File name:

ZIP-Password-IS-951951______VmProtect.zip

Full analysis: https://app.any.run/tasks/f8d41113-dd73-4d61-b68c-ee94b82967b6
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 15, 2022, 02:52:07
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
trojan
rat
redline
stealer
loader
raccoon
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

EFE9E1BFE8405AE27DFADA0D189F44CA

SHA1:

EFD3770EDCEBC03E5437945B50C0D784576F29E9

SHA256:

659FE37447FF0D6A6B470144E321829140D3B4AAB03488AAC75C6571CAD87CED

SSDEEP:

98304:35W4nrEUX8K2qry24uzoTG04RPD9KRI0NBmDlWUKa+T4lmG+g8ILBVQaGKyHEsRw:35WW8QrFLJhKO0/0lxA4lm1acaykOwya

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executes PowerShell scripts

      • cmd.exe (PID: 984)

    • Drops executable file immediately after starts

      • setup_installer.exe (PID: 760)
      • 61e231b2a394a_Sat02fc0e52.exe (PID: 3992)
      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 1688)
      • 61e231b2a394a_Sat02fc0e52.exe (PID: 3564)

    • Application was dropped or rewritten from another process

      • setup_installer.exe (PID: 760)
      • 149_setupInstaller.exe (PID: 3628)
      • 149_setupInstaller.exe (PID: 684)
      • 61e231ae18706_Sat028e900d3.exe (PID: 1304)
      • 61e231b18bfb5_Sat022d459aaa7.exe (PID: 3520)
      • 61e231b686514_Sat020f28d97695.exe (PID: 3412)
      • 61e231afbd0ff_Sat0275ca378161.exe (PID: 356)
      • 61e231b0801f9_Sat02dabcd2901f.exe (PID: 3016)
      • 61e231ad0641a_Sat02817ac1e8.exe (PID: 2920)
      • 61e231b2a394a_Sat02fc0e52.exe (PID: 3992)
      • 61e231ab47792_Sat02fb6439.exe (PID: 1444)
      • 61e231afbd0ff_Sat0275ca378161.exe (PID: 1324)
      • 61e231c2c70ca_Sat02e1a7ed.exe (PID: 3436)
      • setup_install.exe (PID: 3324)
      • 61e231b2a394a_Sat02fc0e52.exe (PID: 3564)
      • 61e231c7536eb_Sat028b7251.exe (PID: 2608)
      • 61e231c8a77c0_Sat021d76eef2.exe (PID: 2080)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 2368)
      • 61e231b0801f9_Sat02dabcd2901f.exe (PID: 2560)
      • 61e231c431105_Sat0296c511cdf.exe (PID: 3928)
      • 61e231ab47792_Sat02fb6439.exe (PID: 2584)
      • c2001101-5d15-47d7-997d-9d9bd627547e.exe (PID: 684)
      • dfa475ad-b6b6-4938-956f-6f01c20d7fb7.exe (PID: 2744)
      • 3ea4339b-068c-41c7-9e2b-9b2faaf10297.exe (PID: 3224)
      • db3b8f82-a67a-4fd1-9805-66fc2ffbd6ae.exe (PID: 2420)
      • 517A.tmp.exe (PID: 3364)
      • 57D4.tmp.exe (PID: 3172)
      • 22b3368b-da1a-4cd8-924a-4d0abaff18f1.exe (PID: 576)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 560)
      • 53027.exe (PID: 4076)

    • Loads dropped or rewritten executable

      • setup_install.exe (PID: 3324)
      • rundll32.exe (PID: 3148)
      • 57D4.tmp.exe (PID: 3172)

    • Changes settings of System certificates

      • 61e231afbd0ff_Sat0275ca378161.exe (PID: 1324)

