File name:

8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.zip

Full analysis: https://app.any.run/tasks/ffd4a516-5a35-472c-bd32-0356c75a3996
Verdict: Malicious activity
Threats:

GuLoader is an advanced downloader written in shellcode. It’s used by criminals to distribute other malware, notably trojans, on a large scale. It’s infamous for using anti-detection and anti-analysis capabilities.

Malware Trends Tracker     >>>
Analysis date: September 03, 2025, 17:24:14
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
remcos
rat
guloader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

72117F254911A0F1E5E2C8BC6B60259E

SHA1:

277B5A74090E87B43EC1119DEE1679913300DA18

SHA256:

44814432B5C6A158C04641742B2E5E59EEF20302A163E9CEB10A8C6389A0AC4D

SSDEEP:

12288:9hGLIe2vVRJFsaezGMFPLsM1V48Ufl2W3J7Yg62lX:9hc72tzFsaeSMFPLsAVJUflT57Yg6SX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 4036)

    • Executing a file with an untrusted certificate

      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 5424)
      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 2400)
      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 2632)
      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 5628)

    • Changes the autorun value in the registry

      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 2400)
      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 2632)

    • GULOADER has been detected (YARA)

      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 5424)

    • Known privilege escalation attack

      • dllhost.exe (PID: 3108)

    • GULOADER SHELLCODE has been detected (YARA)

      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 5424)

    • REMCOS mutex has been found

      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 5424)
      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 5628)

    • REMCOS has been detected (YARA)

      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 5628)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 4036)
      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 5424)
      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 5628)

    • Executable content was dropped or overwritten

      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 2400)
      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 5424)
      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 2632)

    • Application launched itself

      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 2400)
      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 2632)
      • updater.exe (PID: 1156)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 2400)
      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 2632)

    • The process creates files with name similar to system file names

      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 2400)
      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 2632)

    • There is functionality for taking screenshot (YARA)

      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 5424)
      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 5628)

    • The process executes via Task Scheduler

      • updater.exe (PID: 1156)

    • Connects to unusual port

      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 5628)

  • INFO

    • Checks supported languages

      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 2400)
      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 5424)
      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 2632)
      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 5628)
      • updater.exe (PID: 1156)
      • updater.exe (PID: 6292)

    • Create files in a temporary directory

      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 2400)
      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 5424)
      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 2632)

    • Reads the computer name

      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 2400)
      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 5424)
      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 2632)
      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 5628)
      • updater.exe (PID: 1156)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4036)

    • Creates files or folders in the user directory

      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 2400)
      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 5424)

    • Checks proxy server information

      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 5424)
      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 5628)
      • slui.exe (PID: 4120)

    • Launching a file from a Registry key

      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 2400)
      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 2632)

    • Reads the machine GUID from the registry

      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 5424)
      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 5628)

    • Reads the software policy settings

      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 5424)
      • 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe (PID: 5628)
      • slui.exe (PID: 4120)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 3108)

    • Process checks whether UAC notifications are on

      • updater.exe (PID: 1156)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(5628) 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe
C2 (1)streetwisecre.duckdns.org:3421:0streetwisecre.duckdns.org:2565
BotnetJUNE
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell0
Setup_path%APPDATA%
Copy_fileregistries.exe
Startup_valueTrue
Hide_fileTrue
Mutex_nameiwyrhtutty-9599U5
Keylog_flag1
Keylog_path%APPDATA%
Keylog_fileregistries.dat
Keylog_cryptFalse
Hide_keylogTrue
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path1
Audio_dirMicRecords
Connect_delay0
Copy_dirregistries
Keylog_dirregistries
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2025:09:02 20:09:42
ZipCRC: 0x6550c2ca
ZipCompressedSize: 412940
ZipUncompressedSize: 435424
ZipFileName: 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
152
Monitored processes
10
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe #GULOADER 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe CMSTPLUA 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe slui.exe #REMCOS 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe svchost.exe updater.exe no specs updater.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1156"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --wake --systemC:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe—svchost.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2400"C:\Users\admin\AppData\Local\Temp\Rar$EXb4036.41679\8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb4036.41679\8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb4036.41679\8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
2632"C:\Users\admin\AppData\Local\Temp\Rar$EXb4036.41679\8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb4036.41679\8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe
dllhost.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb4036.41679\8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
3108C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\SysWOW64\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\combase.dll
4036"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4120C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5424"C:\Users\admin\AppData\Local\Temp\Rar$EXb4036.41679\8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb4036.41679\8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe
8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\users\admin\appdata\local\temp\rar$exb4036.41679\8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
5628"C:\Users\admin\AppData\Local\Temp\Rar$EXb4036.41679\8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb4036.41679\8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe
8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\users\admin\appdata\local\temp\rar$exb4036.41679\8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Remcos
(PID) Process(5628) 8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe
C2 (1)streetwisecre.duckdns.org:3421:0streetwisecre.duckdns.org:2565
BotnetJUNE
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell0
Setup_path%APPDATA%
Copy_fileregistries.exe
Startup_valueTrue
Hide_fileTrue
Mutex_nameiwyrhtutty-9599U5
Keylog_flag1
Keylog_path%APPDATA%
Keylog_fileregistries.dat
Keylog_cryptFalse
Hide_keylogTrue
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path1
Audio_dirMicRecords
Connect_delay0
Copy_dirregistries
Keylog_dirregistries
6292"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=134.0.6985.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x111c460,0x111c46c,0x111c478C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe—updater.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
Total events
6 120
Read events
6 075
Write events
32
Delete events
13

