URL:

https://www.mediafire.com/file/b12307u8exutt0i/setup.rar

Full analysis: https://app.any.run/tasks/80bff633-ad16-4ed0-8224-d73800feee9a
Verdict: Malicious activity
Threats:

Crypto mining malware is a resource-intensive threat that infiltrates computers with the purpose of mining cryptocurrencies. This type of threat can be deployed either on an infected machine or a compromised website. In both cases the miner will utilize the computing power of the device and its network bandwidth.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 08:44:49
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autorun-download
miner
winring0x64-sys
vuln-driver
upx
xmrig
Indicators:
MD5:

422981AAE6A46E59CE0075F776FBAD0E

SHA1:

821E7C1FC1E2C125888919A19CE8C0F6FF6CD69A

SHA256:

703076211C90CCD91B088F8519AFDE5AC1AC04B4B8EB9141B386B845D0DC50B3

SSDEEP:

3:N8DSLw3eGUoZ4YRzMNPOn:2OLw3eGy8gVO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes Windows Defender settings

      • setup.exe (PID: 3768)
      • updater.exe (PID: 7036)

    • Adds extension to the Windows Defender exclusion list

      • setup.exe (PID: 3768)
      • updater.exe (PID: 7036)

    • Uninstalls Malicious Software Removal Tool (MRT)

      • cmd.exe (PID: 2108)
      • cmd.exe (PID: 8084)

    • Changes the autorun value in the registry

      • Watykanczyk.exe (PID: 3676)

    • Vulnerable driver has been detected

      • updater.exe (PID: 7036)
      • updater.exe (PID: 2872)

    • MINER has been detected (SURICATA)

      • msedge.exe (PID: 7476)

    • XMRIG has been detected (YARA)

      • explorer.exe (PID: 812)

  • SUSPICIOUS

    • BASE64 encoded PowerShell command has been detected

      • setup.exe (PID: 7480)

    • Base64-obfuscated command line is found

      • setup.exe (PID: 7480)

    • Executable content was dropped or overwritten

      • setup.exe (PID: 7480)
      • setup.exe (PID: 3768)
      • updater.exe (PID: 7036)
      • updater.exe (PID: 2872)

    • Starts POWERSHELL.EXE for commands execution

      • setup.exe (PID: 7480)
      • setup.exe (PID: 3768)
      • updater.exe (PID: 7036)

    • Reads security settings of Internet Explorer

      • setup.exe (PID: 7480)
      • Watykanczyk.exe (PID: 3676)

    • Script adds exclusion path to Windows Defender

      • setup.exe (PID: 3768)
      • updater.exe (PID: 7036)

    • Script adds exclusion extension to Windows Defender

      • setup.exe (PID: 3768)
      • updater.exe (PID: 7036)

    • Manipulates environment variables

      • powershell.exe (PID: 7520)
      • powershell.exe (PID: 8040)

    • Process uninstalls Windows update

      • wusa.exe (PID: 7384)
      • wusa.exe (PID: 8004)

    • Starts CMD.EXE for commands execution

      • setup.exe (PID: 3768)
      • updater.exe (PID: 7036)
      • updater.exe (PID: 2872)

    • Stops a currently running service

      • sc.exe (PID: 8116)
      • sc.exe (PID: 7400)
      • sc.exe (PID: 7396)
      • sc.exe (PID: 7812)
      • sc.exe (PID: 7784)
      • sc.exe (PID: 6208)
      • sc.exe (PID: 7624)
      • sc.exe (PID: 7252)
      • sc.exe (PID: 8148)
      • sc.exe (PID: 3020)
      • sc.exe (PID: 5884)
      • sc.exe (PID: 4612)
      • sc.exe (PID: 632)
      • sc.exe (PID: 3924)
      • sc.exe (PID: 3944)
      • sc.exe (PID: 6092)

    • Modifies hosts file to alter network resolution

      • setup.exe (PID: 3768)
      • updater.exe (PID: 2872)

    • Windows service management via SC.EXE

      • sc.exe (PID: 7328)
      • sc.exe (PID: 2084)

