File name:

EYE.zip

Full analysis: https://app.any.run/tasks/19cc5480-c87f-4d2a-a1c8-5ab713acc268
Verdict: Malicious activity
Analysis date: April 20, 2025, 12:06:32
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

63559CCBD4C2622F8EED327D32550CA3

SHA1:

B8B3BB57E39D78CE1B9A195ED66CC8950A1BF2B7

SHA256:

B479060FCB1B9797AC23ACAE6C3CA4FF26B8C5A7FF82D403F034372D4792B8EE

SSDEEP:

96:r/Y2avxId5R0TNNBFdzjV0/Z4C7OVBbDipBghbSehHpYqQogdR:rY20CdMD1RmIpipkWeRaR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 5332)

    • Starts NET.EXE for service management

      • cmd.exe (PID: 5756)
      • net.exe (PID: 5204)

    • Create files in the Startup directory

      • cmd.exe (PID: 5756)

    • Starts NET.EXE to view/add/change user profiles

      • cmd.exe (PID: 5756)
      • net.exe (PID: 6108)
      • net.exe (PID: 1228)
      • net.exe (PID: 1748)
      • net.exe (PID: 2088)
      • net.exe (PID: 5600)
      • net.exe (PID: 300)
      • net.exe (PID: 3100)
      • net.exe (PID: 4200)
      • net.exe (PID: 1660)
      • net.exe (PID: 6828)
      • net.exe (PID: 3020)
      • net.exe (PID: 4724)
      • net.exe (PID: 208)
      • net.exe (PID: 5548)
      • net.exe (PID: 6828)
      • net.exe (PID: 5304)
      • net.exe (PID: 5744)
      • net.exe (PID: 6424)
      • net.exe (PID: 5408)
      • net.exe (PID: 3888)
      • net.exe (PID: 5512)
      • net.exe (PID: 5548)
      • net.exe (PID: 6940)
      • net.exe (PID: 3332)
      • net.exe (PID: 6424)
      • net.exe (PID: 5204)
      • net.exe (PID: 5960)
      • net.exe (PID: 6424)
      • net.exe (PID: 5204)
      • net.exe (PID: 6660)
      • net.exe (PID: 2136)
      • net.exe (PID: 6828)
      • net.exe (PID: 1512)
      • net.exe (PID: 1040)
      • net.exe (PID: 2108)
      • net.exe (PID: 6940)
      • net.exe (PID: 5020)
      • net.exe (PID: 2064)
      • net.exe (PID: 6424)
      • net.exe (PID: 4272)
      • net.exe (PID: 6148)
      • net.exe (PID: 644)
      • net.exe (PID: 2392)
      • net.exe (PID: 2064)
      • net.exe (PID: 1812)
      • net.exe (PID: 5244)
      • net.exe (PID: 5392)
      • net.exe (PID: 3140)
      • net.exe (PID: 4200)
      • net.exe (PID: 6640)
      • net.exe (PID: 5668)
      • net.exe (PID: 6940)
      • net.exe (PID: 5020)
      • net.exe (PID: 3968)
      • net.exe (PID: 3332)
      • net.exe (PID: 2064)
      • net.exe (PID: 1812)
      • net.exe (PID: 4880)
      • net.exe (PID: 680)
      • net.exe (PID: 5668)
      • net.exe (PID: 3968)
      • net.exe (PID: 5020)
      • net.exe (PID: 6108)
      • net.exe (PID: 920)
      • net.exe (PID: 1616)
      • net.exe (PID: 2392)
      • net.exe (PID: 4688)
      • net.exe (PID: 1348)
      • net.exe (PID: 924)
      • net.exe (PID: 208)
      • net.exe (PID: 4152)
      • net.exe (PID: 1660)
      • net.exe (PID: 3140)
      • net.exe (PID: 5800)
      • net.exe (PID: 736)
      • net.exe (PID: 3396)
      • net.exe (PID: 6940)
      • net.exe (PID: 5668)
      • net.exe (PID: 3968)
      • net.exe (PID: 4608)
      • net.exe (PID: 5216)
      • net.exe (PID: 7020)
      • net.exe (PID: 4896)
      • net.exe (PID: 2344)
      • net.exe (PID: 4728)
      • net.exe (PID: 6852)
      • net.exe (PID: 6512)
      • net.exe (PID: 6048)
      • net.exe (PID: 3176)
      • net.exe (PID: 6476)
      • net.exe (PID: 4000)
      • net.exe (PID: 6256)
      • net.exe (PID: 3804)
      • net.exe (PID: 776)
      • net.exe (PID: 5132)
      • net.exe (PID: 616)
      • net.exe (PID: 6644)
      • net.exe (PID: 2664)
      • net.exe (PID: 1452)
      • net.exe (PID: 5124)
      • net.exe (PID: 6416)
      • net.exe (PID: 6728)

    • Disables task manager

      • reg.exe (PID: 3884)

