File name:

Pruebas.zip

Full analysis: https://app.any.run/tasks/1623e723-b580-4e4e-9b73-d8d93b8aa5f8
Verdict: Malicious activity
Analysis date: July 03, 2025, 17:31:26
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

D3F1320AB3B1CF00A739F823D80A7425

SHA1:

99B944DA69C294A8596EDD940304222793747B0F

SHA256:

B3728E7E8F284B54113FBD9A22E8E2FD1BB2867436F3F26F581D5D0E355B6A88

SSDEEP:

98304:XUtM7uiNqXcqavFG2bJ6FGkDje36sEhwWqvKEVAPlTQkBkOcqZuCX0WFmnt5RDaF:AG4Xg4v0ZKp9fgexD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • KillerAnalyticsService314966.exe (PID: 4456)
      • KillerAnalyticsService314966.exe (PID: 6940)
      • KillerAnalyticsService314966.exe (PID: 4760)
      • KillerAnalyticsService314966.exe (PID: 424)
      • KillerAnalyticsService314966.exe (PID: 3400)
      • KillerAnalyticsService314966.exe (PID: 1700)
      • KillerAnalyticsService314966.exe (PID: 1652)

  • SUSPICIOUS

    • Starts a Microsoft application from unusual location

      • KillerAnalyticsService314966.exe (PID: 6940)
      • KillerAnalyticsService314966.exe (PID: 4456)
      • KillerAnalyticsService314966.exe (PID: 4760)
      • KillerAnalyticsService314966.exe (PID: 424)
      • KillerAnalyticsService314966.exe (PID: 1700)
      • KillerAnalyticsService314966.exe (PID: 3400)
      • KillerAnalyticsService314966.exe (PID: 1652)

    • Drops a system driver (possible attempt to evade defenses)

      • WinRAR.exe (PID: 6648)

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 6648)

    • Reads the date of Windows installation

      • KillerAnalyticsService314966.exe (PID: 4456)
      • KillerAnalyticsService314966.exe (PID: 424)
      • KillerAnalyticsService314966.exe (PID: 1700)
      • KillerAnalyticsService314966.exe (PID: 1652)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6648)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 6648)

    • Manual execution by a user

      • KillerAnalyticsService314966.exe (PID: 6940)
      • KillerAnalyticsService314966.exe (PID: 4456)
      • KillerAnalyticsService314966.exe (PID: 4760)
      • KillerAnalyticsService314966.exe (PID: 424)
      • KillerAnalyticsService314966.exe (PID: 3400)
      • KillerAnalyticsService314966.exe (PID: 1700)
      • KillerAnalyticsService314966.exe (PID: 1652)

    • Reads product name

      • KillerAnalyticsService314966.exe (PID: 4456)
      • KillerAnalyticsService314966.exe (PID: 424)
      • KillerAnalyticsService314966.exe (PID: 1700)
      • KillerAnalyticsService314966.exe (PID: 1652)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 4580)
      • OpenWith.exe (PID: 2792)
      • OpenWith.exe (PID: 868)

    • Checks supported languages

      • KillerAnalyticsService314966.exe (PID: 4456)
      • KillerAnalyticsService314966.exe (PID: 424)
      • KillerAnalyticsService314966.exe (PID: 1700)
      • KillerAnalyticsService314966.exe (PID: 1652)

    • Reads the computer name

      • KillerAnalyticsService314966.exe (PID: 4456)
      • KillerAnalyticsService314966.exe (PID: 424)
      • KillerAnalyticsService314966.exe (PID: 1700)
      • KillerAnalyticsService314966.exe (PID: 1652)

    • Reads Environment values

      • KillerAnalyticsService314966.exe (PID: 4456)
      • KillerAnalyticsService314966.exe (PID: 424)
      • KillerAnalyticsService314966.exe (PID: 1700)
      • KillerAnalyticsService314966.exe (PID: 1652)

    • Reads CPU info

      • KillerAnalyticsService314966.exe (PID: 424)
      • KillerAnalyticsService314966.exe (PID: 1700)
      • KillerAnalyticsService314966.exe (PID: 4456)
      • KillerAnalyticsService314966.exe (PID: 1652)

    • Reads the software policy settings

      • slui.exe (PID: 6336)

