File name:

AntiZapret-main.zip

Full analysis: https://app.any.run/tasks/ce4c8edd-e48e-4b1e-9dfe-ebb37168635a
Verdict: Malicious activity
Analysis date: June 03, 2025, 07:20:02
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
windivert-sys
mal-driver
arch-exec
arch-doc
upx
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

98DFF4C351D71ED6F61C220435EDAE87

SHA1:

A3D895FB8D51BC6A792B7509E695292B539E6ED7

SHA256:

E4796F39ACD77E0CB3FE79F24D2AE6C599571FE9EBCBC1378B1427EAB06C0273

SSDEEP:

98304:KsqAZEcMug/1wWNWBKKBgD9fZ+WSMIEZBh4zXBNEmIfC81YudWUCeQ4Sm/7yc8Cp:yGvGV6g

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Malicious driver has been detected

      • WinRAR.exe (PID: 7724)

    • Detects Cygwin installation

      • WinRAR.exe (PID: 7724)

    • Starts NET.EXE for service management

      • cmd.exe (PID: 6132)
      • net.exe (PID: 7788)

  • SUSPICIOUS

    • Drops a system driver (possible attempt to evade defenses)

      • WinRAR.exe (PID: 7724)

    • Stops a currently running service

      • sc.exe (PID: 7348)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 6132)

    • Windows service management via SC.EXE

      • sc.exe (PID: 7268)
      • sc.exe (PID: 8172)

  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 7724)

    • Checks supported languages

      • winws.exe (PID: 3996)
      • winws.exe (PID: 6496)

    • Reads the computer name

      • winws.exe (PID: 3996)
      • winws.exe (PID: 6496)

    • Manual execution by a user

      • cmd.exe (PID: 4120)
      • cmd.exe (PID: 6132)
      • WINWORD.EXE (PID: 7832)
      • cmd.exe (PID: 4776)
      • cmd.exe (PID: 6028)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7724)

    • UPX packer has been detected

      • winws.exe (PID: 3996)
      • winws.exe (PID: 6496)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2025:02:10 10:48:38
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: AntiZapret-main/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
160
Monitored processes
28
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT winrar.exe sppextcomobj.exe no specs slui.exe rundll32.exe no specs cmd.exe conhost.exe no specs winws.exe no specs conhost.exe no specs slui.exe cmd.exe no specs conhost.exe no specs net.exe no specs net1.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs winword.exe ai.exe no specs cmd.exe no specs conhost.exe no specs winws.exe no specs winws.exe no specs winws.exe conhost.exe no specs cmd.exe conhost.exe no specs winws.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
672C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
680"C:\Users\admin\Desktop\AntiZapret-main\winws.exe" --wf-tcp=80,443 --wf-udp=443,50000-50100 --filter-udp=443 --hostlist="C:\Users\admin\Desktop\AntiZapret-main\list-extended.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-fake-quic="C:\Users\admin\Desktop\AntiZapret-main\quic_initial_www_google_com.bin" --new --filter-udp=50000-50100 --ipset="C:\Users\admin\Desktop\AntiZapret-main\ipset-discord.txt" --dpi-desync=fake --dpi-desync-any-protocol --dpi-desync-cutoff=d3 --dpi-desync-repeats=8 --new --filter-tcp=80 --hostlist="C:\Users\admin\Desktop\AntiZapret-main\list-extended.txt" --dpi-desync=fake,split2 --dpi-desync-autottl=5 --dpi-desync-fooling=md5sig --new --filter-tcp=443 --hostlist="C:\Users\admin\Desktop\AntiZapret-main\list-extended.txt" --dpi-desync=fake,split --dpi-desync-autottl=5 --dpi-desync-repeats=10 --dpi-desync-fooling=badseq --dpi-desync-fake-tls="C:\Users\admin\Desktop\AntiZapret-main\tls_clienthello_www_google_com.bin"C:\Users\admin\Desktop\AntiZapret-main\winws.exe—cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\antizapret-main\winws.exe
c:\windows\system32\ntdll.dll
2416\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3996"C:\Users\admin\Desktop\AntiZapret-main\winws.exe" --wf-tcp=80,443 --wf-udp=443,50000-50100 --filter-udp=443 --hostlist="C:\Users\admin\Desktop\AntiZapret-main\list-general.txt" --dpi-desync=fake --dpi-desync-repeats=10 --dpi-desync-fake-quic="C:\Users\admin\Desktop\AntiZapret-main\quic_initial_www_google_com.bin" --new --filter-udp=50000-50100 --ipset="C:\Users\admin\Desktop\AntiZapret-main\ipset-discord.txt" --dpi-desync=fake --dpi-desync-any-protocol --dpi-desync-cutoff=d3 --dpi-desync-repeats=8 --new --filter-tcp=80 --hostlist="C:\Users\admin\Desktop\AntiZapret-main\list-general.txt" --dpi-desync=fake,split2 --dpi-desync-autottl=5 --dpi-desync-fooling=md5sig --new --filter-tcp=443 --hostlist="C:\Users\admin\Desktop\AntiZapret-main\list-general.txt" --dpi-desync=fake,split --dpi-desync-autottl=5 --dpi-desync-repeats=10 --dpi-desync-fooling=badseq --dpi-desync-fake-tls="C:\Users\admin\Desktop\AntiZapret-main\tls_clienthello_www_google_com.bin"C:\Users\admin\Desktop\AntiZapret-main\winws.exe—cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225786
Modules
Images
c:\users\admin\desktop\antizapret-main\winws.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\users\admin\desktop\antizapret-main\cygwin1.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4120"C:\WINDOWS\System32\cmd.exe" /C "C:\Users\admin\Desktop\AntiZapret-main\1_antizapret_general_v3.cmd" C:\Windows\System32\cmd.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
4380\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—winws.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4452\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—winws.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4776C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\Desktop\AntiZapret-main\1_antizapret_extended_v3.cmd" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
5556"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6028"C:\WINDOWS\System32\cmd.exe" /C "C:\Users\admin\Desktop\AntiZapret-main\1_antizapret_extended_v3.cmd" C:\Windows\System32\cmd.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
Total events
7 157
Read events
7 040
Write events
96
Delete events
21