  • SUSPICIOUS

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 5256)
      • cmd.exe (PID: 5756)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 5256)
      • cmd.exe (PID: 2240)
      • cmd.exe (PID: 5756)

    • Application launched itself

      • cmd.exe (PID: 5256)
      • cmd.exe (PID: 2240)
      • cmd.exe (PID: 5756)

    • Executing commands from a ".bat" file

      • cmd.exe (PID: 5256)
      • cmd.exe (PID: 2240)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 5756)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 5756)

    • Uses NETSH.EXE to change the status of the firewall

      • cmd.exe (PID: 5756)

    • Executing commands from ".cmd" file

      • cmd.exe (PID: 5756)

    • Process uses IPCONFIG to get network configuration information

      • cmd.exe (PID: 5756)

    • Starts application with an unusual extension

      • cmd.exe (PID: 4120)

    • Uses NETSH.EXE to obtain data on the network

      • cmd.exe (PID: 5756)

    • Uses WMIC.EXE to obtain physical disk drive information

      • cmd.exe (PID: 5756)

    • Uses SYSTEMINFO.EXE to read the environment

      • cmd.exe (PID: 5756)

    • Uses WMIC.EXE to obtain CPU information

      • cmd.exe (PID: 5756)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • cmd.exe (PID: 5756)

    • Uses RUNDLL32.EXE to load library

      • cmd.exe (PID: 5756)

    • Stops a currently running service

      • sc.exe (PID: 2084)

    • Executable content was dropped or overwritten

      • Dism.exe (PID: 6192)
      • cmd.exe (PID: 5756)

    • Windows service management via SC.EXE

      • sc.exe (PID: 1812)

    • Creates or modifies Windows services

      • reg.exe (PID: 2100)

    • Starts a Microsoft application from unusual location

      • DismHost.exe (PID: 4620)
      • DismHost.exe (PID: 2800)

    • Starts NET.EXE to display or manage information about active sessions

      • cmd.exe (PID: 5756)
      • net.exe (PID: 1276)

    • The process creates files with name similar to system file names

      • Dism.exe (PID: 6192)

    • Process drops legitimate windows executable

      • cmd.exe (PID: 5756)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 5756)

    • The process checks if it is being run in the virtual environment

      • cmd.exe (PID: 5756)

    • The process drops C-runtime libraries

      • cmd.exe (PID: 5756)

    • Creates file in the systems drive root

      • cmd.exe (PID: 5756)
      • cmd.exe (PID: 2244)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2244)

  • INFO

    • Manual execution by a user

      • cmd.exe (PID: 5256)

    • Checks supported languages

      • mode.com (PID: 6660)
      • scrnsave.scr (PID: 6940)
      • DismHost.exe (PID: 4620)
      • DismHost.exe (PID: 2800)

    • Starts MODE.COM to configure console settings

      • mode.com (PID: 6660)

    • Reads the computer name

      • scrnsave.scr (PID: 6940)
      • DismHost.exe (PID: 4620)
      • DismHost.exe (PID: 2800)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 4892)
      • WMIC.exe (PID: 3300)

    • Reads the software policy settings

      • slui.exe (PID: 668)
      • slui.exe (PID: 5800)

    • Checks proxy server information

      • slui.exe (PID: 5800)

    • Create files in a temporary directory

      • Dism.exe (PID: 6192)

    • The sample compiled with english language support

      • Dism.exe (PID: 6192)
      • cmd.exe (PID: 5756)

    • The sample compiled with chinese language support

      • cmd.exe (PID: 5756)

    • The sample compiled with korean language support

      • cmd.exe (PID: 5756)

    • The sample compiled with spanish language support

      • cmd.exe (PID: 5756)

    • The sample compiled with Italian language support

      • cmd.exe (PID: 5756)

    • The sample compiled with french language support

      • cmd.exe (PID: 5756)

    • The sample compiled with japanese language support

      • cmd.exe (PID: 5756)

    • The sample compiled with russian language support

      • cmd.exe (PID: 5756)

