File name:

hwid pack.zip

Full analysis: https://app.any.run/tasks/5ef38e1e-ef06-4742-8f28-80e54f7012cc
Verdict: Malicious activity
Analysis date: April 13, 2025, 07:21:30
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ucorew64-sys
vuln-driver
arch-exec
arch-doc
amifldrv64-sys
obfuscated-js
delphi
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

734C14A94F1778E506606804D3566594

SHA1:

8CBD6A9C512EDAAB288A0FD24C7C2D7D71C3999D

SHA256:

41CAEB1DAB6AB9DA4571B88CD0A0A2B3A21CE305909358E538A04F988D4A139F

SSDEEP:

196608:ELlI5+lEzBGc3CqWeo/X/Mbw4+OPexK4Ux:GNYBG1DXQwXBBq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Vulnerable driver has been detected

      • WinRAR.exe (PID: 3896)

  • SUSPICIOUS

    • Drops a system driver (possible attempt to evade defenses)

      • WinRAR.exe (PID: 3896)

    • Reads security settings of Internet Explorer

      • DMIEDIT.EXE (PID: 5416)
      • HardDisk.exe (PID: 7912)

    • There is functionality for taking screenshot (YARA)

      • DMIEDIT.EXE (PID: 5416)
      • DMIEDIT.EXE (PID: 7276)
      • DMIEDIT.EXE (PID: 5504)
      • DMIEDIT.EXE (PID: 7212)
      • HardDisk.exe (PID: 1244)
      • HardDisk.exe (PID: 7912)

    • Executes application which crashes

      • DMIEDIT.EXE (PID: 7276)
      • DMIEDIT.EXE (PID: 5504)
      • DMIEDIT.EXE (PID: 5416)
      • DMIEDIT.EXE (PID: 7212)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3896)

    • Manual execution by a user

      • DMIEDIT.EXE (PID: 5416)
      • DMIEDIT.EXE (PID: 904)
      • msedge.exe (PID: 6080)
      • DMIEDIT.EXE (PID: 7276)
      • DMIEDIT.EXE (PID: 8040)
      • DMIEDIT.EXE (PID: 5504)
      • mspaint.exe (PID: 8068)
      • DMIEDIT.EXE (PID: 7280)
      • DMIEDIT.EXE (PID: 516)
      • DMIEDIT.EXE (PID: 7212)
      • AMIDEWINx64.EXE (PID: 7636)
      • AMIDEWINx64.EXE (PID: 4212)
      • HardDisk.exe (PID: 7912)
      • DMIEDIT.EXE (PID: 5280)
      • AMIDEWIN.EXE (PID: 7596)
      • HardDisk.exe (PID: 7372)
      • HardDisk.exe (PID: 1244)
      • HardDisk.exe (PID: 4200)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 3896)

    • Reads the computer name

      • DMIEDIT.EXE (PID: 5416)
      • identity_helper.exe (PID: 8164)
      • DMIEDIT.EXE (PID: 5504)
      • DMIEDIT.EXE (PID: 7276)
      • DMIEDIT.EXE (PID: 7212)
      • AMIDEWINx64.EXE (PID: 4212)
      • HardDisk.exe (PID: 7912)
      • DMIEDIT.EXE (PID: 516)
      • identity_helper.exe (PID: 4056)
      • HardDisk.exe (PID: 7372)
      • HardDisk.exe (PID: 1244)
      • HardDisk.exe (PID: 4200)

    • Checks supported languages

      • DMIEDIT.EXE (PID: 5416)
      • identity_helper.exe (PID: 8164)
      • DMIEDIT.EXE (PID: 7276)
      • DMIEDIT.EXE (PID: 5504)
      • DMIEDIT.EXE (PID: 7212)
      • DMIEDIT.EXE (PID: 516)
      • AMIDEWINx64.EXE (PID: 4212)
      • HardDisk.exe (PID: 7912)
      • AMIDEWIN.EXE (PID: 7596)
      • identity_helper.exe (PID: 4056)
      • HardDisk.exe (PID: 7372)
      • HardDisk.exe (PID: 1244)
      • HardDisk.exe (PID: 4200)

    • Application launched itself

      • msedge.exe (PID: 3300)
      • msedge.exe (PID: 6080)
      • msedge.exe (PID: 5956)

    • Reads Environment values

      • identity_helper.exe (PID: 8164)
      • identity_helper.exe (PID: 4056)

    • Checks proxy server information

      • slui.exe (PID: 4300)

    • Reads the software policy settings

      • slui.exe (PID: 4300)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 6072)
      • WerFault.exe (PID: 2896)
      • WerFault.exe (PID: 7468)
      • WerFault.exe (PID: 3396)

    • Compiled with Borland Delphi (YARA)

