File name:

hausbomber6.0.zip

Full analysis: https://app.any.run/tasks/2160b731-35c5-4c71-b107-89cb75710851
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: May 30, 2025, 17:14:30
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
loader
cobaltstrike
backdoor
adware
evasion
github
auto
quasar
rat
formbook
qrcode
hausbomber
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

696006D1FFC74D3A356291BB5B9C6B84

SHA1:

B96F80D67E9B3BADA02D5C92BDA8468188F3D2F5

SHA256:

8961A06E29A61161CA9E0F8628E9E4EC221CB78012F02A926FA74AA35A836900

SSDEEP:

192:PjIUD57VboqjYdho8o8izBR2BhsvMBY7xDNt:rIIohJ7iz/GhLUlNt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6740)

    • Changes the autorun value in the registry

      • HeimdallGuard.exe (PID: 7936)

    • COBALTSTRIKE has been detected (SURICATA)

      • Lee.exe (PID: 4736)

    • Uses Task Scheduler to autorun other applications

      • bootstrapper.exe (PID: 8132)
      • bootstrapper.exe (PID: 7572)
      • Client-built.exe (PID: 8160)
      • bootstrapper.exe (PID: 3924)

    • HAUSBOMBER has been detected (YARA)

      • 4363463463464363463463463.exe (PID: 2852)

    • RAT has been found (auto)

      • 4363463463464363463463463.exe (PID: 2852)

    • Executing a file with an untrusted certificate

      • vc2005sp1redist_x86.exe (PID: 1196)

    • Changes powershell execution policy (Bypass)

      • NJRAT%20DANGEROUS.exe (PID: 8076)

    • Changes Windows Defender settings

      • NJRAT%20DANGEROUS.exe (PID: 8076)

    • FORMBOOK has been found (auto)

      • 4363463463464363463463463.exe (PID: 2852)
      • NJRAT%20DANGEROUS.exe (PID: 8076)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 5236)
      • powershell.exe (PID: 780)
      • powershell.exe (PID: 2320)

    • Adds path to the Windows Defender exclusion list

      • NJRAT%20DANGEROUS.exe (PID: 8076)

    • Adds process to the Windows Defender exclusion list

      • NJRAT%20DANGEROUS.exe (PID: 8076)

    • Uses Task Scheduler to run other applications

      • NJRAT%20DANGEROUS.exe (PID: 8076)
      • NJRAT%20DANGEROUS.exe (PID: 6668)

  • SUSPICIOUS

    • Application launched itself

      • HeimdallGuard.exe (PID: 7936)
      • gallery-dl.exe (PID: 4724)
      • lazagne.exe (PID: 8168)
      • HeimdallGuard.exe (PID: 832)
      • HeimdallGuard.exe (PID: 6616)

    • Executable content was dropped or overwritten

      • 4363463463464363463463463.exe (PID: 8012)
      • 4363463463464363463463463.exe (PID: 2852)
      • gallery-dl.exe (PID: 4724)
      • XClient.exe (PID: 5508)
      • bootstrapper.exe (PID: 8132)
      • lazagne.exe (PID: 8168)
      • Solara_Protect.exe (PID: 1616)
      • cqms.exe (PID: 8184)
      • NJRAT%20DANGEROUS.exe (PID: 8076)

    • Reads security settings of Internet Explorer

      • 4363463463464363463463463.exe (PID: 8012)
      • Lee.exe (PID: 4736)

    • Connects to unusual port

      • 4363463463464363463463463.exe (PID: 8012)
      • Lee.exe (PID: 4736)
      • update.exe (PID: 4100)
      • 4363463463464363463463463.exe (PID: 2852)
      • bootstrapper.exe (PID: 7572)
      • Client-built.exe (PID: 8160)
      • XClient.exe (PID: 5508)
      • Windows.exe (PID: 1516)
      • bootstrapper.exe (PID: 3924)
      • NJRAT%20DANGEROUS.exe (PID: 6668)

