File name:

for testing.zip

Full analysis: https://app.any.run/tasks/9f12c6e7-2409-4b03-9e76-de71242542e9
Verdict: Malicious activity
Analysis date: May 27, 2025, 23:56:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
arch-exec
memz
mbr
Indicators:
MIME: application/zip
File info: Zip archive data, at least v4.5 to extract, compression method=deflate
MD5:

68EC8DD3E945B1506DC42AB2B5D59384

SHA1:

FF1507B08F59C6E858C27BFC58C006CE313D6175

SHA256:

BA49309462459D7957E469B7DED546BC939002B7F9D27BE3E45B157373DEF292

SSDEEP:

6144:7U1afzTKFQ4QmtMitJCzX/FcyQXVDG2EvMDMKZDi5iriWPB9tvb:7oafzT7TmtPe/NaDG2EvMDQMGWPNvb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 2448)

    • Uses base64 encoding (SCRIPT)

      • cscript.exe (PID: 1888)

    • MEMZ has been detected (YARA)

      • MEMZ.exe (PID: 2096)
      • MEMZ.exe (PID: 3636)
      • MEMZ.exe (PID: 3224)
      • MEMZ.exe (PID: 3776)
      • MEMZ.exe (PID: 3000)
      • MEMZ.exe (PID: 3712)
      • MEMZ.exe (PID: 3656)

    • Gets a file object corresponding to the file in a specified path (SCRIPT)

      • cscript.exe (PID: 1888)

    • Disables task manager

      • 一一一一一一一一一一一一一一一一.exe (PID: 3096)

  • SUSPICIOUS

    • The process executes JS scripts

      • cmd.exe (PID: 1864)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • cscript.exe (PID: 1888)

    • Sets XML DOM element text (SCRIPT)

      • cscript.exe (PID: 1888)

    • Script creates XML DOM node (SCRIPT)

      • cscript.exe (PID: 1888)

    • Creates a Stream, which may work with files, input/output devices, pipes, or TCP/IP sockets (SCRIPT)

      • cscript.exe (PID: 1888)

    • Creates XML DOM element (SCRIPT)

      • cscript.exe (PID: 1888)

    • Creates a Folder object (SCRIPT)

      • cscript.exe (PID: 1888)

    • Saves data to a binary file (SCRIPT)

      • cscript.exe (PID: 1888)

    • Executable content was dropped or overwritten

      • cscript.exe (PID: 1888)
      • quantizer.exe (PID: 1500)

    • Reads the Internet Settings

      • cscript.exe (PID: 1888)
      • cmd.exe (PID: 1864)
      • MEMZ.exe (PID: 2096)
      • MEMZ.exe (PID: 3656)

    • Starts itself from another location

      • quantizer.exe (PID: 1500)

    • There is functionality for taking screenshot (YARA)

      • 一一一一一一一一一一一一一一一一.exe (PID: 3096)
      • MEMZ.exe (PID: 2096)
      • Phsyletric.exe (PID: 2416)
      • MEMZ.exe (PID: 3224)
      • MEMZ.exe (PID: 3636)
      • MEMZ.exe (PID: 3776)
      • MEMZ.exe (PID: 3000)
      • MEMZ.exe (PID: 3712)
      • MEMZ.exe (PID: 3656)

    • Application launched itself

      • MEMZ.exe (PID: 2096)

    • Creates file in the systems drive root

      • MEMZ.exe (PID: 3656)
      • notepad.exe (PID: 3136)

    • Reads security settings of Internet Explorer

      • MEMZ.exe (PID: 3656)
      • MEMZ.exe (PID: 2096)

    • Start notepad (likely ransomware note)

      • MEMZ.exe (PID: 3656)

    • Writes binary data to a Stream object (SCRIPT)

      • cscript.exe (PID: 1888)

  • INFO

    • Manual execution by a user

      • cmd.exe (PID: 1864)
      • Phsyletric.exe (PID: 1000)
      • Phsyletric.exe (PID: 2416)
      • quantizer.exe (PID: 2384)
      • quantizer.exe (PID: 1500)
      • msedge.exe (PID: 912)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2448)

