Find similar analyses in TI Lookup
Analysis date (UTC): 29 November 2024, 05:09Analysis environment: Windows 10 Pro, build 19045, x64

https://blogoss.fr/hexed/vent.txt

MD5:5B91875A235A51D84D23A4AB0B90A077
SHA1:84DB73E1133199AB030243A85E0ABF5CB2411930
SHA256:89827A91F64CCCD103ED677B53D7BDA68FEBC82777E59863D07873E01501356C

Analysis result

Threat level:Malicious activity
Tags:
evasionarch-exec
Full analysis:Analysis https://blogoss.fr/hexed/vent.txt Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

No malicious indicators.

SUSPICIOUS

Potential Corporate Privacy Violation

  • msedge.exe (PID: 6928)

Uses RUNDLL32.EXE to load library

  • cmd.exe (PID: 7680)

INFO

Checks supported languages

  • identity_helper.exe (PID: 7656)

Reads Environment values

  • identity_helper.exe (PID: 7656)

Reads the computer name

  • identity_helper.exe (PID: 7656)

Manual execution by a user

  • WinRAR.exe (PID: 3832)
  • WinRAR.exe (PID: 1192)
  • kokesh.exe (PID: 6032)
  • kokesh.exe (PID: 8040)
  • cmd.exe (PID: 7680)

Executable content was dropped or overwritten

  • msedge.exe (PID: 6520)
  • WinRAR.exe (PID: 3832)

Application launched itself

  • msedge.exe (PID: 6540)

Threats

PIDProcessClassMessage
6928msedge.exePotentially Bad TrafficET DNS Query for .cc TLD
6928msedge.exePotentially Bad TrafficET DNS Query for .cc TLD
6928msedge.exeMisc activitySUSPICIOUS [ANY.RUN] Tracking Service (.popin .cc)
6928msedge.exeMisc activitySUSPICIOUS [ANY.RUN] Tracking Service (.popin .cc)

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN

© 2017-2026 ANY.RUN LLC. ALL RIGHTS RESERVED