    • Uses powercfg.exe to modify the power settings

      • setup.exe (PID: 3768)
      • updater.exe (PID: 7036)
      • updater.exe (PID: 2872)

    • Starts SC.EXE for service management

      • setup.exe (PID: 3768)
      • updater.exe (PID: 7036)
      • updater.exe (PID: 2872)

    • Creates a new Windows service

      • sc.exe (PID: 6728)

    • Executes as Windows Service

      • updater.exe (PID: 7036)

    • Reads Internet Explorer settings

      • Watykanczyk.exe (PID: 3676)

    • Drops a system driver (possible attempt to evade defenses)

      • updater.exe (PID: 7036)
      • updater.exe (PID: 2872)

    • Potential Corporate Privacy Violation

      • msedge.exe (PID: 7476)

    • Connects to unusual port

      • explorer.exe (PID: 812)
      • explorer.exe (PID: 6152)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 4252)

  • INFO

    • Autorun file from Downloads

      • chrome.exe (PID: 1164)

    • Checks supported languages

      • setup.exe (PID: 7480)
      • setup.exe (PID: 3768)
      • Watykanczyk.exe (PID: 3676)
      • updater.exe (PID: 7036)
      • identity_helper.exe (PID: 8056)
      • identity_helper.exe (PID: 1512)
      • Watykanczyk.exe (PID: 6796)

    • Reads Microsoft Office registry keys

      • chrome.exe (PID: 4944)

    • Process checks computer location settings

      • setup.exe (PID: 7480)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 8056)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 8056)

    • Manual execution by a user

      • setup.exe (PID: 7480)
      • setup.exe (PID: 3884)
      • msedge.exe (PID: 536)
      • Watykanczyk.exe (PID: 6796)

    • Reads the computer name

      • setup.exe (PID: 7480)
      • Watykanczyk.exe (PID: 3676)
      • identity_helper.exe (PID: 8056)

    • Application launched itself

      • chrome.exe (PID: 4944)
      • msedge.exe (PID: 8112)
      • msedge.exe (PID: 536)
      • msedge.exe (PID: 7768)

    • Create files in a temporary directory

      • setup.exe (PID: 7480)

    • Reads the machine GUID from the registry

      • Watykanczyk.exe (PID: 3676)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 4120)
      • powershell.exe (PID: 7520)
      • powershell.exe (PID: 8040)

    • Checks proxy server information

      • Watykanczyk.exe (PID: 3676)
      • slui.exe (PID: 8008)

    • Disables trace logs

      • Watykanczyk.exe (PID: 3676)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 4120)
      • powershell.exe (PID: 7520)
      • powershell.exe (PID: 8040)

    • Reads the software policy settings

      • slui.exe (PID: 7908)
      • slui.exe (PID: 8008)

    • Reads Environment values

      • Watykanczyk.exe (PID: 3676)
      • identity_helper.exe (PID: 8056)

    • Creates files or folders in the user directory

      • Watykanczyk.exe (PID: 3676)

    • Creates files in the program directory

      • setup.exe (PID: 3768)
      • PLUGScheduler.exe (PID: 4252)

    • The sample compiled with japanese language support

      • updater.exe (PID: 7036)
      • updater.exe (PID: 2872)

    • UPX packer has been detected

      • explorer.exe (PID: 812)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
420
Monitored processes
169
Malicious processes
5
Suspicious processes
4

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs sppextcomobj.exe no specs slui.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winrar.exe setup.exe no specs setup.exe powershell.exe no specs conhost.exe no specs setup.exe watykanczyk.exe slui.exe powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs wusa.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs THREAT updater.exe powershell.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs #MINER msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs wusa.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs #XMRIG explorer.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs svchost.exe updater.exe no specs plugscheduler.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs explorer.exe watykanczyk.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
536"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --do-not-de-elevate --single-argument http://karachan.org/b/C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
616\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
616\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powercfg.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
632\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
632C:\WINDOWS\system32\sc.exe stop dosvcC:\Windows\System32\sc.exe—updater.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Exit code:
1062
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
780"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6484 --field-trial-handle=2336,i,6930284048627682165,8363189001682386400,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
812explorer.exeC:\Windows\explorer.exe
updater.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Explorer
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
856"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4928 --field-trial-handle=2320,i,1584149532314973613,3606665031696634265,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
920"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x310,0x314,0x318,0x308,0x320,0x7ffc80855fd8,0x7ffc80855fe4,0x7ffc80855ff0C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1116\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
34 669
Read events
34 572
Write events
96
Delete events
1

