File name:

Vapev4guibykqrma1234.zip

Full analysis: https://app.any.run/tasks/b59c47d6-f63d-439c-8797-de5da7c13064
Verdict: Malicious activity
Analysis date: May 31, 2025, 15:15:59
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

27825F0C4A06F4A9FE5F014BA6636D97

SHA1:

06C067F7C1C7A90633F5C3CDC3963AA24E7C6074

SHA256:

8F940D59A207414C71A3333B42EB8CB9FC102BC9737A4668CAB429FE564ED53F

SSDEEP:

98304:Gk2oetdE6vImf8WGRpntGGv7G2rEGyafx8HnntOBhDFJQhZyDvkylVJ6Hh+aR2pq:Y73hBSPtoiINCWKKmz+zpQV0PXL

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 2040)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • vaperip.exe (PID: 6192)
      • vaperip.exe (PID: 7792)
      • vaperip.exe (PID: 7204)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 2040)

    • Executes application which crashes

      • Vape.exe (PID: 6252)

    • There is functionality for taking screenshot (YARA)

      • Vape.exe (PID: 6540)
      • Vape.exe (PID: 7848)

  • INFO

    • Manual execution by a user

      • vaperip.exe (PID: 6192)
      • Vape.exe (PID: 6252)
      • Vape.exe (PID: 6540)
      • WinRAR.exe (PID: 7700)
      • vaperip.exe (PID: 7792)
      • Vape.exe (PID: 7848)
      • vaperip.exe (PID: 7204)

    • Checks supported languages

      • Vape.exe (PID: 6252)
      • vaperip.exe (PID: 6192)
      • Vape.exe (PID: 732)
      • Vape.exe (PID: 6540)
      • vaperip.exe (PID: 7792)
      • vaperip.exe (PID: 7204)
      • Vape.exe (PID: 7848)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2040)
      • WinRAR.exe (PID: 7700)

    • Reads the computer name

      • Vape.exe (PID: 6252)
      • Vape.exe (PID: 732)
      • Vape.exe (PID: 6540)
      • Vape.exe (PID: 7848)

    • Reads the machine GUID from the registry

      • Vape.exe (PID: 732)
      • Vape.exe (PID: 6252)
      • Vape.exe (PID: 7848)
      • Vape.exe (PID: 6540)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 8020)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 7912)

    • Checks proxy server information

      • slui.exe (PID: 2136)

    • Reads the software policy settings

      • slui.exe (PID: 2136)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2025:05:30 10:28:44
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: Vape v4 gui by kqrma1234/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
19
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe vaperip.exe no specs conhost.exe no specs cmd.exe no specs vape.exe vape.exe no specs werfault.exe no specs winrar.exe rundll32.exe no specs openwith.exe no specs vaperip.exe no specs conhost.exe no specs cmd.exe no specs vape.exe no specs vaperip.exe no specs conhost.exe no specs cmd.exe no specs vape.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
732"C:\Users\admin\AppData\Local\Temp\Rar$EXa2040.38613\Vape v4 gui by kqrma1234\Vape.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2040.38613\Vape v4 gui by kqrma1234\Vape.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Vape
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2040.38613\vape v4 gui by kqrma1234\vape.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1568\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—vaperip.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2040"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\Vapev4guibykqrma1234.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2136C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4200\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—vaperip.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4784C:\WINDOWS\system32\cmd.exe /c pauseC:\Windows\System32\cmd.exe—vaperip.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
3221225786
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
6192"C:\Users\admin\Desktop\vaperip.exe" C:\Users\admin\Desktop\vaperip.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225786
Modules
Images
c:\users\admin\desktop\vaperip.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
6252"C:\Users\admin\Desktop\Vape.exe" C:\Users\admin\Desktop\Vape.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Vape
Exit code:
3762504530
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\vape.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6540"C:\Users\admin\Desktop\Vapev4guibykqrma1234\Vape v4 gui by kqrma1234\Vape.exe" C:\Users\admin\Desktop\Vapev4guibykqrma1234\Vape v4 gui by kqrma1234\Vape.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Vape
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\vapev4guibykqrma1234\vape v4 gui by kqrma1234\vape.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7204"C:\Users\admin\Desktop\Vapev4guibykqrma1234\Vape v4 gui by kqrma1234\vaperip.exe" C:\Users\admin\Desktop\Vapev4guibykqrma1234\Vape v4 gui by kqrma1234\vaperip.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\vapev4guibykqrma1234\vape v4 gui by kqrma1234\vaperip.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
7 923
Read events
7 901
Write events
22
Delete events
0

