File name:

MDE_File_Sample_f58abdb5e8a7b5d3358d3fdb3bd758369d4fd0a0.zip

Full analysis: https://app.any.run/tasks/6f474ccb-79b7-4be3-ba52-f29825d01f1d
Verdict: Malicious activity
Analysis date: March 24, 2025, 08:10:51
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
xor-url
generic
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

F69B3061F528EB6395C0F15E64D000C2

SHA1:

869C404C3CAA34324E361184661B1A4BC19E1D68

SHA256:

9CC6BFD4A0D33A2C9056A292D6E17FEEAA5DF391612A76CF56560DC597F9D6B8

SSDEEP:

98304:of7T2slHjal/oZlwG9B/yPs3d00u04mbQ22LBZVGnB/yZkdKEJ5lvKJoUNPGqopD:q63c1MP9Na

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • f_00f7a8.exe (PID: 4224)
      • f_00f7a8.exe (PID: 6436)
      • f_00f7a8.exe (PID: 8156)
      • f_00f7a8.exe (PID: 5548)

    • Changes settings for real-time protection

      • powershell.exe (PID: 1328)
      • powershell.exe (PID: 7832)
      • powershell.exe (PID: 5720)

    • Changes Windows Defender settings

      • cmd.exe (PID: 7400)
      • cmd.exe (PID: 7760)
      • cmd.exe (PID: 8024)
      • cmd.exe (PID: 6768)
      • cmd.exe (PID: 4892)
      • cmd.exe (PID: 1072)
      • cmd.exe (PID: 7504)
      • cmd.exe (PID: 5232)

    • Adds path to the Windows Defender exclusion list

      • cmd.exe (PID: 7504)
      • cmd.exe (PID: 4892)
      • cmd.exe (PID: 1072)
      • cmd.exe (PID: 5232)

    • XORed URL has been found (YARA)

      • f_00f7a8.exe (PID: 6436)
      • iResolvePrime.exe (PID: 7892)
      • iResolvePrime.exe (PID: 2096)

    • Adds process to the Windows Defender exclusion list

      • cmd.exe (PID: 7760)

  • SUSPICIOUS

    • Script disables Windows Defender's real-time protection

      • cmd.exe (PID: 7400)
      • cmd.exe (PID: 8024)
      • cmd.exe (PID: 6768)

    • Starts CMD.EXE for commands execution

      • f_00f7a8.exe (PID: 6436)
      • iResolvePrime.exe (PID: 7892)
      • iResolvePrime.exe (PID: 2096)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 7400)
      • cmd.exe (PID: 7504)
      • cmd.exe (PID: 7760)
      • cmd.exe (PID: 8024)
      • cmd.exe (PID: 6768)
      • cmd.exe (PID: 4892)
      • cmd.exe (PID: 1072)
      • cmd.exe (PID: 5232)

    • Script adds exclusion process to Windows Defender

      • cmd.exe (PID: 7760)

    • Script adds exclusion path to Windows Defender

      • cmd.exe (PID: 7504)
      • cmd.exe (PID: 4892)
      • cmd.exe (PID: 1072)
      • cmd.exe (PID: 5232)

    • Reads security settings of Internet Explorer

      • ShellExperienceHost.exe (PID: 7404)
      • f_00f7a8.exe (PID: 6436)
      • iResolvePrime.exe (PID: 7892)

    • Drops a system driver (possible attempt to evade defenses)

      • f_00f7a8.exe (PID: 6436)

    • Process drops legitimate windows executable

      • f_00f7a8.exe (PID: 6436)

    • Executable content was dropped or overwritten

      • f_00f7a8.exe (PID: 6436)
      • iResolvePrime.exe (PID: 2096)

    • Process drops SQLite DLL files

      • f_00f7a8.exe (PID: 6436)

    • The process drops C-runtime libraries

      • f_00f7a8.exe (PID: 6436)

    • Drops 7-zip archiver for unpacking

      • f_00f7a8.exe (PID: 6436)

    • There is functionality for taking screenshot (YARA)

      • iResolvePrime.exe (PID: 7892)
      • iResolvePrime.exe (PID: 2096)