    • Actions looks like stealing of personal data

      • c2001101-5d15-47d7-997d-9d9bd627547e.exe (PID: 684)
      • 61e231b0801f9_Sat02dabcd2901f.exe (PID: 2560)
      • dfa475ad-b6b6-4938-956f-6f01c20d7fb7.exe (PID: 2744)
      • 61e231ab47792_Sat02fb6439.exe (PID: 2584)
      • 22b3368b-da1a-4cd8-924a-4d0abaff18f1.exe (PID: 576)
      • 57D4.tmp.exe (PID: 3172)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 560)

    • Stealing of credential data

      • c2001101-5d15-47d7-997d-9d9bd627547e.exe (PID: 684)
      • 57D4.tmp.exe (PID: 3172)

    • Steals credentials from Web Browsers

      • c2001101-5d15-47d7-997d-9d9bd627547e.exe (PID: 684)
      • 61e231b0801f9_Sat02dabcd2901f.exe (PID: 2560)
      • dfa475ad-b6b6-4938-956f-6f01c20d7fb7.exe (PID: 2744)
      • 61e231ab47792_Sat02fb6439.exe (PID: 2584)
      • 22b3368b-da1a-4cd8-924a-4d0abaff18f1.exe (PID: 576)
      • 57D4.tmp.exe (PID: 3172)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 560)

    • Connects to CnC server

      • 61e231b0801f9_Sat02dabcd2901f.exe (PID: 2560)
      • 61e231ab47792_Sat02fb6439.exe (PID: 2584)
      • dfa475ad-b6b6-4938-956f-6f01c20d7fb7.exe (PID: 2744)
      • 22b3368b-da1a-4cd8-924a-4d0abaff18f1.exe (PID: 576)
      • 61e231c8a77c0_Sat021d76eef2.exe (PID: 2080)
      • 61e231b686514_Sat020f28d97695.exe (PID: 3412)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 560)
      • 57D4.tmp.exe (PID: 3172)

    • REDLINE was detected

      • 61e231ab47792_Sat02fb6439.exe (PID: 2584)
      • dfa475ad-b6b6-4938-956f-6f01c20d7fb7.exe (PID: 2744)
      • 22b3368b-da1a-4cd8-924a-4d0abaff18f1.exe (PID: 576)
      • 61e231b0801f9_Sat02dabcd2901f.exe (PID: 2560)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 560)

    • Application was injected by another process

      • svchost.exe (PID: 924)

    • Runs injected code in another process

      • rundll32.exe (PID: 3148)

    • RACCOON was detected

      • 57D4.tmp.exe (PID: 3172)

  • SUSPICIOUS

    • Reads the computer name

      • WinRAR.exe (PID: 2280)
      • setup_installer.exe (PID: 760)
      • 61e231ab47792_Sat02fb6439.exe (PID: 1444)
      • powershell.exe (PID: 2736)
      • setup_install.exe (PID: 3324)
      • 149_setupInstaller.exe (PID: 3628)
      • 61e231ad0641a_Sat02817ac1e8.exe (PID: 2920)
      • 61e231b0801f9_Sat02dabcd2901f.exe (PID: 3016)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 2368)
      • 61e231c7536eb_Sat028b7251.exe (PID: 2608)
      • 61e231c2c70ca_Sat02e1a7ed.exe (PID: 3436)
      • 61e231c431105_Sat0296c511cdf.exe (PID: 3928)
      • 61e231afbd0ff_Sat0275ca378161.exe (PID: 356)
      • 61e231afbd0ff_Sat0275ca378161.exe (PID: 1324)
      • powershell.exe (PID: 2100)
      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 2972)
      • 61e231b686514_Sat020f28d97695.exe (PID: 3412)
      • 61e231b18bfb5_Sat022d459aaa7.exe (PID: 3520)
      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 1688)
      • 61e231c8a77c0_Sat021d76eef2.exe (PID: 2080)
      • 61e231b0801f9_Sat02dabcd2901f.exe (PID: 2560)
      • 3ea4339b-068c-41c7-9e2b-9b2faaf10297.exe (PID: 3224)
      • dfa475ad-b6b6-4938-956f-6f01c20d7fb7.exe (PID: 2744)
      • c2001101-5d15-47d7-997d-9d9bd627547e.exe (PID: 684)
      • 61e231ab47792_Sat02fb6439.exe (PID: 2584)
      • 22b3368b-da1a-4cd8-924a-4d0abaff18f1.exe (PID: 576)
      • db3b8f82-a67a-4fd1-9805-66fc2ffbd6ae.exe (PID: 2420)
      • 517A.tmp.exe (PID: 3364)
      • 57D4.tmp.exe (PID: 3172)
      • 53027.exe (PID: 4076)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 560)