    • The sample compiled with german language support

      • cmd.exe (PID: 5756)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:04:20 04:43:26
ZipCRC: 0x28c71910
ZipCompressedSize: 2511
ZipUncompressedSize: 7661
ZipFileName: EYE.bat
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
455
Monitored processes
321
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe no specs slui.exe cmd.exe conhost.exe no specs cacls.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe conhost.exe no specs cacls.exe no specs reg.exe no specs reg.exe no specs net.exe no specs net1.exe no specs netsh.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs cmd.exe no specs conhost.exe no specs net.exe no specs net1.exe no specs scrnsave.scr no specs mode.com no specs netsh.exe no specs ipconfig.exe no specs ipconfig.exe no specs find.exe no specs wmic.exe no specs wmic.exe no specs systeminfo.exe no specs tiworker.exe no specs netsh.exe no specs netsh.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs slui.exe net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs reg.exe no specs rundll32.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs dism.exe dismhost.exe no specs dismhost.exe no specs net.exe no specs net1.exe no specs reg.exe no specs reg.exe no specs net.exe no specs net1.exe no specs cmd.exe no specs conhost.exe no specs diskpart.exe no specs vdsldr.exe no specs taskkill.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208net user 2468 26389 /addC:\Windows\System32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\netutils.dll
208C:\WINDOWS\system32\net1 user 30436 22504 /addC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\samcli.dll
c:\windows\system32\netutils.dll
208net user 31844 31199 /addC:\Windows\System32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\mpr.dll
300net user 10773 23808 /addC:\Windows\System32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\netutils.dll
616net user 30829 5680 /addC:\Windows\System32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\mpr.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
644net user 13171 17412 /addC:\Windows\System32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\mpr.dll
c:\windows\system32\bcrypt.dll
644C:\WINDOWS\system32\net1 user 16631 23352 /addC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\samcli.dll
c:\windows\system32\netutils.dll
668"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
680tskill /A ESAFEC:\Windows\System32\tskill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Remote Desktop Services End Process Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tskill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
680tskill /A norton*C:\Windows\System32\tskill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Remote Desktop Services End Process Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tskill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\winsta.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32full.dll
Total events
12 713
Read events
12 689
Write events
22
Delete events
2

Modification events

(PID) Process:(5332) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5332) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5332) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5332) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\EYE.zip
(PID) Process:(5332) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5332) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5332) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5332) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5332) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(5332) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
Executable files
154
Suspicious files
9
Text files
17
Unknown types
0

Dropped files

PID
Process
Filename
Type
5332WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5332.13653\EYE.battext
MD5:3D5B07463A9CF117B46A8ACDE27FAEBF
SHA256:2E95B5D48F930A202F5E7DE4275E617EBAF6B89F3343DA6B394652D5E790027D
5756cmd.exeC:\Users\admin\Desktop\windowswimn32.battext
MD5:9905E5A33C6EDD8EB5F59780AFBF74DE
SHA256:C134B2F85415BA5CFCE3E3FE4745688335745A9BB22152AC8F5C77F190D8AEE3
6192Dism.exeC:\Windows\Logs\DISM\dism.logtext
MD5:EFD4D607E308F41A3B6ADF87DA5D45D7
SHA256:E17466A51D05FFC8F67D63B124D79AF0E770C622463E3F485D7226ED96C89F27
6192Dism.exeC:\Users\admin\AppData\Local\Temp\2A516668-E618-4A99-99E5-7EF1D471827C\AppxProvider.dllexecutable
MD5:396C483D62FEA5FA0FD442C8DC99D4EF
SHA256:36F2AF43F10FD76FEEF65BF574D79D3E27FD40DAF61249880511543C1F17AD91
5756cmd.exeC:\Users\admin\Desktop\rest.battext
MD5:52D75448C46016F3F860076C2472FCE8
SHA256:29C6A4EDF2D211C6F583AB051A579FC0E8D72F2C88959BFB7FD36380425F9CFE
6192Dism.exeC:\Users\admin\AppData\Local\Temp\2A516668-E618-4A99-99E5-7EF1D471827C\DismCorePS.dllexecutable
MD5:35A07968EC37231249F3F072AE555E3A
SHA256:E5F25E5A170CB3D165C3D143EAE967B96AB80F88FB09176DA8591B0B68C77E00
812TiWorker.exeC:\Windows\Logs\CBS\CBS.logtext
MD5:B15E4494473E0AE9E168221FB14DD045
SHA256:8CCAC2C3FF7ECAA4F09E992149782B53F5F27FDBEA7A18ED1A9A7A08BF2CCCBB
5756cmd.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rest.battext
MD5:96DD21A13A959DBDE9B32EE41DBB7E21
SHA256:0B4CD78BEA7B71D32ADDCB6AD47880529959D897ED74B8494226842195744048
5756cmd.exeC:\Users\admin\Desktop\kill.txttext
MD5:995F43DB4634D90C81AB3B716FAA1FF5
SHA256:1AECC13A454167B47D503E8B9576A04DB3E8C4C7510AE8077140DC8EF17E5145
6192Dism.exeC:\Users\admin\AppData\Local\Temp\2A516668-E618-4A99-99E5-7EF1D471827C\AssocProvider.dllexecutable
MD5:B7DB592706D3EEFBCF0D5A166D462E56
SHA256:DE21321272862E7C332E1724DC315F06F3ABE7A0340E61D351CAB208D6BBF059
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
33
DNS requests
22
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.30:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5408
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5408
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
23.216.77.30:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5408
SIHClient.exe
4.245.163.56:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.216.77.30
  • 23.216.77.22
  • 23.216.77.8
  • 23.216.77.28
  • 23.216.77.38
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
google.com
  • 216.58.212.174
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.160.128
  • 20.190.160.65
  • 40.126.32.133
  • 40.126.32.136
  • 20.190.160.5
  • 40.126.32.74
  • 20.190.160.131
  • 40.126.32.134
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
EYE.zip