File name:

cinearchive.exe

Full analysis: https://app.any.run/tasks/2514f23b-ed3a-4e8a-a8a3-d9285a024b0d
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: March 01, 2026, 16:20:09
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
asyncrat
smb
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

09C1FF529EC6CD9FC7938748DB91DCAF

SHA1:

AA8DD0FCF0F70BD46A77A97B253E39F0156BEA87

SHA256:

EB8494F0A294566CA2FB0D19B4D46B70EEFBE8D96CA54C6B964D195E3523FA0E

SSDEEP:

1536:SSSTOn0PQCzQQSrKSM5MeGbb+wJnEtvzRWc0VclN:SSSTOsQCzQQSrmyeGbb+8nEtlmY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • cinearchive.exe (PID: 8344)

    • ASYNCRAT has been detected (YARA)

      • cinearchive.exe (PID: 8980)

  • SUSPICIOUS

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 5764)

    • Starts CMD.EXE for commands execution

      • cinearchive.exe (PID: 8344)

    • Executing commands from a ".bat" file

      • cinearchive.exe (PID: 8344)

    • Executable content was dropped or overwritten

      • cinearchive.exe (PID: 8344)

    • The executable file from the user directory is run by the CMD process

      • cinearchive.exe (PID: 3352)

    • Connects to SSH

      • cinearchive.exe (PID: 8980)

  • INFO

    • Reads the computer name

      • cinearchive.exe (PID: 8344)
      • cinearchive.exe (PID: 8980)
      • cinearchive.exe (PID: 3352)

    • Checks supported languages

      • cinearchive.exe (PID: 8344)
      • cinearchive.exe (PID: 8980)
      • cinearchive.exe (PID: 3352)

    • Manual execution by a user

      • cinearchive.exe (PID: 8980)

    • Creates files or folders in the user directory

      • cinearchive.exe (PID: 8344)

    • Launching a file from a Registry key

      • cinearchive.exe (PID: 8344)

    • Create files in a temporary directory

      • cinearchive.exe (PID: 8344)

    • Drops script file

      • cinearchive.exe (PID: 8344)
      • cmd.exe (PID: 5764)

    • Reads the machine GUID from the registry

      • cinearchive.exe (PID: 8344)
      • cinearchive.exe (PID: 8980)
      • cinearchive.exe (PID: 3352)

    • Attempt to connect to SMB server

      • cinearchive.exe (PID: 8980)

    • Checks proxy server information

      • slui.exe (PID: 4624)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AsyncRat