    • Drops a file with a compile date too recent

      • setup_installer.exe (PID: 760)
      • 61e231c2c70ca_Sat02e1a7ed.exe (PID: 3436)
      • 61e231ad0641a_Sat02817ac1e8.exe (PID: 2920)
      • 61e231afbd0ff_Sat0275ca378161.exe (PID: 1324)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 2368)
      • 57D4.tmp.exe (PID: 3172)

    • Checks supported languages

      • cmd.exe (PID: 984)
      • WinRAR.exe (PID: 2280)
      • setup_install.exe (PID: 3324)
      • cmd.exe (PID: 4012)
      • 61e231ab47792_Sat02fb6439.exe (PID: 1444)
      • cmd.exe (PID: 1424)
      • cmd.exe (PID: 2236)
      • cmd.exe (PID: 1500)
      • cmd.exe (PID: 3648)
      • cmd.exe (PID: 3012)
      • powershell.exe (PID: 2736)
      • 61e231ad0641a_Sat02817ac1e8.exe (PID: 2920)
      • cmd.exe (PID: 3208)
      • 149_setupInstaller.exe (PID: 3628)
      • setup_installer.exe (PID: 760)
      • cmd.exe (PID: 4004)
      • cmd.exe (PID: 3176)
      • cmd.exe (PID: 3236)
      • cmd.exe (PID: 1536)
      • 61e231b686514_Sat020f28d97695.exe (PID: 3412)
      • 61e231ae18706_Sat028e900d3.exe (PID: 1304)
      • cmd.exe (PID: 2724)
      • cmd.exe (PID: 2136)
      • cmd.exe (PID: 564)
      • 61e231b2a394a_Sat02fc0e52.exe (PID: 3992)
      • 61e231afbd0ff_Sat0275ca378161.exe (PID: 356)
      • 61e231b0801f9_Sat02dabcd2901f.exe (PID: 3016)
      • 61e231c8a77c0_Sat021d76eef2.exe (PID: 2080)
      • 61e231c7536eb_Sat028b7251.exe (PID: 2608)
      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 2972)
      • 61e231c2c70ca_Sat02e1a7ed.exe (PID: 3436)
      • 61e231c431105_Sat0296c511cdf.exe (PID: 3928)
      • 61e231b18bfb5_Sat022d459aaa7.exe (PID: 3520)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 2368)
      • 61e231afbd0ff_Sat0275ca378161.exe (PID: 1324)
      • powershell.exe (PID: 2100)
      • 61e231b2a394a_Sat02fc0e52.exe (PID: 3564)
      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 1688)
      • 61e231b0801f9_Sat02dabcd2901f.exe (PID: 2560)
      • 61e231ab47792_Sat02fb6439.exe (PID: 2584)
      • 3ea4339b-068c-41c7-9e2b-9b2faaf10297.exe (PID: 3224)
      • dfa475ad-b6b6-4938-956f-6f01c20d7fb7.exe (PID: 2744)
      • c2001101-5d15-47d7-997d-9d9bd627547e.exe (PID: 684)
      • 517A.tmp.exe (PID: 3364)
      • 22b3368b-da1a-4cd8-924a-4d0abaff18f1.exe (PID: 576)
      • db3b8f82-a67a-4fd1-9805-66fc2ffbd6ae.exe (PID: 2420)
      • 57D4.tmp.exe (PID: 3172)
      • 53027.exe (PID: 4076)
      • cmd.exe (PID: 532)
      • cmd.exe (PID: 3808)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 560)
      • cmd.exe (PID: 2664)