      • HardDisk.exe (PID: 1244)
      • HardDisk.exe (PID: 7912)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2023:07:11 19:49:08
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: hwid pack/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
268
Monitored processes
116
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT winrar.exe rundll32.exe no specs dmiedit.exe no specs dmiedit.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs slui.exe werfault.exe no specs mspaint.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs dmiedit.exe no specs dmiedit.exe msedge.exe no specs werfault.exe no specs msedge.exe no specs dmiedit.exe no specs dmiedit.exe msedge.exe no specs werfault.exe no specs msedge.exe no specs dmiedit.exe no specs dmiedit.exe dmiedit.exe msedge.exe no specs werfault.exe no specs amidewinx64.exe no specs amidewinx64.exe conhost.exe no specs msedge.exe no specs amidewin.exe no specs conhost.exe no specs harddisk.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs harddisk.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs harddisk.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs harddisk.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
436"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2620 --field-trial-handle=2344,i,4280044006243932732,16471422888268518074,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
516"C:\Users\admin\Desktop\hwid pack\serial changer\DMIEDIT.EXE" C:\Users\admin\Desktop\hwid pack\serial changer\DMIEDIT.EXE
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
DMI EDITOR/Windows MFC Application
Exit code:
0
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\desktop\hwid pack\serial changer\dmiedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
684"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7304 --field-trial-handle=2344,i,4280044006243932732,16471422888268518074,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
780"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=48 --mojo-platform-channel-handle=3852 --field-trial-handle=2344,i,4280044006243932732,16471422888268518074,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
864"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3580 --field-trial-handle=2516,i,7509422746029035785,11471766331847810064,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
904"C:\Users\admin\Desktop\hwid pack\serial changer\DMIEDIT.EXE" C:\Users\admin\Desktop\hwid pack\serial changer\DMIEDIT.EXE—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
DMI EDITOR/Windows MFC Application
Exit code:
3221226540
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\desktop\hwid pack\serial changer\dmiedit.exe
c:\windows\system32\ntdll.dll
1040"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2068 --field-trial-handle=2344,i,4280044006243932732,16471422888268518074,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1244"C:\Users\admin\Desktop\hwid pack\HardDisk.exe" C:\Users\admin\Desktop\hwid pack\HardDisk.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\hwid pack\harddisk.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
2092"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=51 --mojo-platform-channel-handle=7344 --field-trial-handle=2344,i,4280044006243932732,16471422888268518074,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2096"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2332 --field-trial-handle=2252,i,10242095243841477916,14947390882041280880,262144 --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
Total events
19 948
Read events
19 801
Write events
134
Delete events
13

Modification events

(PID) Process:(3896) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(3896) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(3896) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(3896) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\hwid pack.zip
(PID) Process:(3896) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3896) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3896) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3896) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3896) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(3896) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
Executable files
41
Suspicious files
614
Text files
178
Unknown types
2