(PID) Process(8980) cinearchive.exe
C2 (3)deltasteel.za.com
malware.deltasteel.za.com
phishing.deltasteel.za.com
Ports (9)4872
3389
445
22
443
80
21
1604
200
Version1.0.7
Options
AutoRuntrue
MutexCineVault_FilmMutex_v3430
InstallFolder%AppData%
Certificates
Cert1MIICMDCCAZmgAwIBAgIVAMCkoZTZNI3ZZ34cnBMGc/s4e6Y5MA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTI1MDUxMDA3NDI1MFoXDTM2MDIxNzA3NDI1MFowEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0A...
Server_SignaturehD/etOx149zurn8IZgnZOZTHB5V2qNENgEtO7p1Af26v+eB+rk6Jg9/6I0FbF0iLkDY/eu0cyf4rvtdbrLm6SQ7uLzwMfoCTVaY+BH/yePJq/xfHa2vXfW/erX2TxVey5xsCjQ/3rFF1dhDMU5p+7NoqBllzT7KWzS0GyvH2074=
Keys
AES5e6569bc183a22ab63ce502deef19cbca41f5cdbfea7683326fd273355ec4889
SaltDcRatByqwqdanchun
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:01:12 03:47:42+00:00
ImageFileCharacteristics: Executable
PEType: PE32
LinkerVersion: 8
CodeSize: 60416
InitializedDataSize: 5632
UninitializedDataSize: -
EntryPoint: 0x10a6e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2026.99.8200.82
ProductVersionNumber: 2026.99.8200.82
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: CineVault Cinema Tech
FileDescription: Cinephile's private reel vault: encrypted movie collection catalog for posters, reviews & watch notes, scene screenshot & clip protection, watchlist & rating lockdown, anti-leak spoiler-free share controls with expiration, director & genre timeline secure storage, offline backup for your cinematic legacy, and cinematic AI that guards your film treasures from digital piracy or device wipe – preserve your screen stories, privately.
FileVersion: 2026.99.8200.82
InternalName: CineArchive
LegalCopyright: Copyright © 2026 CineVault Cinema Tech. All reels reserved.
LegalTrademarks: CineVault™, Film Archive™, VaultCine™ are registered trademarks of CineVault Cinema Tech.
OriginalFileName: CineArchive
ProductName: CineVault Film Archive
ProductVersion: 2026.99.8200.82
AssemblyVersion: 2026.99.8200.82
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
7
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start cinearchive.exe cmd.exe no specs conhost.exe no specs timeout.exe no specs #ASYNCRAT cinearchive.exe cinearchive.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
756timeout 3 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3352"C:\Users\admin\AppData\Roaming\cinearchive.exe" C:\Users\admin\AppData\Roaming\cinearchive.exe—cmd.exe
User:
admin
Company:
CineVault Cinema Tech
Integrity Level:
MEDIUM
Description:
Cinephile's private reel vault: encrypted movie collection catalog for posters, reviews & watch notes, scene screenshot & clip protection, watchlist & rating lockdown, anti-leak spoiler-free share co
Exit code:
0
Version:
2026.99.8200.82
Modules
Images
c:\users\admin\appdata\roaming\cinearchive.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4624C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4856\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5764C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\tmp67A1.tmp.bat""C:\Windows\System32\cmd.exe—cinearchive.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
8344"C:\Users\admin\Desktop\cinearchive.exe" C:\Users\admin\Desktop\cinearchive.exe
explorer.exe
User:
admin
Company:
CineVault Cinema Tech
Integrity Level:
MEDIUM
Description:
Cinephile's private reel vault: encrypted movie collection catalog for posters, reviews & watch notes, scene screenshot & clip protection, watchlist & rating lockdown, anti-leak spoiler-free share co
Exit code:
0
Version:
2026.99.8200.82
Modules
Images
c:\users\admin\desktop\cinearchive.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
8980"C:\Users\admin\AppData\Roaming\cinearchive.exe"C:\Users\admin\AppData\Roaming\cinearchive.exe
explorer.exe
User:
admin
Company:
CineVault Cinema Tech
Integrity Level:
MEDIUM
Description:
Cinephile's private reel vault: encrypted movie collection catalog for posters, reviews & watch notes, scene screenshot & clip protection, watchlist & rating lockdown, anti-leak spoiler-free share co
Version:
2026.99.8200.82
Modules
Images
c:\users\admin\appdata\roaming\cinearchive.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
AsyncRat
(PID) Process(8980) cinearchive.exe
C2 (3)deltasteel.za.com
malware.deltasteel.za.com
phishing.deltasteel.za.com
Ports (9)4872
3389
445
22
443
80
21
1604
200
Version1.0.7
Options
AutoRuntrue
MutexCineVault_FilmMutex_v3430
InstallFolder%AppData%
Certificates
Cert1MIICMDCCAZmgAwIBAgIVAMCkoZTZNI3ZZ34cnBMGc/s4e6Y5MA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTI1MDUxMDA3NDI1MFoXDTM2MDIxNzA3NDI1MFowEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0A...
Server_SignaturehD/etOx149zurn8IZgnZOZTHB5V2qNENgEtO7p1Af26v+eB+rk6Jg9/6I0FbF0iLkDY/eu0cyf4rvtdbrLm6SQ7uLzwMfoCTVaY+BH/yePJq/xfHa2vXfW/erX2TxVey5xsCjQ/3rFF1dhDMU5p+7NoqBllzT7KWzS0GyvH2074=
Keys
AES5e6569bc183a22ab63ce502deef19cbca41f5cdbfea7683326fd273355ec4889
SaltDcRatByqwqdanchun
Total events
4 337
Read events
4 336
Write events
1
Delete events
0