    • Executable content was dropped or overwritten

      • setup_installer.exe (PID: 760)
      • WinRAR.exe (PID: 2280)
      • 149_setupInstaller.exe (PID: 3628)
      • 61e231b2a394a_Sat02fc0e52.exe (PID: 3992)
      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 2972)
      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 1688)
      • 61e231b2a394a_Sat02fc0e52.exe (PID: 3564)
      • 61e231c2c70ca_Sat02e1a7ed.exe (PID: 3436)
      • 61e231ad0641a_Sat02817ac1e8.exe (PID: 2920)
      • db3b8f82-a67a-4fd1-9805-66fc2ffbd6ae.exe (PID: 2420)
      • 61e231afbd0ff_Sat0275ca378161.exe (PID: 1324)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 2368)
      • 57D4.tmp.exe (PID: 3172)

    • Drops a file that was compiled in debug mode

      • setup_installer.exe (PID: 760)
      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 2972)
      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 1688)
      • db3b8f82-a67a-4fd1-9805-66fc2ffbd6ae.exe (PID: 2420)
      • 61e231ad0641a_Sat02817ac1e8.exe (PID: 2920)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 2368)
      • 57D4.tmp.exe (PID: 3172)

    • Drops a file with too old compile date

      • setup_installer.exe (PID: 760)
      • 61e231b2a394a_Sat02fc0e52.exe (PID: 3992)
      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 2972)
      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 1688)
      • 61e231b2a394a_Sat02fc0e52.exe (PID: 3564)
      • 57D4.tmp.exe (PID: 3172)

    • Starts CMD.EXE for commands execution

      • setup_install.exe (PID: 3324)
      • 61e231ad0641a_Sat02817ac1e8.exe (PID: 2920)
      • 61e231b686514_Sat020f28d97695.exe (PID: 3412)
      • 57D4.tmp.exe (PID: 3172)

    • Executes PowerShell scripts

      • 61e231c208b88_Sat021d6cb0.exe (PID: 2368)

    • Reads Windows owner or organization settings

      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 2972)
      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 1688)

    • Application launched itself

      • 61e231afbd0ff_Sat0275ca378161.exe (PID: 356)
      • 61e231b0801f9_Sat02dabcd2901f.exe (PID: 3016)
      • 61e231ab47792_Sat02fb6439.exe (PID: 1444)

    • Reads the Windows organization settings

      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 2972)
      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 1688)

    • Reads Environment values

      • 61e231c2c70ca_Sat02e1a7ed.exe (PID: 3436)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 2368)
      • c2001101-5d15-47d7-997d-9d9bd627547e.exe (PID: 684)
      • db3b8f82-a67a-4fd1-9805-66fc2ffbd6ae.exe (PID: 2420)
      • 61e231ab47792_Sat02fb6439.exe (PID: 2584)
      • 61e231b0801f9_Sat02dabcd2901f.exe (PID: 2560)
      • 517A.tmp.exe (PID: 3364)
      • 22b3368b-da1a-4cd8-924a-4d0abaff18f1.exe (PID: 576)
      • dfa475ad-b6b6-4938-956f-6f01c20d7fb7.exe (PID: 2744)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 560)
      • 57D4.tmp.exe (PID: 3172)

    • Adds / modifies Windows certificates

      • 61e231afbd0ff_Sat0275ca378161.exe (PID: 1324)

    • Reads default file associations for system extensions

      • 61e231c431105_Sat0296c511cdf.exe (PID: 3928)

    • Uses RUNDLL32.EXE to load library

      • control.exe (PID: 2696)

    • Reads the cookies of Google Chrome

      • c2001101-5d15-47d7-997d-9d9bd627547e.exe (PID: 684)
      • 61e231b0801f9_Sat02dabcd2901f.exe (PID: 2560)
      • dfa475ad-b6b6-4938-956f-6f01c20d7fb7.exe (PID: 2744)
      • 61e231ab47792_Sat02fb6439.exe (PID: 2584)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 560)
      • 22b3368b-da1a-4cd8-924a-4d0abaff18f1.exe (PID: 576)