Modification events

(PID) Process:(7724) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7724) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7724) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7724) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\AntiZapret-main.zip
(PID) Process:(7724) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7724) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7724) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7724) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7724) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
(PID) Process:(7724) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:size
Value:
80
Executable files
9
Suspicious files
15
Text files
28
Unknown types
0

Dropped files

PID
Process
Filename
Type
7724WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7724.2688\AntiZapret-main\1_antizapret_general_v3.cmdtext
MD5:19416A00660900ACA12B8DEAF1B66F41
SHA256:C6606B404AFD0757F5DBE608D6360D2B112D3DA4765B1D6435D69FED01EBC163
7724WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7724.2688\AntiZapret-main\2_service_antizapret_extended_install_v1.cmdtext
MD5:900BAADE2CAD19083A26C3E779199056
SHA256:A2BDB532204E4AF6C85E2F4F7F6BABB5BE58C3B98F04D01CCE634DBC0BD64CC2
7724WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7724.2688\AntiZapret-main\1_antizapret_general_v1.cmdtext
MD5:203FA7F9D29D4A449DA5B9FB2B10D6B5
SHA256:B28F48DD979880BCE13B185958F692627C1FB8954FF3632D1DBEB1C3ADAF6D5D
7724WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7724.2688\AntiZapret-main\1_antizapret_extended_v3.cmdtext
MD5:D96419CA91F0EDA57DCD00FEB26C4AC3
SHA256:C881518C088B025480B84E07F3F98640C0D4E8647153EF17E29698A88459BA87
7724WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7724.2688\AntiZapret-main\1_discord_v2.cmdtext
MD5:F6A293DA029D3A476AB980EB4A7C47B5
SHA256:A44441112F95BC822916890955618233FE337C31BA8946978D5A5B7D936D888B
7724WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7724.2688\AntiZapret-main\1_discord_v1.cmdtext
MD5:F4608E6FFD109439DECE098956F3A691
SHA256:87F5BF5D9F410FDB470800DC054120CF76ECB519C793AAE9AD72D406CE4E6AF6
7724WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7724.2688\AntiZapret-main\1_antizapret_extended_v2.cmdtext
MD5:398F38DD1CF7DA7D796492E2F81898A4
SHA256:4B467D1FD0B1C2DAC0DB2990D3F7AC2EABE23908B2DB68E78301C589EF573BA9
7724WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7724.2688\AntiZapret-main\2_service_discord_install_v3.cmdtext
MD5:158F0D873354CB439C006E7137AC75EC
SHA256:0FF4E3DA1A1F96C989AE1EE2B5D39BD18CD65FF94C638EAF70206A06BE09497D
7724WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7724.2688\AntiZapret-main\2_service_antizapret_general_install_v3.cmdtext
MD5:5CA7FF45764EDC7863F133063FD019DC
SHA256:84F34193AE00016DDBC8B25E18617004738AF6F10C8FA37134A0EA3832899258
7724WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa7724.2688\AntiZapret-main\2_service_goodbye_discord_install_v2.cmdtext
MD5:F0E39B6BDC4AFB71F8179DBE29073A67
SHA256:FABC0AA3DABFD39F5D06B641AAAB7121B0EBC164B6844E5D1F68AB4D9EF2FF18
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
18
DNS requests
11
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7600
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7332
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7600
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7600
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5556
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.46
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
  • 51.124.78.146
  • 20.73.194.208
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
officeclient.microsoft.com
  • 52.109.32.97
whitelisted
self.events.data.microsoft.com
  • 20.189.173.10
  • 104.208.16.95
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AntiZapret-main.zip