    • Process requests binary or script from the Internet

      • 4363463463464363463463463.exe (PID: 8012)
      • 4363463463464363463463463.exe (PID: 2852)

    • Connects to the server without a host name

      • 4363463463464363463463463.exe (PID: 8012)
      • 4363463463464363463463463.exe (PID: 2852)

    • Potential Corporate Privacy Violation

      • 4363463463464363463463463.exe (PID: 8012)
      • 4363463463464363463463463.exe (PID: 2852)

    • Access to an unwanted program domain was detected

      • Lee.exe (PID: 4736)

    • Uses TASKKILL.EXE to kill process

      • powershell.exe (PID: 5416)

    • The process executes via Task Scheduler

      • powershell.exe (PID: 5416)
      • bootstrapper.exe (PID: 3924)
      • PLUGScheduler.exe (PID: 4084)

    • Get information on the list of running processes

      • powershell.exe (PID: 5416)

    • The process drops C-runtime libraries

      • gallery-dl.exe (PID: 4724)
      • lazagne.exe (PID: 8168)

    • Process drops python dynamic module

      • gallery-dl.exe (PID: 4724)
      • lazagne.exe (PID: 8168)

    • Process drops legitimate windows executable

      • gallery-dl.exe (PID: 4724)
      • lazagne.exe (PID: 8168)
      • 4363463463464363463463463.exe (PID: 2852)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • update.exe (PID: 4100)
      • NJRAT%20DANGEROUS.exe (PID: 8076)
      • NJRAT%20DANGEROUS.exe (PID: 6668)
      • svchost.exe (PID: 2220)

    • Starts itself from another location

      • bootstrapper.exe (PID: 8132)
      • cqms.exe (PID: 8184)

    • Starts CMD.EXE for commands execution

      • update.exe (PID: 4100)
      • Solara_Protect.exe (PID: 1616)

    • The executable file from the user directory is run by the CMD process

      • Windows.exe (PID: 1516)

    • Starts a Microsoft application from unusual location

      • vc2005sp1redist_x86.exe (PID: 1196)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 7756)

    • Executing commands from a ".bat" file

      • Solara_Protect.exe (PID: 1616)

    • Script adds exclusion path to Windows Defender

      • NJRAT%20DANGEROUS.exe (PID: 8076)

    • Starts POWERSHELL.EXE for commands execution

      • NJRAT%20DANGEROUS.exe (PID: 8076)

    • Script adds exclusion process to Windows Defender

      • NJRAT%20DANGEROUS.exe (PID: 8076)

  • INFO

    • Manual execution by a user

      • WinRAR.exe (PID: 3996)
      • HeimdallGuard.exe (PID: 7936)
      • 4363463463464363463463463.exe (PID: 8012)
      • 4363463463464363463463463.exe (PID: 8160)
      • 4363463463464363463463463.exe (PID: 8104)
      • 4363463463464363463463463.exe (PID: 2432)
      • 4363463463464363463463463.exe (PID: 7652)
      • 4363463463464363463463463.exe (PID: 6724)
      • 4363463463464363463463463.exe (PID: 1532)
      • 4363463463464363463463463.exe (PID: 4728)
      • 4363463463464363463463463.exe (PID: 1240)
      • 4363463463464363463463463.exe (PID: 7336)
      • cmd.exe (PID: 2320)
      • 4363463463464363463463463.exe (PID: 6892)
      • 4363463463464363463463463.exe (PID: 2852)
      • 4363463463464363463463463.exe (PID: 5968)
      • HeimdallGuard.exe (PID: 832)
      • cqms.exe (PID: 3968)
      • NJRAT%20DANGEROUS.exe (PID: 6668)
      • cqms.exe (PID: 6240)
      • HeimdallGuard.exe (PID: 6616)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6740)
      • WinRAR.exe (PID: 3996)

    • Disables trace logs

      • HeimdallGuard.exe (PID: 7936)
      • 4363463463464363463463463.exe (PID: 8012)
      • 4363463463464363463463463.exe (PID: 6724)
      • 4363463463464363463463463.exe (PID: 7336)