    • Reads the date of Windows installation

      • iResolvePrime.exe (PID: 7892)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2384)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 7472)
      • BackgroundTransferHost.exe (PID: 7848)
      • BackgroundTransferHost.exe (PID: 7684)
      • BackgroundTransferHost.exe (PID: 660)
      • BackgroundTransferHost.exe (PID: 8076)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 7684)
      • iResolvePrime.exe (PID: 2096)

    • Manual execution by a user

      • f_00f7a8.exe (PID: 6436)
      • f_00f7a8.exe (PID: 8156)
      • f_00f7a8.exe (PID: 5548)
      • f_00f7a8.exe (PID: 4224)
      • iResolvePrime.exe (PID: 6800)
      • iResolvePrime.exe (PID: 2096)

    • Checks supported languages

      • f_00f7a8.exe (PID: 6436)
      • f_00f7a8.exe (PID: 5548)
      • ShellExperienceHost.exe (PID: 7404)
      • iResolvePrime.exe (PID: 7892)
      • updater.exe (PID: 7972)

    • Reads the computer name

      • f_00f7a8.exe (PID: 6436)
      • ShellExperienceHost.exe (PID: 7404)
      • updater.exe (PID: 7972)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 7684)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 1328)
      • powershell.exe (PID: 7896)
      • powershell.exe (PID: 5504)
      • powershell.exe (PID: 5720)
      • powershell.exe (PID: 6392)
      • powershell.exe (PID: 8092)
      • powershell.exe (PID: 7832)
      • powershell.exe (PID: 900)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7896)
      • powershell.exe (PID: 1328)
      • powershell.exe (PID: 5504)
      • powershell.exe (PID: 7832)
      • powershell.exe (PID: 5720)
      • powershell.exe (PID: 6392)
      • powershell.exe (PID: 8092)
      • powershell.exe (PID: 900)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 7684)
      • f_00f7a8.exe (PID: 6436)
      • iResolvePrime.exe (PID: 7892)

    • Reads the machine GUID from the registry

      • f_00f7a8.exe (PID: 6436)
      • iResolvePrime.exe (PID: 7892)

    • Creates files in the program directory

      • f_00f7a8.exe (PID: 6436)
      • iResolvePrime.exe (PID: 7892)
      • iResolvePrime.exe (PID: 2096)

    • Disables trace logs

      • f_00f7a8.exe (PID: 6436)
      • iResolvePrime.exe (PID: 7892)

    • The sample compiled with english language support

      • f_00f7a8.exe (PID: 6436)

    • The sample compiled with arabic language support

      • f_00f7a8.exe (PID: 6436)

    • SQLite executable

      • f_00f7a8.exe (PID: 6436)

    • Process checks computer location settings

      • f_00f7a8.exe (PID: 6436)
      • iResolvePrime.exe (PID: 7892)

    • Reads Environment values

      • iResolvePrime.exe (PID: 7892)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

