File name:

161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.zip

Full analysis: https://app.any.run/tasks/8740ebc9-829c-493a-b33b-bea690c5c721
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: January 24, 2022, 15:41:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
ransomware
stop
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract
MD5:

C1ACB33E084DAF418279BAD5C383470B

SHA1:

BAA2F4F5B3655EF427BAA42D5F59E2511C05D1E7

SHA256:

E7314F5F29097BF5E3AC35220E15030FEF9E1DF53753D12352D8420D869725EF

SSDEEP:

12288:9kLHXjgM14/64hT/05NIVoclKU6OwaloRHoCyrrnN7C/s65/WUVVad8b:sjgSuYjIVocgR7gnN70ss//VaM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1004)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2928)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3696)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3832)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3340)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3872)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 560)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2948)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 508)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2148)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3632)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3132)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3420)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3172)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3752)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1152)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2132)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2672)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3264)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2648)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3396)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 612)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3432)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2252)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2168)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1424)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2232)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3152)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1592)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2328)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3456)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1748)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1696)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3304)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1388)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2896)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3680)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3972)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1552)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3016)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 600)

    • Changes settings of System certificates

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2928)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1424)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3340)

    • Changes the autorun value in the registry

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1424)

    • Loads the Task Scheduler COM API

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1424)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3340)

    • STOP was detected

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3340)

  • SUSPICIOUS

    • Checks supported languages

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1004)
      • WinRAR.exe (PID: 3004)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2928)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3696)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1424)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3832)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3340)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3872)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 560)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2948)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 508)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3132)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3632)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3172)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3420)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2148)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3396)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1152)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3752)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2672)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2648)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3264)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2132)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 612)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 3004)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1424)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3004)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1424)

    • Reads the computer name

      • WinRAR.exe (PID: 3004)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2928)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1424)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3340)

    • Application launched itself

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1004)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1424)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3832)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3696)

    • Adds / modifies Windows certificates

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2928)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1424)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3340)

    • Uses ICACLS.EXE to modify access control list

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1424)

  • INFO

    • Manual execution by user

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1004)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3696)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3872)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2948)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 560)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 508)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3632)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3132)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3420)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2148)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3172)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3396)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3264)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3752)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2672)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2132)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2648)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1152)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 612)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3432)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2252)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2168)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2232)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1696)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3152)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2328)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1592)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1748)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3456)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1552)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1388)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3304)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3680)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3972)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3016)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 600)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2896)

    • Reads settings of System Certificates

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2928)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1424)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3340)

    • Checks Windows Trust Settings

      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 2928)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 1424)
      • 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe (PID: 3340)

    • Checks supported languages

      • icacls.exe (PID: 2368)

    • Reads the computer name

      • icacls.exe (PID: 2368)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
ZipUncompressedSize: 808448
ZipCompressedSize: 716690
ZipCRC: 0xac31dfc4
ZipModifyDate: 2022:01:24 15:40:21
ZipCompression: Unknown (99)
ZipBitFlag: 0x0003
ZipRequiredVersion: 51
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
82
Monitored processes
43
Malicious processes
17
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start winrar.exe 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe icacls.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe #STOP 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs 161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
508"C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe" C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
560"C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe" C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
600"C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe" C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
612"C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe" C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1004"C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe" C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\rpcrt4.dll
1152"C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe" C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1388"C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe" C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
1424"C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe" C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\mpr.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wininet.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
1552"C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe" C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
1592"C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe" C:\Users\admin\Desktop\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Total events
11 854
Read events
11 674
Write events
170
Delete events
10

Modification events

(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3004) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.zip
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3004) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
2
Suspicious files
8
Text files
1
Unknown types
2

Dropped files

PID
Process
Filename
Type
3004WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3004.2710\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exeexecutable
MD5:—
SHA256:—
2928161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
2928161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dbinary
MD5:—
SHA256:—
2928161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dder
MD5:—
SHA256:—
1424161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\geo[1].jsonbinary
MD5:—
SHA256:—
2928161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Eder
MD5:—
SHA256:—
2928161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:—
SHA256:—
1424161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exeC:\Users\admin\AppData\Local\b1e4a996-45fb-43fd-902c-f7a858a62f41\161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exeexecutable
MD5:—
SHA256:—
2928161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
3340161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exeC:\Users\admin\AppData\Local\bowsakkdestx.txtbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
29
DNS requests
10
Threats
31

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2928
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
GET
200
104.18.30.182:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
—
—
HEAD
200
23.79.149.131:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=132875126920420000
US
—
—
whitelisted
2928
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?57dc01fc755c98fc
US
compressed
4.70 Kb
whitelisted
3340
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
GET
200
88.158.247.38:80
http://tzgl.org/fhsgtsspen6/get.php?pid=6E3AAB7CB29BC9495DFDE01272C66F39&first=true
RO
binary
559 b
malicious
2928
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
GET
200
104.18.30.182:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
3340
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
GET
404
88.158.247.38:80
http://tzgl.org/files/1/build3.exe
RO
html
216 b
malicious
—
—
GET
200
23.79.149.131:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=132875126920420000
US
compressed
78.4 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2928
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
77.123.139.190:443
api.2ip.ua
Volia
UA
suspicious
2928
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
209.197.3.8:80
ctldl.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
2928
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
104.18.30.182:80
ocsp.comodoca.com
Cloudflare Inc
US
suspicious
1424
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
77.123.139.190:443
api.2ip.ua
Volia
UA
suspicious
3340
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
77.123.139.190:443
api.2ip.ua
Volia
UA
suspicious
—
—
77.123.139.190:443
api.2ip.ua
Volia
UA
suspicious
—
—
23.79.149.131:80
query.prod.cms.rt.microsoft.com
Akamai International B.V.
US
unknown
3340
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
88.158.247.38:80
tzgl.org
S.N. Radiocomunicatii S.A.
RO
malicious

DNS requests

Domain
IP
Reputation
api.2ip.ua
  • 77.123.139.190
shared
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
ocsp.comodoca.com
  • 104.18.30.182
  • 104.18.31.182
whitelisted
ocsp.usertrust.com
  • 104.18.30.182
  • 104.18.31.182
whitelisted
kotob.top
  • —
malicious
tzgl.org
  • 88.158.247.38
  • 183.78.205.92
  • 211.171.233.126
  • 61.98.7.132
  • 210.182.29.70
  • 189.129.113.216
  • 109.102.255.230
  • 151.251.30.69
  • 187.212.179.214
  • 186.7.139.88
malicious
query.prod.cms.rt.microsoft.com
  • 23.79.149.131
whitelisted

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
ET POLICY External IP Address Lookup DNS Query (2ip .ua)
2928
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
Potentially Bad Traffic
ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)
1424
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
Potentially Bad Traffic
ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)
3340
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
Potentially Bad Traffic
ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)
—
—
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
3340
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer)
3340
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
A Network Trojan was detected
ET TROJAN Potential Dridex.Maldoc Minimal Executable Request
3340
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer)
—
—
Potentially Bad Traffic
ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)
—
—
Potentially Bad Traffic
ET INFO Observed External IP Lookup Domain (api .2ip .ua in TLS SNI)
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
161548b327b0ab4197a1f1b0d3bc8668beadbbbdbb05a92d25478f4358733c34.zip