    • Checks supported languages

      • HeimdallGuard.exe (PID: 7936)
      • HeimdallGuard.exe (PID: 7736)
      • 4363463463464363463463463.exe (PID: 8012)
      • Lee.exe (PID: 4736)
      • 4363463463464363463463463.exe (PID: 7652)
      • 4363463463464363463463463.exe (PID: 8104)
      • 4363463463464363463463463.exe (PID: 6724)
      • 4363463463464363463463463.exe (PID: 5968)
      • 4363463463464363463463463.exe (PID: 7336)

    • Reads the computer name

      • HeimdallGuard.exe (PID: 7936)
      • HeimdallGuard.exe (PID: 7736)
      • 4363463463464363463463463.exe (PID: 8012)
      • Lee.exe (PID: 4736)
      • 4363463463464363463463463.exe (PID: 7652)
      • 4363463463464363463463463.exe (PID: 6724)
      • 4363463463464363463463463.exe (PID: 7336)
      • 4363463463464363463463463.exe (PID: 5968)

    • Reads the software policy settings

      • HeimdallGuard.exe (PID: 7936)
      • 4363463463464363463463463.exe (PID: 8012)
      • slui.exe (PID: 3124)

    • Reads the machine GUID from the registry

      • HeimdallGuard.exe (PID: 7936)
      • HeimdallGuard.exe (PID: 7736)
      • 4363463463464363463463463.exe (PID: 8012)
      • Lee.exe (PID: 4736)
      • 4363463463464363463463463.exe (PID: 6724)
      • 4363463463464363463463463.exe (PID: 7336)

    • Checks proxy server information

      • HeimdallGuard.exe (PID: 7936)
      • Lee.exe (PID: 4736)
      • 4363463463464363463463463.exe (PID: 8012)
      • 4363463463464363463463463.exe (PID: 7336)

    • Launch of the file from Registry key

      • HeimdallGuard.exe (PID: 7936)

    • Process checks computer location settings

      • 4363463463464363463463463.exe (PID: 8012)

    • The sample compiled with english language support

      • gallery-dl.exe (PID: 4724)
      • lazagne.exe (PID: 8168)

    • Uses Task Scheduler to autorun other applications (AUTOMATE)

      • cmd.exe (PID: 4628)

    • The sample compiled with chinese language support

      • 4363463463464363463463463.exe (PID: 2852)
      • cqms.exe (PID: 8184)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0009
ZipCompression: Unknown (99)
ZipModifyDate: 2025:05:30 17:13:20
ZipCRC: 0x31d44928
ZipCompressedSize: 4869
ZipUncompressedSize: 10752
ZipFileName: 4363463463464363463463463.exe.bin
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
362
Monitored processes
100
Malicious processes
5
Suspicious processes
10