Dropped files

PID
Process
Filename
Type
3896WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3896.21751\hwid pack\monitor serial\Info.txttext
MD5:DF95ACFBA3051D021EC94E47726BBD07
SHA256:61350CE9D700627A156845DFEE77C44703280B16FD30BC1C216BFFC1CC82C0A1
3896WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3896.21751\hwid pack\MacSetup.exeexecutable
MD5:A7C8CF1D50EBE630A7D0C47686A0ABBF
SHA256:A453B3EA8D8133531FAD26B18701C694C324CC201E3069D07E99F0E100908C1A
3896WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3896.21751\hwid pack\serial changer\README.txttext
MD5:0E28E605E0988892043002E8D6FA719B
SHA256:1541F150F12295D926578FC8920F2F398D046BDDA66BC3026BF2533BBA07666B
3896WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3896.21751\hwid pack\HardDisk.exeexecutable
MD5:C20E96D4E616CE333C19A1C15A1CC137
SHA256:2C141C06F7DF57F11EF2C62F2A96093484A65DF47065B1A475C53784AF0E2664
3896WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3896.21751\hwid pack\monitor serial\CRU.exeexecutable
MD5:0F69AF48C32613F73C6ACB87A7D18661
SHA256:0351A943CA93558FF36F74C3F0C768DCEB724E833E282ABCF1BE5B2E71D5C67B
3896WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3896.21751\hwid pack\serial changer\amifldrv64.sysexecutable
MD5:785045F8B25CD2E937DDC6B09DEBE01A
SHA256:37073E42FFA0322500F90CD7E3C8D02C4CDD695D31C77E81560ABEC20BFB68BA
3896WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3896.21751\hwid pack\serial changer\AMIDEWINx64.EXEexecutable
MD5:6A6505B2413D2C7B16C6D059448DB9E5
SHA256:53E3B72F8EB13ACF3CB69D4CB124E8DC64FC541555C3C95CC8003B8046853955
3896WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3896.21751\hwid pack\serial changer\DMIEDIT.EXEexecutable
MD5:FBAF6262FD84F9966338518D4DE46FDD
SHA256:5D37E5E7CE01549965BF2166ADCBA33D1E2C4BD2C90711032F3987B58452CE49
3896WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3896.21751\hwid pack\serial changer\UCORESYS.SYSexecutable
MD5:9555D36FB21B993E5C4B98C2FC2B3671
SHA256:FD6F56189CD723B32FC06392867FCD5128E63D8B5801E4F7A83523F820531981
3896WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3896.21751\hwid pack\monitor serial\restart.exeexecutable
MD5:8242CE426AD462EFF02EDAE1487A6949
SHA256:B68EE265308DC9DA7DBB521BB71238D27AC50A5EE816F21C13818393BE982D7A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
37
TCP/UDP connections
166
DNS requests
205
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.18:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7700
svchost.exe
GET
206
23.48.23.27:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/a575cead-e662-4f4d-b0c3-81f1438d0388?P1=1744954407&P2=404&P3=2&P4=ihF8AynDFD65nb5KS2MiqgTg4l7mkMuM9IiHTmSsMFboMr4p9ML4pnzYjHrLqAcmcukSSZee5dh5Pwive9f8IQ%3d%3d
unknown
—
—
whitelisted
7700
svchost.exe
GET
206
23.48.23.27:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/a575cead-e662-4f4d-b0c3-81f1438d0388?P1=1744954407&P2=404&P3=2&P4=ihF8AynDFD65nb5KS2MiqgTg4l7mkMuM9IiHTmSsMFboMr4p9ML4pnzYjHrLqAcmcukSSZee5dh5Pwive9f8IQ%3d%3d
unknown
—
—
whitelisted
7700
svchost.exe
GET
206
23.48.23.27:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/a575cead-e662-4f4d-b0c3-81f1438d0388?P1=1744954407&P2=404&P3=2&P4=ihF8AynDFD65nb5KS2MiqgTg4l7mkMuM9IiHTmSsMFboMr4p9ML4pnzYjHrLqAcmcukSSZee5dh5Pwive9f8IQ%3d%3d
unknown
—
—
whitelisted
7700
svchost.exe
GET
206
23.48.23.27:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/a575cead-e662-4f4d-b0c3-81f1438d0388?P1=1744954407&P2=404&P3=2&P4=ihF8AynDFD65nb5KS2MiqgTg4l7mkMuM9IiHTmSsMFboMr4p9ML4pnzYjHrLqAcmcukSSZee5dh5Pwive9f8IQ%3d%3d
unknown
—
—
whitelisted
7852
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7852
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7700
svchost.exe
GET
206
23.48.23.27:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/a575cead-e662-4f4d-b0c3-81f1438d0388?P1=1744954407&P2=404&P3=2&P4=ihF8AynDFD65nb5KS2MiqgTg4l7mkMuM9IiHTmSsMFboMr4p9ML4pnzYjHrLqAcmcukSSZee5dh5Pwive9f8IQ%3d%3d
unknown
—
—
whitelisted
7700
svchost.exe
GET
206
23.48.23.27:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/a575cead-e662-4f4d-b0c3-81f1438d0388?P1=1744954407&P2=404&P3=2&P4=ihF8AynDFD65nb5KS2MiqgTg4l7mkMuM9IiHTmSsMFboMr4p9ML4pnzYjHrLqAcmcukSSZee5dh5Pwive9f8IQ%3d%3d
unknown
—
—
whitelisted
7700
svchost.exe
HEAD
200
23.48.23.27:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/a575cead-e662-4f4d-b0c3-81f1438d0388?P1=1744954407&P2=404&P3=2&P4=ihF8AynDFD65nb5KS2MiqgTg4l7mkMuM9IiHTmSsMFboMr4p9ML4pnzYjHrLqAcmcukSSZee5dh5Pwive9f8IQ%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.18:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6512
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6080
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
6512
msedge.exe
141.193.213.21:443
www.ami.com
—
—
whitelisted
6512
msedge.exe
142.250.184.195:443
fonts.gstatic.com
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
google.com
  • 172.217.18.14
whitelisted
crl.microsoft.com
  • 23.216.77.18
  • 23.216.77.22
  • 23.216.77.8
  • 23.216.77.28
  • 23.216.77.30
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.249
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 150.171.28.11
  • 150.171.27.11
whitelisted
www.ami.com
  • 141.193.213.21
  • 141.193.213.20
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.253.45
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
bzib.nelreports.net
  • 23.48.23.51
  • 23.48.23.26
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
hwid pack.zip