    • Reads the cookies of Mozilla Firefox

      • c2001101-5d15-47d7-997d-9d9bd627547e.exe (PID: 684)
      • 61e231b0801f9_Sat02dabcd2901f.exe (PID: 2560)
      • dfa475ad-b6b6-4938-956f-6f01c20d7fb7.exe (PID: 2744)
      • 61e231ab47792_Sat02fb6439.exe (PID: 2584)
      • 22b3368b-da1a-4cd8-924a-4d0abaff18f1.exe (PID: 576)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 560)

    • Searches for installed software

      • c2001101-5d15-47d7-997d-9d9bd627547e.exe (PID: 684)
      • 61e231b0801f9_Sat02dabcd2901f.exe (PID: 2560)
      • 61e231ab47792_Sat02fb6439.exe (PID: 2584)
      • 22b3368b-da1a-4cd8-924a-4d0abaff18f1.exe (PID: 576)
      • dfa475ad-b6b6-4938-956f-6f01c20d7fb7.exe (PID: 2744)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 560)
      • 57D4.tmp.exe (PID: 3172)

    • Creates files in the user directory

      • 61e231ad0641a_Sat02817ac1e8.exe (PID: 2920)
      • db3b8f82-a67a-4fd1-9805-66fc2ffbd6ae.exe (PID: 2420)
      • rundll32.exe (PID: 3148)
      • 61e231c8a77c0_Sat021d76eef2.exe (PID: 2080)

    • Starts CMD.EXE for self-deleting

      • 61e231ad0641a_Sat02817ac1e8.exe (PID: 2920)
      • 57D4.tmp.exe (PID: 3172)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 3808)

    • Executed via WMI

      • rundll32.exe (PID: 3148)

    • Starts itself from another location

      • 61e231c208b88_Sat021d6cb0.exe (PID: 2368)

    • Creates a directory in Program Files

      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 1688)

  • INFO

    • Checks Windows Trust Settings

      • powershell.exe (PID: 2736)
      • 61e231c7536eb_Sat028b7251.exe (PID: 2608)
      • 61e231ad0641a_Sat02817ac1e8.exe (PID: 2920)
      • powershell.exe (PID: 2100)

    • Reads settings of System Certificates

      • 61e231c7536eb_Sat028b7251.exe (PID: 2608)
      • 61e231afbd0ff_Sat0275ca378161.exe (PID: 1324)
      • powershell.exe (PID: 2736)
      • 61e231c2c70ca_Sat02e1a7ed.exe (PID: 3436)
      • 61e231ad0641a_Sat02817ac1e8.exe (PID: 2920)
      • 61e231b686514_Sat020f28d97695.exe (PID: 3412)
      • 61e231b18bfb5_Sat022d459aaa7.exe (PID: 3520)
      • c2001101-5d15-47d7-997d-9d9bd627547e.exe (PID: 684)
      • db3b8f82-a67a-4fd1-9805-66fc2ffbd6ae.exe (PID: 2420)
      • dfa475ad-b6b6-4938-956f-6f01c20d7fb7.exe (PID: 2744)
      • 22b3368b-da1a-4cd8-924a-4d0abaff18f1.exe (PID: 576)
      • 61e231c208b88_Sat021d6cb0.exe (PID: 2368)

    • Application was dropped or rewritten from another process

      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 2972)
      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 1688)

    • Loads dropped or rewritten executable

      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 1688)
      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 2972)

    • Checks supported languages

      • control.exe (PID: 2696)
      • rundll32.exe (PID: 1148)
      • PING.EXE (PID: 3968)
      • taskkill.exe (PID: 1520)
      • msiexec.exe (PID: 3280)
      • rundll32.exe (PID: 3148)
      • timeout.exe (PID: 2632)

    • Reads the computer name

      • control.exe (PID: 2696)
      • PING.EXE (PID: 3968)
      • taskkill.exe (PID: 1520)
      • rundll32.exe (PID: 3148)