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe winrar.exe rundll32.exe no specs heimdallguard.exe conhost.exe no specs heimdallguard.exe no specs conhost.exe no specs 4363463463464363463463463.exe conhost.exe no specs #COBALTSTRIKE lee.exe slui.exe 4363463463464363463463463.exe no specs 4363463463464363463463463.exe conhost.exe no specs 4363463463464363463463463.exe no specs 4363463463464363463463463.exe conhost.exe no specs 4363463463464363463463463.exe no specs 4363463463464363463463463.exe conhost.exe no specs 4363463463464363463463463.exe no specs 4363463463464363463463463.exe conhost.exe no specs 4363463463464363463463463.exe no specs 4363463463464363463463463.exe conhost.exe no specs cmd.exe conhost.exe no specs powershell.exe conhost.exe no specs tasklist.exe no specs taskkill.exe no specs taskkill.exe no specs 4363463463464363463463463.exe no specs #RAT 4363463463464363463463463.exe conhost.exe no specs update.exe gallery-dl.exe conhost.exe no specs gallery-dl.exe no specs svchost.exe nfe.sfx.exe no specs xclient.exe cmd.exe no specs conhost.exe no specs choice.exe no specs bootstrapper.exe schtasks.exe no specs conhost.exe no specs bootstrapper.exe testmemtest38.exe no specs conhost.exe no specs solara_protect.exe schtasks.exe no specs conhost.exe no specs lazagne.exe conhost.exe no specs lazagne.exe no specs client-built.exe schtasks.exe no specs conhost.exe no specs cmd.exe cmd.exe no specs conhost.exe no specs conhost.exe no specs timeout.exe no specs schtasks.exe no specs vc2005sp1redist_x86.exe no specs heimdallguard.exe conhost.exe no specs windows.exe heimdallguard.exe no specs conhost.exe no specs cqms.exe cqms.exe #FORMBOOK njrat%20dangerous.exe powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs bootstrapper.exe plugscheduler.exe no specs cqms.exe no specs cqms.exe schtasks.exe no specs conhost.exe no specs heimdallguard.exe njrat%20dangerous.exe conhost.exe no specs schtasks.exe no specs conhost.exe no specs heimdallguard.exe no specs conhost.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
132"C:\Users\admin\Desktop\Files\TestMemTest38.exe" C:\Users\admin\Desktop\Files\TestMemTest38.exe—4363463463464363463463463.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\files\testmemtest38.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
496"C:\WINDOWS\system32\tasklist.exe"C:\Windows\System32\tasklist.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
780"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'NJRAT%20DANGEROUS.exe'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—NJRAT%20DANGEROUS.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
832"C:\Users\admin\Desktop\endpoint\HeimdallGuard.exe" C:\Users\admin\Desktop\endpoint\HeimdallGuard.exe
explorer.exe
User:
admin
Company:
HeimdallGuard Sikkerhet AS
Integrity Level:
HIGH
Description:
HeimdallGuard Endpoint Agent
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\endpoint\heimdallguard.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
968\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1116\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—4363463463464363463463463.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1132"C:\Users\admin\Desktop\Files\lazagne.exe" C:\Users\admin\Desktop\Files\lazagne.exe—lazagne.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\desktop\files\lazagne.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\users\admin\appdata\local\temp\_mei81682\python27.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
1180\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—HeimdallGuard.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1196"C:\Users\admin\Desktop\Files\vc2005sp1redist_x86.exe" C:\Users\admin\Desktop\Files\vc2005sp1redist_x86.exe—4363463463464363463463463.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
6.00.3790.0 (srv03_rtm.030324-2048)
Modules
Images
c:\users\admin\desktop\files\vc2005sp1redist_x86.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1240"C:\Users\admin\Desktop\4363463463464363463463463.exe" C:\Users\admin\Desktop\4363463463464363463463463.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
3221226540
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\4363463463464363463463463.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
62 103
Read events
61 962
Write events
128
Delete events
13

Modification events

(PID) Process:(6740) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6740) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6740) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6740) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\hausbomber6.0.zip
(PID) Process:(6740) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6740) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6740) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6740) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6740) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(6740) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
Executable files
100
Suspicious files
100
Text files
94
Unknown types
4