Modification events

(PID) Process:(8344) cinearchive.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:cinearchive
Value:
"C:\Users\admin\AppData\Roaming\cinearchive.exe"
Executable files
1
Suspicious files
0
Text files
0
Unknown types
1

Dropped files

PID
Process
Filename
Type
8344cinearchive.exeC:\Users\admin\AppData\Roaming\cinearchive.exeexecutable
MD5:09C1FF529EC6CD9FC7938748DB91DCAF
SHA256:EB8494F0A294566CA2FB0D19B4D46B70EEFBE8D96CA54C6B964D195E3523FA0E
8344cinearchive.exeC:\Users\admin\AppData\Local\Temp\tmp67A1.tmp.batbinary
MD5:4857C90E4B1DC5E00FD570C49D68A6D0
SHA256:7F7BD71A14C422FC6F566E89F56FB35989D8809E5928CBDE6EE3DD4710781CB6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
29
DNS requests
22
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5992
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
8568
RUXIMICS.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
6768
MoUsoCoreWorker.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
5992
svchost.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
6768
MoUsoCoreWorker.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
8568
RUXIMICS.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
—
—
POST
500
48.192.1.65:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
US
—
—
whitelisted
2976
slui.exe
POST
500
48.192.1.65:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
US
—
512 b
whitelisted
3292
svchost.exe
GET
200
23.216.77.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
NL
binary
824 b
whitelisted
—
—
POST
500
48.192.1.65:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
US
binary
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
5992
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
8568
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6768
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
5992
svchost.exe
23.216.77.6:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
6768
MoUsoCoreWorker.exe
23.216.77.6:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
8568
RUXIMICS.exe
23.216.77.6:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
5992
svchost.exe
23.52.181.212:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
6768
MoUsoCoreWorker.exe
23.52.181.212:80
www.microsoft.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
self.events.data.microsoft.com
  • 51.104.15.252
  • 52.178.17.233
whitelisted
google.com
  • 142.250.201.174
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
  • 23.216.77.42
  • 23.216.77.8
  • 23.216.77.36
whitelisted
www.microsoft.com
  • 23.52.181.212
whitelisted
malware.deltasteel.za.com
  • —
unknown
phishing.deltasteel.za.com
  • —
unknown
deltasteel.za.com
  • 104.26.7.211
  • 104.26.6.211
  • 172.67.73.55
unknown
activation-v2.sls.microsoft.com
  • 48.192.1.65
whitelisted

Threats

PID
Process
Class
Message
8980
cinearchive.exe
Not Suspicious Traffic
INFO [ANY.RUN] Possible SMB Connection Attempt
8980
cinearchive.exe
Not Suspicious Traffic
INFO [ANY.RUN] Possible SMB Connection Attempt
8980
cinearchive.exe
Not Suspicious Traffic
INFO [ANY.RUN] Possible SMB Connection Attempt
8980
cinearchive.exe
Not Suspicious Traffic
INFO [ANY.RUN] Possible SMB Connection Attempt
8980
cinearchive.exe
Not Suspicious Traffic
INFO [ANY.RUN] Possible SMB Connection Attempt
8980
cinearchive.exe
Not Suspicious Traffic
INFO [ANY.RUN] Possible SMB Connection Attempt
8980
cinearchive.exe
Not Suspicious Traffic
INFO [ANY.RUN] Possible SMB Connection Attempt
8980
cinearchive.exe
Not Suspicious Traffic
INFO [ANY.RUN] Possible SMB Connection Attempt
8980
cinearchive.exe
Not Suspicious Traffic
INFO [ANY.RUN] Possible SMB Connection Attempt
8980
cinearchive.exe
Not Suspicious Traffic
INFO [ANY.RUN] Possible SMB Connection Attempt
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
cinearchive.exe