    • Creates a software uninstall entry

      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 1688)

    • Creates files in the program directory

      • 61e231b2a394a_Sat02fc0e52.tmp (PID: 1688)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: 149_setupInstaller.exe
ZipUncompressedSize: 5847902
ZipCompressedSize: 5835653
ZipCRC: 0x8f8191d0
ZipModifyDate: 2022:01:15 04:30:21
ZipCompression: Deflated
ZipBitFlag: 0x0001
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
108
Monitored processes
61
Malicious processes
23
Suspicious processes
8

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start inject winrar.exe 149_setupinstaller.exe no specs 149_setupinstaller.exe setup_installer.exe setup_install.exe cmd.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs 61e231ab47792_sat02fb6439.exe no specs cmd.exe no specs cmd.exe no specs 61e231ad0641a_sat02817ac1e8.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs 61e231ae18706_sat028e900d3.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs 61e231b686514_sat020f28d97695.exe 61e231b0801f9_sat02dabcd2901f.exe no specs 61e231afbd0ff_sat0275ca378161.exe no specs 61e231b18bfb5_sat022d459aaa7.exe 61e231b2a394a_sat02fc0e52.exe 61e231c431105_sat0296c511cdf.exe no specs 61e231c8a77c0_sat021d76eef2.exe 61e231c208b88_sat021d6cb0.exe 61e231c2c70ca_sat02e1a7ed.exe 61e231c7536eb_sat028b7251.exe 61e231b2a394a_sat02fc0e52.tmp powershell.exe no specs 61e231afbd0ff_sat0275ca378161.exe 61e231b2a394a_sat02fc0e52.exe #REDLINE 61e231b0801f9_sat02dabcd2901f.exe #REDLINE 61e231ab47792_sat02fb6439.exe 61e231b2a394a_sat02fc0e52.tmp control.exe no specs rundll32.exe no specs c2001101-5d15-47d7-997d-9d9bd627547e.exe 3ea4339b-068c-41c7-9e2b-9b2faaf10297.exe no specs #REDLINE dfa475ad-b6b6-4938-956f-6f01c20d7fb7.exe #REDLINE 22b3368b-da1a-4cd8-924a-4d0abaff18f1.exe db3b8f82-a67a-4fd1-9805-66fc2ffbd6ae.exe 517a.tmp.exe no specs #RACCOON 57d4.tmp.exe 53027.exe no specs cmd.exe no specs ping.exe no specs cmd.exe no specs taskkill.exe no specs msiexec.exe no specs rundll32.exe svchost.exe #REDLINE 61e231c208b88_sat021d6cb0.exe cmd.exe no specs timeout.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
35661e231afbd0ff_Sat0275ca378161.exe C:\Users\admin\AppData\Local\Temp\7zS8F245514\61e231afbd0ff_Sat0275ca378161.exe—cmd.exe
User:
admin
Company:
DCloud
Integrity Level:
HIGH
Description:
HBuilder X
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\7zs8f245514\61e231afbd0ff_sat0275ca378161.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
532"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\admin\AppData\Local\Temp\7zS8F245514\61e231ad0641a_Sat02817ac1e8.exe" >> NULC:\Windows\system32\cmd.exe—61e231ad0641a_Sat02817ac1e8.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\apphelp.dll
560C:\Users\admin\AppData\Local\Temp\61e231c208b88_Sat021d6cb0.exeC:\Users\admin\AppData\Local\Temp\61e231c208b88_Sat021d6cb0.exe
61e231c208b88_Sat021d6cb0.exe
User:
admin
Company:
Installer
Integrity Level:
HIGH
Description:
Installer
Exit code:
0
Version:
6.3.0.8
Modules
Images
c:\users\admin\appdata\local\temp\61e231c208b88_sat021d6cb0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
564C:\Windows\system32\cmd.exe /c 61e231c7536eb_Sat028b7251.exe C:\Windows\system32\cmd.exe—setup_install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
3
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\temp\7zs8f245514\61e231c7536eb_sat028b7251.exe
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
576"C:\Users\admin\AppData\Local\Temp\22b3368b-da1a-4cd8-924a-4d0abaff18f1.exe" C:\Users\admin\AppData\Local\Temp\22b3368b-da1a-4cd8-924a-4d0abaff18f1.exe
61e231c2c70ca_Sat02e1a7ed.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\22b3368b-da1a-4cd8-924a-4d0abaff18f1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
684"C:\Users\admin\AppData\Local\Temp\Rar$EXb2280.29416\149_setupInstaller.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2280.29416\149_setupInstaller.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb2280.29416\149_setupinstaller.exe
c:\windows\system32\ntdll.dll
684"C:\Users\admin\AppData\Local\Temp\c2001101-5d15-47d7-997d-9d9bd627547e.exe" C:\Users\admin\AppData\Local\Temp\c2001101-5d15-47d7-997d-9d9bd627547e.exe
61e231c2c70ca_Sat02e1a7ed.exe
User:
admin
Integrity Level:
HIGH
Description:
gdffgsdfsd
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\c2001101-5d15-47d7-997d-9d9bd627547e.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
760"C:\Users\admin\AppData\Local\Temp\setup_installer.exe" C:\Users\admin\AppData\Local\Temp\setup_installer.exe
149_setupInstaller.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7z Setup SFX
Exit code:
0
Version:
19.00
Modules
Images
c:\users\admin\appdata\local\temp\setup_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
924C:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
984C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting DisableC:\Windows\system32\cmd.exe—setup_install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
66 910
Read events
66 232
Write events
659
Delete events
19