    • Checks supported languages

      • Phsyletric.exe (PID: 2416)
      • quantizer.exe (PID: 1500)
      • MEMZ.exe (PID: 2096)
      • MEMZ.exe (PID: 3224)
      • MEMZ.exe (PID: 3636)
      • MEMZ.exe (PID: 3776)
      • MEMZ.exe (PID: 3712)
      • MEMZ.exe (PID: 3000)
      • 一一一一一一一一一一一一一一一一.exe (PID: 3096)
      • MEMZ.exe (PID: 3656)

    • Create files in a temporary directory

      • quantizer.exe (PID: 1500)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 1888)

    • Reads the computer name

      • Phsyletric.exe (PID: 2416)
      • MEMZ.exe (PID: 2096)
      • 一一一一一一一一一一一一一一一一.exe (PID: 3096)
      • MEMZ.exe (PID: 3656)

    • Creates files or folders in the user directory

      • cscript.exe (PID: 1888)

    • Reads the machine GUID from the registry

      • MEMZ.exe (PID: 3656)

    • Application launched itself

      • msedge.exe (PID: 912)
      • msedge.exe (PID: 3264)
      • msedge.exe (PID: 2984)
      • msedge.exe (PID: 1768)
      • msedge.exe (PID: 2328)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 45
ZipBitFlag: 0x0800
ZipCompression: Deflated
ZipModifyDate: 2025:05:27 23:54:38
ZipCRC: 0x00000000
ZipCompressedSize: 2
ZipUncompressedSize: -
ZipFileName: for testing/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
95
Monitored processes
54
Malicious processes
10
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe cmd.exe no specs phsyletric.exe no specs cscript.exe phsyletric.exe quantizer.exe no specs quantizer.exe memz.exe no specs 一一一一一一一一一一一一一一一一.exe no specs memz.exe no specs #MEMZ memz.exe #MEMZ memz.exe no specs #MEMZ memz.exe no specs #MEMZ memz.exe no specs #MEMZ memz.exe no specs #MEMZ memz.exe no specs #MEMZ memz.exe no specs notepad.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs notepad.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
184"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=3932 --field-trial-handle=1360,i,3594101637935057206,18080221346021653775,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
320"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3368 --field-trial-handle=1360,i,3594101637935057206,18080221346021653775,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
524"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2452 --field-trial-handle=1360,i,3594101637935057206,18080221346021653775,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
656"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2844 --field-trial-handle=1360,i,3594101637935057206,18080221346021653775,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
856"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=3880 --field-trial-handle=1360,i,3594101637935057206,18080221346021653775,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
912"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --enable-features=msMicrosoftRootStoreUsed --flag-switches-end --do-not-de-elevate http://google.co.ck/search?q=how+to+send+a+virus+to+my+friendC:\Program Files\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
944"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1292 --field-trial-handle=1360,i,3594101637935057206,18080221346021653775,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1000"C:\Users\admin\Desktop\for testing\Phsyletric.exe" C:\Users\admin\Desktop\for testing\Phsyletric.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\for testing\phsyletric.exe
c:\windows\system32\ntdll.dll
1156"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4352 --field-trial-handle=1360,i,3594101637935057206,18080221346021653775,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1396"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3440 --field-trial-handle=1360,i,3594101637935057206,18080221346021653775,131072 --enable-features=msMicrosoftRootStoreUsed /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
11 923
Read events
11 720
Write events
196
Delete events
7

Modification events

(PID) Process:(2448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2448) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\for testing.zip
(PID) Process:(2448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
4
Suspicious files
83
Text files
28
Unknown types
0

