File name:

SingleEgg.zip

Full analysis: https://app.any.run/tasks/208c2783-f70b-4300-8bd3-752a6f8e2905
Verdict: Malicious activity
Analysis date: May 19, 2025, 17:37:24
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/zip
File info: Zip archive data, at least v4.5 to extract, compression method=deflate
MD5:

30AD89BCAB09A2A4B598BCA3905B6F7A

SHA1:

64FF8AB1D3034A8F5932EDE51F0BE3E9E980ED73

SHA256:

8087C027796D20F7755930677D6DD4E108D0498D589F380F03748D1B7CEBAA1D

SSDEEP:

12:5IL/VlpIV+4tRBd4c9KamTraobEC4Au5CyhNwvugs/BlcbaQ:GL/V0VFZ9BmTZbL4juBs/Tg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 7808)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • cmd.exe (PID: 7940)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 7940)

  • INFO

    • The sample compiled with english language support

      • cmd.exe (PID: 7940)

    • Manual execution by a user

      • cmd.exe (PID: 7940)

    • SQLite executable

      • cmd.exe (PID: 7940)

    • Reads the software policy settings

      • slui.exe (PID: 536)

    • Checks proxy server information

      • slui.exe (PID: 536)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0800
ZipCompression: Deflated
ZipModifyDate: 2025:05:19 13:06:14
ZipCRC: 0xf0d402f6
ZipCompressedSize: 285
ZipUncompressedSize: 427
ZipFileName: scrambledeggs.bat
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
19
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs cmd.exe conhost.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs slui.exe timeout.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
536C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
660timeout /t 10 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1184timeout /t 10 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1760timeout /t 10 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2284timeout /t 10 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3888timeout /t 10 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4172timeout /t 10 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5504timeout /t 10 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5640timeout /t 10 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6388timeout /t 10 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
4 817
Read events
4 809
Write events
8
Delete events
0

Modification events

(PID) Process:(7808) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7808) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7808) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7808) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\SingleEgg.zip
(PID) Process:(7808) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7808) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7808) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7808) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
10
Suspicious files
7
Text files
14
Unknown types
0

Dropped files

PID
Process
Filename
Type
7940cmd.exeC:\Users\admin\Documents\1627027216.lockedtext
MD5:302F3B44A2D5D71DAED9F883CC74ACFE
SHA256:6A53971DC2609177A6C4D73C4778A17F31AAA11CA192D41A307442E80C68AC61
7940cmd.exeC:\Users\admin\Documents\PowerShell\Modules\PSSQLite\1.1.0\101968804.lockedtext
MD5:975DB49FB59AAA2360EDB3924A22C6A0
SHA256:527EA8818671EE1F598D58A30252D85FA6E41F85BA1BE9D8C779E63ECC64912C
7940cmd.exeC:\Users\admin\Documents\PowerShell\Modules\PSSQLite\1.1.0\1579712396.lockedtext
MD5:1F323EE64216B0A2D72C69D8F3652519
SHA256:E763F237634510139F79D5B08D5C8B2DB918476E30BED08A9B0B0A1F48849A01
7940cmd.exeC:\Users\admin\Documents\PowerShell\Modules\PSSQLite\1.1.0\core\linux-x64\1864023769.lockedbinary
MD5:286D8BB7ECD3BF2665347A2C8E7F0220
SHA256:FB75C3AE5DD6C2CC716347FB11A2ADCB5154DD9D6BE4A2D07CABD3476C6C5E01
7940cmd.exeC:\Users\admin\Documents\PowerShell\Modules\PSSQLite\1.1.0\core\linux-x64\186707441.lockedexecutable
MD5:D17C0BD9A39673CE97B386E8A4B3FA99
SHA256:0D8F0FDECE759C2E99B0DE8D2473A966F8A74AB1A62CB0A2B302BA9BEF28AB8B
7940cmd.exeC:\Users\admin\Documents\PowerShell\Modules\PSSQLite\1.1.0\2509924579.lockedtext
MD5:A51187316BF78A5A8DC95C9F8F0741BC
SHA256:C525FFE310C648C5D657CA60EE67A77EBDB521D224DC9CDC9BE5AF9933251178
7940cmd.exeC:\Users\admin\Documents\314116332.lockedtext
MD5:713D33A14C69543F37172CC98C75085F
SHA256:935220C677FE0E6266AA923195A888890B76112664DCC7DE997AFA0A1F0DA47C
7940cmd.exeC:\Users\admin\Documents\176832214.lockedtext
MD5:E0136D693DA2509B9FD2EB68B5D90015
SHA256:53B50EF417CD7FC1AFFA457DB43C38B8F7C5AA803BB963A08CDDC5D3706DA6AD
7940cmd.exeC:\Users\admin\Documents\PowerShell\Modules\PSSQLite\1.1.0\2004325568.lockedtext
MD5:DA162A241057D5D6043B3FB6C28F111A
SHA256:28BF04C5451332F4C8955206C38633B49F6A57557C65B153C183859D615994ED
7940cmd.exeC:\Users\admin\Documents\OneNote Notebooks\My Notebook\122843088.lockedbinary
MD5:CC25D39DED4E41B9FDEBBA5328D4C541
SHA256:9F7A00B7385B15A3155DD0ACE08D726F5A3B0196EBB4FB0B0AAFEBF770BC44E1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
44
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5024
RUXIMICS.exe
GET
200
23.216.77.26:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5024
RUXIMICS.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7288
SIHClient.exe
GET
200
23.216.77.26:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
7288
SIHClient.exe
GET
200
23.216.77.26:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
7288
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7288
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
7288
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
7288
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
7288
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5024
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
—
—
20.190.160.132:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.132:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5024
RUXIMICS.exe
23.216.77.26:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5024
RUXIMICS.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.132
  • 20.190.160.3
  • 40.126.32.134
  • 20.190.160.130
  • 40.126.32.76
  • 40.126.32.74
  • 20.190.160.17
  • 20.190.160.64
whitelisted
google.com
  • 142.250.185.238
whitelisted
crl.microsoft.com
  • 23.216.77.26
  • 23.216.77.25
  • 23.216.77.36
  • 23.216.77.31
  • 23.216.77.30
  • 23.216.77.35
  • 23.216.77.42
  • 23.216.77.29
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.19
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SingleEgg.zip