Modification events

(PID) Process:(2280) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2280) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2280) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2280) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2280) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2280) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\ZIP-Password-IS-951951______VmProtect.zip
(PID) Process:(2280) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2280) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2280) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2280) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
102
Suspicious files
18
Text files
21
Unknown types
28

Dropped files

PID
Process
Filename
Type
3628149_setupInstaller.exeC:\Users\admin\AppData\Local\Temp\nsi1E93.tmp —
MD5:—
SHA256:—
2280WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2280.29416\PASSWORD-IS-951951.txttext
MD5:—
SHA256:—
2280WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2280.29416\149_setupInstaller.exeexecutable
MD5:—
SHA256:—
760setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS8F245514\16422138324989.exetext
MD5:—
SHA256:—
760setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS8F245514\61e231af132e7_Sat020ee35cf.exeexecutable
MD5:—
SHA256:—
760setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS8F245514\61e231ad0641a_Sat02817ac1e8.exeexecutable
MD5:—
SHA256:—
760setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS8F245514\61e231ae18706_Sat028e900d3.exeexecutable
MD5:—
SHA256:—
760setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS8F245514\61e231b0801f9_Sat02dabcd2901f.exeexecutable
MD5:—
SHA256:—
3628149_setupInstaller.exeC:\Users\admin\AppData\Local\Temp\setup_installer.exeexecutable
MD5:—
SHA256:—
760setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS8F245514\16422138329109.exetext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
48
TCP/UDP connections
84
DNS requests
34
Threats
163

