File name:

idk.rar

Full analysis: https://app.any.run/tasks/f5251558-d1db-4dc4-bd58-1d6948163807
Verdict: Malicious activity
Analysis date: June 21, 2025, 12:36:09
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
telegram
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

E9F6D33606BE70BD42B58277D1BB3794

SHA1:

C0906C153951780C6B288475CA88CA4BE6598E2F

SHA256:

8C7845530CDCD8B24B60FA80C708D474A222FBA5A311B9758FCCD424404EFC9C

SSDEEP:

768:4i2JyWgWOpgG7hxSG5CPrdDxdzJ4E+uICI:5ALtohxS6CPJJ+PCI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6532)

  • SUSPICIOUS

    • Uses WMIC.EXE to obtain CPU information

      • cmd.exe (PID: 6360)
      • cmd.exe (PID: 1512)

    • Starts CMD.EXE for commands execution

      • idk.exe (PID: 6676)
      • idk.exe (PID: 6732)

    • Uses WMIC.EXE to obtain a list of video controllers

      • cmd.exe (PID: 3580)
      • cmd.exe (PID: 1520)

    • Uses WMIC.EXE to obtain BIOS management information

      • cmd.exe (PID: 4804)
      • cmd.exe (PID: 4916)

    • Accesses video controller name via WMI (SCRIPT)

      • WMIC.exe (PID: 6224)
      • WMIC.exe (PID: 2760)

    • Uses WMIC.EXE to obtain physical disk drive information

      • cmd.exe (PID: 5848)
      • cmd.exe (PID: 1100)

    • Reads security settings of Internet Explorer

      • idk.exe (PID: 6676)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • idk.exe (PID: 6676)

  • INFO

    • Checks supported languages

      • idk.exe (PID: 6676)
      • idk.exe (PID: 6732)

    • Manual execution by a user

      • idk.exe (PID: 6676)
      • idk.exe (PID: 6732)
      • mspaint.exe (PID: 3624)
      • mspaint.exe (PID: 5172)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6532)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 5252)
      • WMIC.exe (PID: 6224)
      • WMIC.exe (PID: 1328)
      • WMIC.exe (PID: 4868)
      • WMIC.exe (PID: 6768)
      • WMIC.exe (PID: 2760)
      • WMIC.exe (PID: 6948)
      • WMIC.exe (PID: 6016)

    • Reads the computer name

      • idk.exe (PID: 6676)
      • idk.exe (PID: 6732)

    • Reads the machine GUID from the registry

      • idk.exe (PID: 6676)

    • Reads the software policy settings

      • idk.exe (PID: 6676)

    • Creates files or folders in the user directory

      • idk.exe (PID: 6676)

    • Checks proxy server information

      • idk.exe (PID: 6676)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 24367
UncompressedSize: 60928
OperatingSystem: Win32
ArchivedFileName: idk.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
162
Monitored processes
24
Malicious processes
0
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe idk.exe conhost.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs slui.exe no specs idk.exe no specs conhost.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs mspaint.exe no specs mspaint.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1100C:\WINDOWS\system32\cmd.exe /c wmic diskdrive get SerialNumber,ModelC:\Windows\System32\cmd.exe—idk.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1328wmic bios get serialnumberC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
1512C:\WINDOWS\system32\cmd.exe /c wmic cpu get ProcessorIdC:\Windows\System32\cmd.exe—idk.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1520C:\WINDOWS\system32\cmd.exe /c wmic path win32_VideoController get nameC:\Windows\System32\cmd.exe—idk.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
2760wmic path win32_VideoController get nameC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
3460\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—idk.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3580C:\WINDOWS\system32\cmd.exe /c wmic path win32_VideoController get nameC:\Windows\System32\cmd.exe—idk.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
3624"C:\WINDOWS\system32\mspaint.exe" "C:\Users\admin\Desktop\nakedwall.jpg"C:\Windows\System32\mspaint.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4804C:\WINDOWS\system32\cmd.exe /c wmic bios get serialnumberC:\Windows\System32\cmd.exe—idk.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
4868wmic diskdrive get SerialNumber,ModelC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
Total events
4 967
Read events
4 887
Write events
78
Delete events
2

Modification events

(PID) Process:(6532) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6532) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6532) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6532) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\idk.rar
(PID) Process:(6532) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6532) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6532) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6532) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6532) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
(PID) Process:(6532) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:size
Value:
80
Executable files
2
Suspicious files
9
Text files
0
Unknown types
1