Dropped files

PID
Process
Filename
Type
2416Phsyletric.exe\Device\Harddisk0\DR0 —
MD5:—
SHA256:—
3656MEMZ.exe\Device\Harddisk0\DR0 —
MD5:—
SHA256:—
4068msedge.exe —
MD5:—
SHA256:—
1888cscript.exeC:\Users\admin\Desktop\for testing\z.zipcompressed
MD5:63EE4412B95D7AD64C54B4BA673470A7
SHA256:44C1857B1C4894B3DFBACCBE04905652E634283DCF6B06C25A74B17021E2A268
1888cscript.exeC:\Users\admin\AppData\Roaming\MEMZ.exeexecutable
MD5:19DBEC50735B5F2A72D4199C4E184960
SHA256:A3D5715A81F2FBEB5F76C88C9C21EEEE87142909716472F911FF6950C790C24D
1500quantizer.exeC:\Users\admin\AppData\Local\Temp\一一一一一一一一一一一一一一一一.exeexecutable
MD5:1458480CF8803569195F934D47AC7481
SHA256:68D528F9AC891E920449188198A233B71B2860838AF4FB970B9966F941CE82CA
912msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF194740.TMP —
MD5:—
SHA256:—
912msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
2768msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics.pmabinary
MD5:886E82F2CA62ECCCE64601B30592078A
SHA256:E5E13D53601100FF3D6BB71514CBCCC4C73FE9B7EF5E930100E644187B42948E
3264msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\04dc7e01-65e9-4b24-8899-da5b2559cb3e.tmpbinary
MD5:C9E658F26F61DE76F7919B6989856E61
SHA256:963304B258060C113A20DE4215BCDA53515CBF1710ED2B009FDBBB7B7EE2500D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
43
DNS requests
35
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3680
msedge.exe
GET
302
172.217.16.196:80
http://google.co.ck/search?q=dank+memz
unknown
—
—
whitelisted
3680
msedge.exe
GET
302
172.217.16.196:80
http://google.co.ck/search?q=how+to+send+a+virus+to+my+friend
unknown
—
—
whitelisted
3680
msedge.exe
GET
302
172.217.16.196:80
http://google.co.ck/search?q=my+computer+is+doing+weird+things+wtf+is+happenin+plz+halp
unknown
—
—
whitelisted
—
—
GET
302
172.217.16.196:80
http://google.co.ck/search?q=how+2+remove+a+virus
unknown
—
—
whitelisted
3680
msedge.exe
GET
302
172.217.16.196:80
http://google.co.ck/search?q=the+memz+are+real
unknown
—
—
whitelisted
3680
msedge.exe
GET
302
172.217.16.196:80
http://google.co.ck/search?q=my+computer+is+doing+weird+things+wtf+is+happenin+plz+halp
unknown
—
—
whitelisted
—
—
GET
302
172.217.16.196:80
http://google.co.ck/search?q=how+to+remove+memz+trojan+virus
unknown
—
—
whitelisted
—
—
GET
302
172.217.16.196:80
http://google.co.ck/search?q=how+to+create+your+own+ransomware
unknown
—
—
whitelisted
—
—
GET
302
172.217.16.196:80
http://google.co.ck/search?q=the+memz+are+real
unknown
—
—
whitelisted
—
—
GET
302
172.217.16.196:80
http://google.co.ck/search?q=facebook+hacking+tool+free+download+no+virus+working+2016
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3680
msedge.exe
150.171.27.11:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3680
msedge.exe
172.217.16.196:80
google.co.ck
GOOGLE
US
whitelisted
912
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
3680
msedge.exe
216.58.206.36:443
www.google.com
GOOGLE
US
whitelisted
3680
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3680
msedge.exe
2.16.204.141:443
www.bing.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.18.14
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 150.171.27.11
  • 150.171.28.11
whitelisted
google.co.ck
  • 172.217.16.196
whitelisted
www.google.com
  • 216.58.206.36
  • 216.58.212.132
whitelisted
www.bing.com
  • 2.16.204.141
  • 2.16.204.161
  • 2.16.241.218
  • 2.16.241.201
whitelisted
www.gstatic.com
  • 142.250.186.99
whitelisted
fonts.gstatic.com
  • 142.250.186.35
whitelisted
self.events.data.microsoft.com
  • 20.189.173.5
  • 20.42.72.131
whitelisted

Threats

No threats detected
Process
Message
msedge.exe
[0528/005840.950:ERROR:exception_handler_server.cc(527)] ConnectNamedPipe: The pipe is being closed. (0xE8)
msedge.exe
[0528/005857.037:ERROR:exception_handler_server.cc(527)] ConnectNamedPipe: The pipe is being closed. (0xE8)
msedge.exe
[0528/005912.291:ERROR:exception_handler_server.cc(527)] ConnectNamedPipe: The pipe is being closed. (0xE8)
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
for testing.zip