Dropped files

PID
Process
Filename
Type
3996WinRAR.exeC:\Users\admin\Desktop\endpoint\HeimdallGuard.exeexecutable
MD5:72EDFF31DFF1490EAA9D0D8BA02C97C9
SHA256:7B63E00DF0FDF76552FF27FAAEB8F73FD70CD27758FD49561A74A531A3986D50
6740WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6740.9184\4363463463464363463463463.exe.binexecutable
MD5:2A94F3960C58C6E70826495F76D00B85
SHA256:2FCAD226B17131DA4274E1B9F8F31359BDD325C9568665F08FD1F6C5D06A23CE
3996WinRAR.exeC:\Users\admin\Desktop\endpoint\Newtonsoft.Json.dllexecutable
MD5:195FFB7167DB3219B217C4FD439EEDD6
SHA256:E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D
5416powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF141403.TMPbinary
MD5:D040F64E9E7A2BB91ABCA5613424598E
SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670
5416powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_jyhevu1y.4ug.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5416powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:07B1E0CA99CDA61AC37A16E885619496
SHA256:07DBB0DDECC1BF8BE15CE6F401B675C0839E81D6C9C1A9AFEDC7CA9365F735E7
80124363463463464363463463463.exeC:\Users\admin\Desktop\Files\02.08.2022.exebinary
MD5:B3F7D5D75E75F2E62990FF84D2B97E5D
SHA256:D0B3D3B096B73C8CF1C693803A44072CC35C9BF1239909068C3F7549725F1DBC
80124363463463464363463463463.exeC:\Users\admin\Desktop\Files\Lee.exeexecutable
MD5:A7FCB5EC6DFEF33922B57A9FB7251743
SHA256:FE3848B53BF6701306CB0FA9618527DBAD319A882D2D1307F8693F005C61C772
5416powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0I4NSO64Y8IE6R5AP8JC.tempbinary
MD5:07B1E0CA99CDA61AC37A16E885619496
SHA256:07DBB0DDECC1BF8BE15CE6F401B675C0839E81D6C9C1A9AFEDC7CA9365F735E7
7936HeimdallGuard.exeC:\Users\admin\Desktop\endpoint\debug.logtext
MD5:F9DC62908B11E9970D34D89261975AC7
SHA256:48A9D08E2179E382FC459139EC7E159A3F8607D30ECC0AD6160F8EBEAFE732CF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
89
TCP/UDP connections
401
DNS requests
81
Threats
53

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2852
4363463463464363463463463.exe
GET
200
43.226.39.44:5988
http://43.226.39.44:5988/TestMemTest38.exe
unknown
—
—
unknown
2852
4363463463464363463463463.exe
GET
200
89.197.154.116:80
http://89.197.154.116/lazagne.exe
unknown
—
—
malicious
2852
4363463463464363463463463.exe
GET
200
42.225.102.95:80
http://windriversfiles.imeitools.com/component/vc2005sp1redist_x86.exe
unknown
—
—
unknown
2852
4363463463464363463463463.exe
GET
200
61.161.0.182:80
http://bundle.kpzip.com/n/tui/ciqinmishi/6/cqms.exe
unknown
—
—
unknown
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7508
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7508
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8012
4363463463464363463463463.exe
GET
200
101.133.156.69:7777
http://101.133.156.69:7777/Lee.exe
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
7552
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
8028
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7552
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
20.190.160.132:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.46
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 2.23.246.101
whitelisted
login.live.com
  • 20.190.160.132
  • 40.126.32.68
  • 40.126.32.136
  • 20.190.160.66
  • 20.190.160.3
  • 40.126.32.140
  • 20.190.160.131
  • 20.190.160.65
  • 40.126.31.1
  • 20.190.159.71
  • 40.126.31.130
  • 20.190.159.128
  • 20.190.159.129
  • 40.126.31.129
  • 40.126.31.131
  • 20.190.159.130
  • 40.126.31.3
  • 40.126.31.67
  • 20.190.159.75
  • 40.126.31.128
  • 40.126.31.71
whitelisted
ocsp.digicert.com
  • 184.30.131.245
  • 2.23.77.188
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.249
  • 172.211.123.250
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
countervector.pro
  • 188.114.96.3
  • 188.114.97.3
unknown

Threats

PID
Process
Class
Message
8012
4363463463464363463463463.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
8012
4363463463464363463463463.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
8012
4363463463464363463463463.exe
Potentially Bad Traffic
ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
8012
4363463463464363463463463.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
8012
4363463463464363463463463.exe
Misc activity
ET INFO Packed Executable Download
8012
4363463463464363463463463.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
8012
4363463463464363463463463.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
4736
Lee.exe
Targeted Malicious Activity was Detected
ET MALWARE Cobalt Strike Beacon Observed
4736
Lee.exe
A Network Trojan was detected
BACKDOOR [ANY.RUN] Possible Cobalt Strike Beacon
4736
Lee.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Fun Web Products Spyware User-Agent (FunWebProducts)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
hausbomber6.0.zip