
OVH SAS
PL
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
autoonline.zip