Modification events

(PID) Process:(4944) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(4944) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(4944) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(4944) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(4944) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(1164) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF
Value:
01000000000000008767F717999CDB01
(PID) Process:(8056) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(8056) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(8056) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(8056) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Downloads\setup.rar
Executable files
16
Suspicious files
317
Text files
137
Unknown types
2

Dropped files

PID
Process
Filename
Type
4944chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old~RF10c40d.TMP —
MD5:—
SHA256:—
4944chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old~RF10c40d.TMP —
MD5:—
SHA256:—
4944chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old~RF10c40d.TMP —
MD5:—
SHA256:—
4944chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\coupon_db\LOG.old —
MD5:—
SHA256:—
4944chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
4944chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old~RF10c40d.TMP —
MD5:—
SHA256:—
4944chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
4944chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RF10c41d.TMP —
MD5:—
SHA256:—
4944chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
4944chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
272
DNS requests
380
Threats
17

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7632
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7668
SIHClient.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3676
Watykanczyk.exe
GET
301
199.232.196.193:80
http://i.imgur.com/FzGMM7P.jpg
unknown
—
—
whitelisted
7668
SIHClient.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5568
SearchApp.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7312
chrome.exe
104.17.150.117:443
www.mediafire.com
CLOUDFLARENET
—
whitelisted
4944
chrome.exe
239.255.255.250:1900
—
—
—
whitelisted
7312
chrome.exe
142.251.18.84:443
—
GOOGLE
US
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.159.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
7312
chrome.exe
104.21.42.32:443
the.gatekeeperconsent.com
CLOUDFLARENET
—
unknown
7312
chrome.exe
142.250.185.200:443
www.googletagmanager.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
www.mediafire.com
  • 104.17.150.117
  • 104.17.151.117
whitelisted
accounts.google.com
  • 0.0.0.0
whitelisted
client.wns.windows.com
  • 40.113.110.67
  • 40.113.103.199
whitelisted
login.live.com
  • 20.190.159.4
  • 20.190.159.23
  • 20.190.159.129
  • 20.190.159.0
  • 20.190.159.64
  • 40.126.31.69
  • 40.126.31.71
  • 40.126.31.3
  • 20.190.159.68
  • 20.190.159.128
  • 40.126.31.2
  • 20.190.159.71
  • 40.126.31.1
  • 40.126.31.131
  • 20.190.159.131
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
the.gatekeeperconsent.com
  • 104.21.42.32
  • 172.67.199.186
unknown
www.googletagmanager.com
  • 142.250.185.200
  • 216.58.206.40
whitelisted
static.mediafire.com
  • 104.17.151.117
  • 104.17.150.117
whitelisted
privacy.gatekeeperconsent.com
  • 104.21.42.32
  • 172.67.199.186
unknown
btloader.com
  • 104.22.75.216
  • 172.67.41.60
  • 104.22.74.216
whitelisted

Threats

PID
Process
Class
Message
7312
chrome.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
7312
chrome.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
7312
chrome.exe
Potentially Bad Traffic
ET FILE_SHARING File Sharing Related Domain in DNS Lookup (download .mediafire .com)
7312
chrome.exe
Potentially Bad Traffic
ET FILE_SHARING File Sharing Related Domain in DNS Lookup (download .mediafire .com)
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Image Sharing Service (imgur.com)
7476
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
7476
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
7476
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge
7476
msedge.exe
Potential Corporate Privacy Violation
ET INFO Observed DNS Query to Coin Mining Domain (nanopool .org)
7476
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.mediafire.com/file/b12307u8exutt0i/setup.rar