Modification events

(PID) Process:(2040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(2040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(2040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Vapev4guibykqrma1234.zip
(PID) Process:(2040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
(PID) Process:(2040) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:size
Value:
80
Executable files
8
Suspicious files
1
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
8020WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Vape.exe_77d1e18e33548d194a2b267b6d751690d042325a_080884c8_e40c8e6f-7ad8-4ded-8e40-b2484708b7b0\Report.wer —
MD5:—
SHA256:—
8020WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\Vape.exe.6252.dmp —
MD5:—
SHA256:—
7700WinRAR.exeC:\Users\admin\Desktop\Vapev4guibykqrma1234\Vape v4 gui by kqrma1234\Vape.exeexecutable
MD5:E69458CEA3C71A9DF95819C160B04E7D
SHA256:FC85E6FBFAADFB4F6BA83EB53F4D66E4F3F5C40D0B710ACE89D51A022421F386
2040WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2040.38613\Vape v4 gui by kqrma1234\Guna.UI2.dllexecutable
MD5:B464FC896B14BFA34F608DA53856E999
SHA256:2130C7489F5A5E21812C1EAB37DC4903B901861A2D545AA607555BE269091AFD
7700WinRAR.exeC:\Users\admin\Desktop\Vapev4guibykqrma1234\Vape v4 gui by kqrma1234\Guna.UI2.dllexecutable
MD5:B464FC896B14BFA34F608DA53856E999
SHA256:2130C7489F5A5E21812C1EAB37DC4903B901861A2D545AA607555BE269091AFD
2040WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2040.38613\Vape v4 gui by kqrma1234\penis.dllexecutable
MD5:3532AB68C068445FE40A19A29CB51156
SHA256:9B2BF838A8598B98363CD94BB33B3667D853B44E0643516617070629CDC7561E
8020WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER2A92.tmp.dmpbinary
MD5:1989AA4BC72F130B063A0EDD989D45DB
SHA256:10D083FF59DD97FA6AABDB1D3D00078B60FAF509B81372313FD2725A02777792
2040WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2040.38613\Vape v4 gui by kqrma1234\vaperip.exeexecutable
MD5:2629D4EDAFE5CBD84DC3EC22865D52D5
SHA256:3361545F3F475F0467D249DB6511046B5F9717E7AA80D736C16065E267045150
8020WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER2C98.tmp.xmlxml
MD5:200BF352E2BCCAAF5CC267F5EBB2BE20
SHA256:7FF29342AE468A141FC60AD06BA2E9AB85E18798B79FB68D9A2D0BB8B98A683B
7700WinRAR.exeC:\Users\admin\Desktop\Vapev4guibykqrma1234\Vape v4 gui by kqrma1234\penis.dllexecutable
MD5:3532AB68C068445FE40A19A29CB51156
SHA256:9B2BF838A8598B98363CD94BB33B3667D853B44E0643516617070629CDC7561E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
25
TCP/UDP connections
50
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
POST
200
20.190.160.20:443
https://login.live.com/RST2.srf
unknown
xml
11.0 Kb
whitelisted
—
—
POST
200
20.190.160.20:443
https://login.live.com/RST2.srf
unknown
xml
11.0 Kb
whitelisted
—
—
POST
200
20.190.160.20:443
https://login.live.com/RST2.srf
unknown
xml
10.3 Kb
whitelisted
—
—
POST
200
40.126.32.74:443
https://login.live.com/RST2.srf
unknown
xml
10.3 Kb
whitelisted
—
—
POST
200
40.126.32.72:443
https://login.live.com/RST2.srf
unknown
xml
10.3 Kb
whitelisted
—
—
GET
304
20.12.23.50:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
7636
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
20.12.23.50:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
7636
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6544
svchost.exe
20.190.160.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
7636
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
7636
svchost.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
7636
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
login.live.com
  • 20.190.160.128
  • 20.190.160.2
  • 20.190.160.64
  • 20.190.160.67
  • 40.126.32.76
  • 20.190.160.4
  • 40.126.32.140
  • 20.190.160.22
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
google.com
  • 142.250.185.174
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Vapev4guibykqrma1234.zip