Dropped files

PID
Process
Filename
Type
6676idk.exeC:\Windows\INF\wvid.PNFbinary
MD5:108D2FAE49AF6F278B92AAC4404EC91A
SHA256:267FE449DBF70DA2C61DAE23D9DD7777105D5088496487F2B6763779CEC833CE
6532WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa6532.20456\idk.exeexecutable
MD5:3AB69B83726B5C16A2249C55B03BA13A
SHA256:D1FA6AF98ECCC77D4B62CB4D5D30981A774F7E7CE375D11D173AD825C3602A64
6676idk.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771binary
MD5:386B22A87DF5778837C5FD54949F3830
SHA256:F6E34ABAEA4090C2F1C25594AE3C20FA464F204EDC4FBF27E55D7D9BB5FEBF51
6676idk.exeC:\Windows\INF\basicdisplay.PNFbinary
MD5:914DCB989709A0CE3F4B24A4CD147F1A
SHA256:C2FEE0EAD23C7B3B509FDDE94DDD6A549F999F364C5CA9D09AC084F22BC0ECB4
6676idk.exeC:\Windows\INF\basicrender.PNFbinary
MD5:8567F128605CC616A38D0870D077D165
SHA256:7B2D28D317F49EED7BC242241E54EB3FFFB512C5FB6F719C4F5E9395E6B1F533
6676idk.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771binary
MD5:6D1F25FD743A142241E0A681F30D4842
SHA256:98E8B9158FA0C5286EF5ACA3F2A87C63D7FA9AAB4D9164B17D98965B169498B3
6676idk.exeC:\Users\admin\Desktop\report.txttext
MD5:E0358FC09B52BB76A77345EA2CE01D93
SHA256:19D7CF6F7579F87810DF5601C857325AF26EFB5B49CAF88454D890B11B5DB898
6676idk.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2Dbinary
MD5:524E14D71D866097D97F983DB221CEAB
SHA256:48DAA86BF178FC1020770C3DC0ABDE1C42963C3AE29BF73B2ECF1E0D8B0D60CE
6676idk.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2Dbinary
MD5:9546272C29F696ED34FE6F0A5B3E2743
SHA256:8029CB2E7B2D736E4B7E648D53716D4D4D5E5A342FB19BCA1884F5CB8A04AEEC
6676idk.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACA7D89F79C6EF86F63EB2FF5D5C876A_8AD14988285EE6F6CBBCCEE3BD7C8E58der
MD5:47C3B18515DEDF02B361CFBF85FC1F32
SHA256:D6A96CA9A3A6A0D6932BAD62CFFED9731F666F8CEF323664A4369DC39615085C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
24
DNS requests
19
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
184.24.77.17:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6676
idk.exe
GET
200
192.124.249.36:80
http://ocsp.godaddy.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D
unknown
—
—
whitelisted
6676
idk.exe
GET
200
192.124.249.36:80
http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D
unknown
—
—
whitelisted
6676
idk.exe
GET
200
192.124.249.36:80
http://ocsp.godaddy.com//MEkwRzBFMEMwQTAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCEVy5zGFpEO7
unknown
—
—
whitelisted
6148
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6148
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3100
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2028
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
184.24.77.17:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6676
idk.exe
149.154.167.220:443
api.telegram.org
Telegram Messenger Inc
GB
whitelisted
6676
idk.exe
192.124.249.36:80
ocsp.godaddy.com
SUCURI-SEC
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.174
whitelisted
crl.microsoft.com
  • 184.24.77.17
  • 184.24.77.11
  • 184.24.77.14
  • 184.24.77.15
  • 184.24.77.16
  • 184.24.77.10
  • 184.24.77.24
  • 184.24.77.22
  • 184.24.77.18
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 95.101.149.131
whitelisted
api.telegram.org
  • 149.154.167.220
whitelisted
ocsp.godaddy.com
  • 192.124.249.36
  • 192.124.249.24
  • 192.124.249.23
  • 192.124.249.41
  • 192.124.249.22
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
login.live.com
  • 40.126.31.129
  • 40.126.31.69
  • 20.190.159.128
  • 20.190.159.131
  • 20.190.159.68
  • 40.126.31.0
  • 20.190.159.130
  • 40.126.31.128
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
6676
idk.exe
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
6676
idk.exe
Misc activity
ET HUNTING Telegram API Certificate Observed
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
idk.rar