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1688
61e231b2a394a_Sat02fc0e52.tmp
HEAD
200
93.189.42.32:80
http://noplayboy.com/77.exe
RU
—
—
malicious
3520
61e231b18bfb5_Sat022d459aaa7.exe
GET
200
104.21.5.208:80
http://wfsdragon.ru/api/setStats.php
US
text
15 b
malicious
3520
61e231b18bfb5_Sat022d459aaa7.exe
GET
400
45.144.225.57:80
http://45.144.225.57/server.txt
unknown
html
301 b
malicious
3520
61e231b18bfb5_Sat022d459aaa7.exe
GET
400
212.193.30.45:80
http://212.193.30.45/proxies.txt
RU
html
301 b
malicious
2608
61e231c7536eb_Sat028b7251.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAWAJn8G8pVTNI4cGFpe7i4%3D
US
der
471 b
whitelisted
3520
61e231b18bfb5_Sat022d459aaa7.exe
GET
400
2.56.59.42:80
http://2.56.59.42/base/api/statistics.php
unknown
html
326 b
malicious
2608
61e231c7536eb_Sat028b7251.exe
GET
200
93.184.220.29:80
http://statuse.digitalcertvalidation.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJrF0xYA49jC3D83fgDGesaUkzIQQUf9OZ86BHDjEAVlYijrfMnt3KAYoCEAYJR5FkG19ljPHMaGsuvmc%3D
US
der
471 b
whitelisted
2920
61e231ad0641a_Sat02817ac1e8.exe
GET
200
92.123.224.113:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgPRApfVsPmQefP8%2BOlu%2BSG2vQ%3D%3D
unknown
der
503 b
shared
3412
61e231b686514_Sat020f28d97695.exe
GET
301
91.107.126.191:80
http://web-stat.biz/stats/1.php?pub=/mixtwo&badparam=NOPE
RU
html
162 b
malicious
2080
61e231c8a77c0_Sat021d76eef2.exe
GET
301
148.251.234.83:80
http://iplogger.org/1dnc57
DE
html
162 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3324
setup_install.exe
172.67.164.34:80
kelenxz.xyz
—
US
malicious
2608
61e231c7536eb_Sat028b7251.exe
149.28.253.196:443
www.listincode.com
—
US
suspicious
3520
61e231b18bfb5_Sat022d459aaa7.exe
212.193.30.45:80
—
—
RU
malicious
3520
61e231b18bfb5_Sat022d459aaa7.exe
104.23.98.190:443
pastebin.com
Cloudflare Inc
US
malicious
2920
61e231ad0641a_Sat02817ac1e8.exe
148.251.234.83:443
iplogger.org
Hetzner Online GmbH
DE
malicious
1324
61e231afbd0ff_Sat0275ca378161.exe
172.67.188.70:443
v.xyzgamev.com
—
US
suspicious
3436
61e231c2c70ca_Sat02e1a7ed.exe
104.21.88.113:443
dpcapps.me
Cloudflare Inc
US
unknown
3520
61e231b18bfb5_Sat022d459aaa7.exe
45.144.225.57:80
—
—
—
malicious
3412
61e231b686514_Sat020f28d97695.exe
91.107.126.191:80
web-stat.biz
Domain names registrar REG.RU, Ltd
RU
malicious
1324
61e231afbd0ff_Sat0275ca378161.exe
13.107.4.50:80
ctldl.windowsupdate.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
kelenxz.xyz
  • 172.67.164.34
  • 104.21.50.158
malicious
www.listincode.com
  • 149.28.253.196
whitelisted
v.xyzgamev.com
  • 172.67.188.70
  • 104.21.40.196
suspicious
iplogger.org
  • 148.251.234.83
shared
web-stat.biz
  • 91.107.126.191
  • 37.220.10.229
malicious
pastebin.com
  • 104.23.98.190
  • 104.23.99.190
malicious
whatisart.top
  • —
suspicious
noplayboy.com
  • 93.189.42.32
malicious
dpcapps.me
  • 104.21.88.113
  • 172.67.177.36
malicious
ctldl.windowsupdate.com
  • 13.107.4.50
  • 209.197.3.8
whitelisted

Threats

PID
Process
Class
Message
3324
setup_install.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .biz TLD
3520
61e231b18bfb5_Sat022d459aaa7.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
3520
61e231b18bfb5_Sat022d459aaa7.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
—
—
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .biz TLD
3520
61e231b18bfb5_Sat022d459aaa7.exe
A Network Trojan was detected
ET MALWARE User-Agent (???)
3412
61e231b686514_Sat020f28d97695.exe
A Network Trojan was detected
ET TROJAN GCleaner Downloader Activity M5
2080
61e231c8a77c0_Sat021d76eef2.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
2080
61e231c8a77c0_Sat021d76eef2.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
125 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ZIP-Password-IS-951951______VmProtect.zip