xor-url

(PID) Process(6436) f_00f7a8.exe
Decrypted-URLs (3)https://gsmadjaa.com/support/
https://gsmadjaa.xyz/update/iResolvehello.php
https://iresolveprime.gsmadjaa.com/bypassicloud.php
(PID) Process(7892) iResolvePrime.exe
Decrypted-URLs (19)http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://schemas.microsoft.com/SMI/2016/WindowsSettings
https://api.ipify.org/
https://api.telegram.org/bot5272081738:AAH33Xu6C6bDaVvQKJI-xMldq7fZBYLz3oE/sendMessage?chat_id=...........&text=
https://api.telegram.org/bot6267929589:AAH6aAM4MgRB871zlKxLAVEjaGk-Z61vKHM/sendMessage?chat_id=2121212318&text=
https://api64.ipify.org
https://docs.microsoft.com/windows/win32/fileio/maximum-file-path-limitation
https://gsmadjaa.com/checkout/index.php?type=iresolvehello&sft=aVJlc29sdmVQcmltZSAoQWN0aXZhdGlvbiBCeXBhc3Mp&init=
https://gsmadjaa.com/iressource/model.php?read=
https://gsmadjaa.com/panel/
https://gsmadjaa.xyz/data/adjaa.dll
https://gsmadjaa.xyz/pc/mac.php?mac_key=
https://gsmadjaa.xyz/update/iResolvePrimehello.7z
https://gsmadjaa.xyz/update/iResolvehello.php
https://gsmadjaa.xyz/update/irtest.txt
https://software.gsmadjaa.com/
https://t.me/gsmadjaa2005
https://t.me/iResolvePrime
https://www.trustpilot.com/evaluate/gsmadjaa.com?utm_source=Trustpilot&utm_medium=email&utm_campaign=trustpilot_email
(PID) Process(2096) iResolvePrime.exe
Decrypted-URLs (19)http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://schemas.microsoft.com/SMI/2016/WindowsSettings
https://api.ipify.org/
https://api.telegram.org/bot5272081738:AAH33Xu6C6bDaVvQKJI-xMldq7fZBYLz3oE/sendMessage?chat_id=...........&text=
https://api.telegram.org/bot6267929589:AAH6aAM4MgRB871zlKxLAVEjaGk-Z61vKHM/sendMessage?chat_id=2121212318&text=
https://api64.ipify.org
https://docs.microsoft.com/windows/win32/fileio/maximum-file-path-limitation
https://gsmadjaa.com/checkout/index.php?type=iresolvehello&sft=aVJlc29sdmVQcmltZSAoQWN0aXZhdGlvbiBCeXBhc3Mp&init=
https://gsmadjaa.com/iressource/model.php?read=
https://gsmadjaa.com/panel/
https://gsmadjaa.xyz/data/adjaa.dll
https://gsmadjaa.xyz/pc/mac.php?mac_key=
https://gsmadjaa.xyz/update/iResolvePrimehello.7z
https://gsmadjaa.xyz/update/iResolvehello.php
https://gsmadjaa.xyz/update/irtest.txt
https://software.gsmadjaa.com/
https://t.me/gsmadjaa2005
https://t.me/iResolvePrime
https://www.trustpilot.com/evaluate/gsmadjaa.com?utm_source=Trustpilot&utm_medium=email&utm_campaign=trustpilot_email
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2025:03:24 08:06:50
ZipCRC: 0x46e6d452
ZipCompressedSize: 5511496
ZipUncompressedSize: 6010024
ZipFileName: f_00f7a8
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
195
Monitored processes
50
Malicious processes
11
Suspicious processes
6

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs f_00f7a8.exe no specs #XOR-URL f_00f7a8.exe cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs f_00f7a8.exe no specs f_00f7a8.exe cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs shellexperiencehost.exe no specs slui.exe #XOR-URL iresolveprime.exe cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs updater.exe no specs conhost.exe no specs iresolveprime.exe no specs #XOR-URL iresolveprime.exe cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs updater.exe no specs conhost.exe no specs rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
456"cmd" ipconfig /flushdnsC:\Windows\System32\cmd.exe—iResolvePrime.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winbrand.dll
660"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
900powershell Add-MpPreference -ExclusionPath """C:\Program Files\ADJAA-SOFTWARES\IRHELLO"""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\atl.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\user32.dll
1072"cmd.exe"C:\Windows\System32\cmd.exe—iResolvePrime.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winbrand.dll
1328powershell Set-MpPreference -DisableRealtimeMonitoring $falseC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1616"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2096"C:\Program Files\ADJAA-SOFTWARES\IRHELLO\iResolvePrime.exe" C:\Program Files\ADJAA-SOFTWARES\IRHELLO\iResolvePrime.exe
explorer.exe
User:
admin
Company:
GSM ADJAA COMPANY
Integrity Level:
HIGH
Description:
iResolvePrime ( Activation Bypass )
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\program files\adjaa-softwares\irhello\iresolveprime.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
xor-url
(PID) Process(2096) iResolvePrime.exe
Decrypted-URLs (19)http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://schemas.microsoft.com/SMI/2016/WindowsSettings
https://api.ipify.org/
https://api.telegram.org/bot5272081738:AAH33Xu6C6bDaVvQKJI-xMldq7fZBYLz3oE/sendMessage?chat_id=...........&text=
https://api.telegram.org/bot6267929589:AAH6aAM4MgRB871zlKxLAVEjaGk-Z61vKHM/sendMessage?chat_id=2121212318&text=
https://api64.ipify.org
https://docs.microsoft.com/windows/win32/fileio/maximum-file-path-limitation
https://gsmadjaa.com/checkout/index.php?type=iresolvehello&sft=aVJlc29sdmVQcmltZSAoQWN0aXZhdGlvbiBCeXBhc3Mp&init=
https://gsmadjaa.com/iressource/model.php?read=
https://gsmadjaa.com/panel/
https://gsmadjaa.xyz/data/adjaa.dll
https://gsmadjaa.xyz/pc/mac.php?mac_key=
https://gsmadjaa.xyz/update/iResolvePrimehello.7z
https://gsmadjaa.xyz/update/iResolvehello.php
https://gsmadjaa.xyz/update/irtest.txt
https://software.gsmadjaa.com/
https://t.me/gsmadjaa2005
https://t.me/iResolvePrime
https://www.trustpilot.com/evaluate/gsmadjaa.com?utm_source=Trustpilot&utm_medium=email&utm_campaign=trustpilot_email
2108\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2384"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\MDE_File_Sample_f58abdb5e8a7b5d3358d3fdb3bd758369d4fd0a0.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2960\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
51 433
Read events
51 349
Write events
84
Delete events
0