Modification events

(PID) Process:(4036) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4036) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4036) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4036) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.zip
(PID) Process:(4036) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4036) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4036) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4036) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4036) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(4036) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
5
Suspicious files
18
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
4036WinRAR.exeC:\Users\admin\AppData\Local\Temp\8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d\8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exeexecutable
MD5:964D3BF175BE28F49F03EBD3D8E7F65A
SHA256:8C459DA35CC2A38D218859F9FB816013C0D33C4BDD3792A69C20BEAF5609687D
24008c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exeC:\Users\admin\AppData\Local\Temp\nsa3F72.tmp\System.dllexecutable
MD5:FCCFF8CB7A1067E23FD2E2B63971A8E1
SHA256:6FCEA34C8666B06368379C6C402B5321202C11B00889401C743FB96C516C679E
24008c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\unbeheaded.lnkbinary
MD5:D842B4E702532DFCA329C6CF4D93A947
SHA256:3CFC0B9D6BBD102164277B86D71E77452DD81683D07B047E7A4C2A61169BB1BA
24008c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exeC:\Users\admin\AppData\Roaming\Jammerbugten\Forhaane54.fngbinary
MD5:A1ADE4B09AD85BB9F455629A4DF60E70
SHA256:78D5125C03F55DD88AFBB0DA586C1841070F6636BF216EBE6F3683D8DDAD3425
24008c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exeC:\Users\admin\AppData\Roaming\Jammerbugten\Cancercelle.Coubinary
MD5:CC86483FC4A373BCA00F7C7FF76227D9
SHA256:C71536E5D0B1E1DAC5A83EE9C645BCAF1AD5C901FFD779AE82C72429D8237A54
24008c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exeC:\Users\admin\AppData\Roaming\Jammerbugten\Ingenirhuset.Flebinary
MD5:3C03CD7654CCDA78FA8F75BDE3F6AE0F
SHA256:C60D5706A2DE200D50720C895045784CE9F1E1AA795600D563D02BC2257D31EF
24008c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exeC:\Users\admin\AppData\Roaming\Jammerbugten\impanelment.ovebinary
MD5:B7075F0D992DDFCB6B0E8E5A0F0C7DC1
SHA256:D63E19EA499886D9428838B6B1301C3D75FDE6B91A49912217F8D9E91792AE1B
54248c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:1FBB37F79B317A9A248E7C4CE4F5BAC5
SHA256:9BF639C595FE335B6F694EE35990BEFD2123F5E07FD1973FF619E3FC88F5F49F
4036WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb4036.41679\8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exeexecutable
MD5:964D3BF175BE28F49F03EBD3D8E7F65A
SHA256:8C459DA35CC2A38D218859F9FB816013C0D33C4BDD3792A69C20BEAF5609687D
24008c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\aandsfravrelsen.initext
MD5:E7A6B2DCFF257F0EE3AC11AA7ABAA8EA
SHA256:D740B6B383884EDDE5919F7897C8941B5C5B53997CE40EE6C648F1EE83497AC4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
42
DNS requests
30
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
825 b
whitelisted
1268
svchost.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
814 b
whitelisted
2288
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
DE
binary
471 b
whitelisted
2980
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
DE
binary
407 b
whitelisted
2980
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
DE
binary
419 b
whitelisted
5424
8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe
GET
200
142.250.185.227:80
http://c.pki.goog/r/gsr1.crl
US
binary
1.70 Kb
whitelisted
5424
8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe
GET
200
142.250.185.227:80
http://o.pki.goog/we2/MFAwTjBMMEowSDAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCDwtar93%2BdmMQSOASEmXU%2Bw%3D%3D
US
binary
278 b
whitelisted
5424
8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe
GET
200
142.250.185.227:80
http://c.pki.goog/r/r4.crl
US
binary
530 b
whitelisted
2940
svchost.exe
GET
200
72.246.169.163:80
http://x1.c.lencr.org/
DE
binary
734 b
whitelisted
5424
8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.exe
GET
200
142.250.185.227:80
http://o.pki.goog/we2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEDlu5jh3Q1WcEuTHZiS6CY0%3D
US
binary
280 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4460
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
69.192.161.161:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2288
svchost.exe
20.190.159.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2288
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
google.com
  • 142.250.185.174
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 69.192.161.161
whitelisted
login.live.com
  • 20.190.159.130
  • 40.126.31.3
  • 20.190.159.23
  • 40.126.31.130
  • 40.126.31.128
  • 20.190.159.129
  • 40.126.31.131
  • 40.126.31.2
  • 20.190.160.128
  • 40.126.32.72
  • 20.190.160.14
  • 20.190.160.65
  • 20.190.160.3
  • 20.190.160.64
  • 20.190.160.67
  • 20.190.160.5
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 20.165.94.63
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
drive.google.com
  • 142.250.185.206
whitelisted
c.pki.goog
  • 142.250.185.227
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
2200
svchost.exe
Misc activity
ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
2200
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
2200
svchost.exe
Misc activity
ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
2200
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
2200
svchost.exe
Misc activity
ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
2200
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
2200
svchost.exe
Misc activity
ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
2200
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
2200
svchost.exe
Misc activity
ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
8c459da35cc2a38d218859f9fb816013c0d33c4bdd3792a69c20beaf5609687d.zip