    • Checks proxy server information

      • slui.exe (PID: 6336)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2025:07:03 11:25:38
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: Pruebas/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
159
Monitored processes
13
Malicious processes
5
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs killeranalyticsservice314966.exe no specs killeranalyticsservice314966.exe no specs openwith.exe no specs slui.exe killeranalyticsservice314966.exe no specs killeranalyticsservice314966.exe no specs killeranalyticsservice314966.exe no specs killeranalyticsservice314966.exe no specs killeranalyticsservice314966.exe openwith.exe no specs openwith.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
424"C:\Users\admin\Desktop\Pruebas\KillerAnalyticsService314966.exe" C:\Users\admin\Desktop\Pruebas\KillerAnalyticsService314966.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Accessible Event Watcher (32-bit UNICODE Release)
Exit code:
0
Version:
7.2.0.0
Modules
Images
c:\users\admin\desktop\pruebas\killeranalyticsservice314966.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
868C:\WINDOWS\system32\OpenWith.exe -EmbeddingC:\Windows\System32\OpenWith.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1652"C:\Users\admin\Desktop\Pruebas\KillerAnalyticsService314966.exe" C:\Users\admin\Desktop\Pruebas\KillerAnalyticsService314966.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Accessible Event Watcher (32-bit UNICODE Release)
Exit code:
0
Version:
7.2.0.0
Modules
Images
c:\users\admin\desktop\pruebas\killeranalyticsservice314966.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1700"C:\Users\admin\Desktop\Pruebas\KillerAnalyticsService314966.exe" C:\Users\admin\Desktop\Pruebas\KillerAnalyticsService314966.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Accessible Event Watcher (32-bit UNICODE Release)
Exit code:
0
Version:
7.2.0.0
Modules
Images
c:\users\admin\desktop\pruebas\killeranalyticsservice314966.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2792C:\WINDOWS\system32\OpenWith.exe -EmbeddingC:\Windows\System32\OpenWith.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3400"C:\Users\admin\Desktop\Pruebas\KillerAnalyticsService314966.exe" C:\Users\admin\Desktop\Pruebas\KillerAnalyticsService314966.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Accessible Event Watcher (32-bit UNICODE Release)
Exit code:
3221226540
Version:
7.2.0.0
Modules
Images
c:\users\admin\desktop\pruebas\killeranalyticsservice314966.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4156C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
4456"C:\Users\admin\Desktop\Pruebas\KillerAnalyticsService314966.exe" C:\Users\admin\Desktop\Pruebas\KillerAnalyticsService314966.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Accessible Event Watcher (32-bit UNICODE Release)
Exit code:
0
Version:
7.2.0.0
Modules
Images
c:\users\admin\desktop\pruebas\killeranalyticsservice314966.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4580C:\WINDOWS\system32\OpenWith.exe -EmbeddingC:\Windows\System32\OpenWith.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4760"C:\Users\admin\Desktop\Pruebas\KillerAnalyticsService314966.exe" C:\Users\admin\Desktop\Pruebas\KillerAnalyticsService314966.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Accessible Event Watcher (32-bit UNICODE Release)
Exit code:
3221226540
Version:
7.2.0.0
Modules
Images
c:\users\admin\desktop\pruebas\killeranalyticsservice314966.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
7 126
Read events
7 099
Write events
14
Delete events
13

Modification events

(PID) Process:(6648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Pruebas.zip
(PID) Process:(6648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(6648) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
8
Suspicious files
0
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
6648WinRAR.exeC:\Users\admin\Desktop\Pruebas\EVENT.dll —
MD5:—
SHA256:—
6648WinRAR.exeC:\Users\admin\Desktop\Pruebas\scrobj.dllexecutable
MD5:3BAC5E5C39B9787E3672ACBFABE438D1
SHA256:164EA0913EF910084147CAB550C12B8F12C710A3F1BADF4A26C6691517A031C4
6648WinRAR.exeC:\Users\admin\Desktop\Pruebas\Cursors\aero_nesw_l.curimage
MD5:94AF75728CB0E587EB63A9FA20A7731A
SHA256:FB59C5F1B02CCB8DFD0CAD9F1DDE148D43F998D24C170FB25D3C8645E8333B8C
6648WinRAR.exeC:\Users\admin\Desktop\Pruebas\Cursors\aero_nesw.curimage
MD5:B6DEEA348966D73380190E4A2E166E0B
SHA256:18108C75EEC4CDE840614716C828C16912549BF18E0EDC610F15B0236B0512EA
6648WinRAR.exeC:\Users\admin\Desktop\Pruebas\pnpmem.sysexecutable
MD5:2769F200292C0F941A10BD60C33EA4A6
SHA256:B8345C32585C45E6248D7194B1071F2B8617718E7C9B270AAF44C132D029DB4C
6648WinRAR.exeC:\Users\admin\Desktop\Pruebas\Cursors\aero_link_im.curimage
MD5:EB7BDB524F8D2DF5EE518F09E74BC915
SHA256:C0A68DD5BF81DA430F18E658AA83A4D7FA544F71B927438DA1C9424EEF6A156A
6648WinRAR.exeC:\Users\admin\Desktop\Pruebas\KillerAnalyticsService314966.exeexecutable
MD5:1EB266F45C6E163E966424893B18FC60
SHA256:655B1947CFF133A1713623E358A923E0A5935353B93486134FB91C74DBFE120F
6648WinRAR.exeC:\Users\admin\Desktop\Pruebas\rnr20.dllexecutable
MD5:B7EE4EA3A902F9D6B45C3DAA17952555
SHA256:84E206B915F5BF1CB79A336B659B7550373AC621A1EE0F9E20D8B074D024F5E6
6648WinRAR.exeC:\Users\admin\Desktop\Pruebas\RpcRtRemote.dllexecutable
MD5:9A6998EBD24026A139567EE52E76AE34
SHA256:B893B3C7DA30429015B506E42E905288CE8D1A95B2B211F56441CBC11D09D47A
6648WinRAR.exeC:\Users\admin\Desktop\Pruebas\RMapi.dllexecutable
MD5:2A10F8D56DB7BA8FD83FD7BAD2F9E94F
SHA256:0257C0CFBE9001DFC51D382977C77BB1B52984D01BE38E47C6B8A0018AF1CAB0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
25
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2764
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
6516
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6516
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4832
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2764
svchost.exe
40.126.31.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2764
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
6516
SIHClient.exe
4.245.163.56:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.110
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.48.23.166
  • 23.48.23.145
  • 23.48.23.143
  • 23.48.23.180
  • 23.48.23.194
  • 23.48.23.177
  • 23.48.23.156
  • 23.48.23.147
  • 23.48.23.176
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
login.live.com
  • 40.126.31.0
  • 40.126.31.131
  • 40.126.31.1
  • 20.190.159.131
  • 40.126.31.71
  • 40.126.31.67
  • 40.126.31.2
  • 40.126.31.129
  • 20.190.160.20
  • 20.190.160.132
  • 20.190.160.3
  • 20.190.160.14
  • 40.126.32.72
  • 40.126.32.68
  • 20.190.160.130
  • 40.126.32.76
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.19
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Pruebas.zip