Modification events

(PID) Process:(2384) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(2384) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(2384) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2384) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\MDE_File_Sample_f58abdb5e8a7b5d3358d3fdb3bd758369d4fd0a0.zip
(PID) Process:(2384) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2384) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2384) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2384) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2384) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(2384) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
Executable files
262
Suspicious files
14
Text files
42
Unknown types
0

Dropped files

PID
Process
Filename
Type
7684BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\ef40b03e-d229-4c0e-97c7-8315947e46be.down_data —
MD5:—
SHA256:—
1328powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:D2979F07A82FBC3067BB967FCE667A1A
SHA256:840E32DBA1011F388920BB69013249BE2C03CA0EA7F44DDCFFD7A113C151C518
7684BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\ef40b03e-d229-4c0e-97c7-8315947e46be.e68cc23d-2626-4fd4-b7bb-176a0411db0e.down_metabinary
MD5:8B5C8E13A98ADA5DE23444307727A9B1
SHA256:36846AC786D8B71ADAC719AE0D4788C49C193237B3581CC6FDCF91ADE7F8E9B6
7684BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\23c825ca-fe85-4020-b772-95ea4407b001.e68cc23d-2626-4fd4-b7bb-176a0411db0e.down_metabinary
MD5:8B5C8E13A98ADA5DE23444307727A9B1
SHA256:36846AC786D8B71ADAC719AE0D4788C49C193237B3581CC6FDCF91ADE7F8E9B6
7896powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_uh1o1rbv.dmj.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1328powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_jka3tuq3.zhb.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2384WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2384.17091\f_00f7a8executable
MD5:BADA330A2595390D070C7E08AC4ACF34
SHA256:D77D7A324BD82C52982A4168E2CF5E7A8C9E8B89404740475D617BDD213F9559
1328powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_hwgykns3.zmk.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5504powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_2g4lvebx.vtl.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7684BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:4872BABAF39AA62B8D32695EBB7E9173
SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
29
DNS requests
20
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.164.18:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7684
BackgroundTransferHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7608
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6876
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7608
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
2.16.164.18:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
6876
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6876
backgroundTaskHost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
7684
BackgroundTransferHost.exe
23.15.178.234:443
www.bing.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.238
whitelisted
crl.microsoft.com
  • 2.16.164.18
  • 2.16.164.24
  • 2.16.164.72
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.160.14
  • 20.190.160.3
  • 20.190.160.65
  • 40.126.32.140
  • 40.126.32.138
  • 40.126.32.136
  • 40.126.32.68
  • 20.190.160.130
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 184.30.131.245
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
www.bing.com
  • 23.15.178.234
  • 23.15.178.138
  • 23.15.178.168
  • 23.15.178.147
  • 23.15.178.185
  • 23.15.178.233
  • 23.15.178.179
  • 23.15.178.216
  • 23.15.178.136
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted

Threats

PID
Process
Class
Message
6436
f_00f7a8.exe
Potentially Bad Traffic
ET HUNTING Observed Let's Encrypt Certificate for Suspicious TLD (.xyz)
7892
iResolvePrime.exe
Potentially Bad Traffic
ET HUNTING Observed Let's Encrypt Certificate for Suspicious TLD (.xyz)
2096
iResolvePrime.exe
Potentially Bad Traffic
ET HUNTING Observed Let's Encrypt Certificate for Suspicious TLD (.xyz)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MDE_File_Sample_f58abdb5e8a7b5d3358d3fdb3bd758369d4fd0a0.zip