File name:

FuckDiscordPI-main.rar

Full analysis: https://app.any.run/tasks/21b87f0f-ea98-471b-aa68-a0e3dbabe819
Verdict: Malicious activity
Analysis date: April 06, 2025, 11:10:08
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
windivert-sys
mal-driver
arch-exec
arch-doc
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

D4EEBFCD7F285F130823B20D0AE8C8CE

SHA1:

E66B2EBF2D7327AF8AECE0E61F90E13459D5F27D

SHA256:

47345BBB90A4EC5F3C30947239FB8E1977243812353AD5824A3D5A309A0CB4D9

SSDEEP:

49152:gwGpdjz3MERdO1ZBO2bQiL2CIbb0k+slK4hFdnGJGd2GFij3F4Ymli0dfmfSFy7A:s7dO3BVQE2Yl0Jvnh2GAj3F4fl/F2Wya

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Malicious driver has been detected

      • WinRAR.exe (PID: 1132)

    • Generic archive extractor

      • WinRAR.exe (PID: 1132)

    • Detects Cygwin installation

      • WinRAR.exe (PID: 1132)

    • Starts NET.EXE for service management

      • cmd.exe (PID: 7952)
      • net.exe (PID: 8016)
      • cmd.exe (PID: 8172)
      • net.exe (PID: 668)
      • net.exe (PID: 7452)
      • cmd.exe (PID: 5548)

  • SUSPICIOUS

    • Drops a system driver (possible attempt to evade defenses)

      • WinRAR.exe (PID: 1132)

    • Executing commands from ".cmd" file

      • WinRAR.exe (PID: 1132)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 1132)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 1132)

    • Windows service management via SC.EXE

      • sc.exe (PID: 8072)
      • sc.exe (PID: 8112)
      • sc.exe (PID: 8132)
      • sc.exe (PID: 5244)
      • sc.exe (PID: 7464)
      • sc.exe (PID: 3176)
      • sc.exe (PID: 4180)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 7952)
      • cmd.exe (PID: 8172)
      • cmd.exe (PID: 5548)

    • Creates a new Windows service

      • sc.exe (PID: 8092)
      • sc.exe (PID: 7520)

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 1132)

  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 1132)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1132)

    • Checks supported languages

      • winws.exe (PID: 7640)

    • Reads the computer name

      • winws.exe (PID: 7640)

    • Reads the software policy settings

      • slui.exe (PID: 7604)
      • slui.exe (PID: 7320)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 5596)

    • Checks proxy server information

      • slui.exe (PID: 7604)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 352
UncompressedSize: 1002
OperatingSystem: Win32
ArchivedFileName: discord_alternative_two.cmd
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
164
Monitored processes
31
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start THREAT winrar.exe sppextcomobj.exe no specs slui.exe winws.exe no specs winws.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs net.exe no specs net1.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs net.exe no specs net1.exe no specs sc.exe no specs openwith.exe no specs cmd.exe no specs conhost.exe no specs net.exe no specs net1.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
668net stop "fuckdiscordpi"C:\Windows\System32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\mpr.dll
c:\windows\system32\bcrypt.dll
1132"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\FuckDiscordPI-main.rarC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2284C:\WINDOWS\system32\net1 stop "fuckdiscordpi"C:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\samcli.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
3176sc start "fuckdiscordpi"C:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
4180sc description "fuckdiscordpi" "FuckDiscordPi: Discord and Youtube service use zapret DPI bypass software"C:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
5244sc delete "fuckdiscordpi"C:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
5548C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$DIa1132.16218\service_start_discord_youtube.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
5596C:\WINDOWS\system32\OpenWith.exe -EmbeddingC:\Windows\System32\OpenWith.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7288C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7320"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
4 657
Read events
4 648
Write events
9
Delete events
0

Modification events

(PID) Process:(1132) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(1132) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(1132) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(1132) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\FuckDiscordPI-main.rar
(PID) Process:(1132) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1132) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1132) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1132) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7640) winws.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Cygwin\Installations
Operation:writeName:acef9c5cfe4f9812
Value:
\??\C:\Users\admin\AppData\Local\Temp
Executable files
4
Suspicious files
2
Text files
20
Unknown types
0

Dropped files

PID
Process
Filename
Type
1132WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1132.13017\discord_alternative_two.cmdtext
MD5:57B50A5DDC87F8E9B6803333F6EE0B52
SHA256:168E55E2F4424BAAE7BEBB89E29388B4EC60EDEED18ECE1F215A5EC15DF89AD3
1132WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1132.13017\discord_youtube.cmdtext
MD5:AB9AAA5817AB05E454B38E7A60E4C232
SHA256:6F11C484C7E68953B26B475731918FC95F60A0722044BD00E952CE11E9608A68
1132WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1132.13017\tls_clienthello_www_google_com.binbinary
MD5:7AB7AD857C5B8794FBDF1091B494DC94
SHA256:E5938780152169F720383F80EABB309E9477369B83B5EC40CC137C397F862CDE
1132WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1132.13017\service_start_discord.battext
MD5:E98A899FF6FFF5C63AA691DE7D90EF24
SHA256:14E5366554D8671616FD27F447C04B2694E576A00E059B799036D3BC58F173DC
1132WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1132.13017\winws.exeexecutable
MD5:8C624E64742BC19447D52F61EDEC52DB
SHA256:13FD7A9C6F7C98239A61A212F69211A0F19159B2E8CDAE8B1EFC57D35CDCD5AD
1132WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1132.13017\service_start_discord_youtube.battext
MD5:5E9E4C768660D632FE24F265D03C15D6
SHA256:D03EF83BF10110937E0BCEB0EB5AEBF86B15834E8EA79607999A9DB28A517994
1132WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1132.13017\WinDivert.dllexecutable
MD5:B2014D33EE645112D5DC16FE9D9FCBFF
SHA256:C1E060EE19444A259B2162F8AF0F3FE8C4428A1C6F694DCE20DE194AC8D7D9A2
1132WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1132.13017\discord_alternative.cmdtext
MD5:F1E3CF9D2AF5BBD37A7167B4D672A7A6
SHA256:55F76D987A29C58C668E0718815A62C57B67689DEB23488297378A3287707EE9
1132WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1132.13017\list-discord.txttext
MD5:393702FC2CA376B26E62126BC606189F
SHA256:72F97AB17CB9E6D03D8E154BB8915E4FE8024F96EF31C79DA6F737D8F69077B8
1132WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1132.13017\list-youtube.txttext
MD5:9D1CFA48BDBF7BB0686ADA93CDDD37DC
SHA256:309E942DA73F8D4664C3D22B39A9B045AF5727EA09AD4A82C8DA0E5E98CF5412
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
22
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1164
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1164
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2340
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6544
svchost.exe
40.126.31.1:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.172.255.218:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.142
  • 216.58.206.46
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
login.live.com
  • 40.126.31.1
  • 40.126.31.69
  • 20.190.159.68
  • 40.126.31.2
  • 20.190.159.0
  • 40.126.31.131
  • 40.126.31.130
  • 40.126.31.67
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.172.255.218
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 2.16.253.202
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
FuckDiscordPI-main.rar