File name:

ZFLIX By YashvirGaming#0388.rar

Full analysis: https://app.any.run/tasks/e4867f1f-b196-455c-8b97-782becfe6396
Verdict: Malicious activity
Analysis date: June 25, 2023, 16:06:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

D36F90AB848E3D73FDEB4EDE7EF4327A

SHA1:

FA3184587B9F14B6329640BF3859A7786234F399

SHA256:

ED8C0ABDE8977B3DC190084EA0D1411387C105460620DD91C8B38A88F898F889

SSDEEP:

196608:ZhkYmPhCIUJFGgYEHY9gL3BE00NQBXNJRH:RmxU9YEHsgoOlRH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • ZFLIX By YashvirGaming#0388.exe (PID: 3764)
      • ZFLIX By YashvirGaming#0388.exe (PID: 2536)
      • ZFLIX By YashvirGaming#0388.exe (PID: 3912)

    • Loads dropped or rewritten executable

      • ZFLIX By YashvirGaming#0388.exe (PID: 3912)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Loads dropped or rewritten executable

      • ZFLIX By YashvirGaming#0388.exe (PID: 3764)

    • Reads the computer name

      • ZFLIX By YashvirGaming#0388.exe (PID: 3764)
      • ZFLIX By YashvirGaming#0388.exe (PID: 2536)
      • ZFLIX By YashvirGaming#0388.exe (PID: 3912)

    • Checks supported languages

      • ZFLIX By YashvirGaming#0388.exe (PID: 3764)
      • ZFLIX By YashvirGaming#0388.exe (PID: 3912)
      • ZFLIX By YashvirGaming#0388.exe (PID: 2536)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3532)
      • WinRAR.exe (PID: 3212)

    • The process checks LSA protection

      • ZFLIX By YashvirGaming#0388.exe (PID: 3764)
      • explorer.exe (PID: 1824)
      • SearchProtocolHost.exe (PID: 3104)
      • ZFLIX By YashvirGaming#0388.exe (PID: 3912)

    • Manual execution by a user

      • ZFLIX By YashvirGaming#0388.exe (PID: 2536)
      • explorer.exe (PID: 1824)
      • ZFLIX By YashvirGaming#0388.exe (PID: 3912)
      • WinRAR.exe (PID: 3212)

    • Reads the machine GUID from the registry

      • ZFLIX By YashvirGaming#0388.exe (PID: 3764)
      • ZFLIX By YashvirGaming#0388.exe (PID: 3912)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
54
Monitored processes
7
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start winrar.exe zflix by yashvirgaming#0388.exe explorer.exe no specs zflix by yashvirgaming#0388.exe searchprotocolhost.exe no specs winrar.exe zflix by yashvirgaming#0388.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1824"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2536"C:\ZFLIX By YashvirGaming#0388\ZFLIX By YashvirGaming#0388.exe" C:\ZFLIX By YashvirGaming#0388\ZFLIX By YashvirGaming#0388.exe
explorer.exe
User:
admin
Company:
YashvirGaming#0388
Integrity Level:
MEDIUM
Description:
Netflix ios Api
Exit code:
3762504530
Version:
1.1.5.0
Modules
Images
c:\zflix by yashvirgaming#0388\zflix by yashvirgaming#0388.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3104"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3212"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\AppData\Local\Temp\ZFLIX By YashvirGaming#0388.rar" "C:\Users\admin\AppData\Local\Temp\ZFLIX By YashvirGaming#0388\"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\winrar\winrar.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
3532"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\ZFLIX By YashvirGaming#0388.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\comdlg32.dll
3764"C:\Users\admin\AppData\Local\Temp\Rar$EXa3532.19543\ZFLIX By YashvirGaming#0388\ZFLIX By YashvirGaming#0388.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3532.19543\ZFLIX By YashvirGaming#0388\ZFLIX By YashvirGaming#0388.exe
WinRAR.exe
User:
admin
Company:
YashvirGaming#0388
Integrity Level:
MEDIUM
Description:
Netflix ios Api
Exit code:
3762504530
Version:
1.1.5.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3532.19543\zflix by yashvirgaming#0388\zflix by yashvirgaming#0388.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3912"C:\Users\admin\AppData\Local\Temp\ZFLIX By YashvirGaming#0388\ZFLIX By YashvirGaming#0388\ZFLIX By YashvirGaming#0388.exe" C:\Users\admin\AppData\Local\Temp\ZFLIX By YashvirGaming#0388\ZFLIX By YashvirGaming#0388\ZFLIX By YashvirGaming#0388.exe—explorer.exe
User:
admin
Company:
YashvirGaming#0388
Integrity Level:
MEDIUM
Description:
Netflix ios Api
Exit code:
0
Version:
1.1.5.0
Modules
Images
c:\users\admin\appdata\local\temp\zflix by yashvirgaming#0388\zflix by yashvirgaming#0388\zflix by yashvirgaming#0388.exe
c:\windows\system32\mscoree.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
8 689
Read events
8 520
Write events
168
Delete events
1

Modification events

(PID) Process:(3532) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3532) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3532) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3532) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3532) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3532) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3532) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3532) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3532) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3532) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
16
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3532WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3532.19543\ZFLIX By YashvirGaming#0388\500K+ MAILPASS MIXED COMBO.txt —
MD5:—
SHA256:—
3532WinRAR.exeC:\Users\admin\Desktop\grgs\500K+ MAILPASS MIXED COMBO.txt —
MD5:—
SHA256:—
3212WinRAR.exeC:\Users\admin\AppData\Local\Temp\ZFLIX By YashvirGaming#0388\ZFLIX By YashvirGaming#0388\500K+ MAILPASS MIXED COMBO.txt —
MD5:—
SHA256:—
3532WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3532.19543\ZFLIX By YashvirGaming#0388\CheckerBasics.dllexecutable
MD5:8E3CD46A43352A4B9DB1BAE60A500D7E
SHA256:4F13F13ADCDD5EDFDFB45E85D90E34C13F93ABC5A2B18EEE1AC673AACD45B3DB
3532WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3532.19543\ZFLIX By YashvirGaming#0388\ZFLIX By YashvirGaming#0388.exeexecutable
MD5:EAB2B149374A25389D051572CE08148E
SHA256:1AAA118136C83399FAEB40D3B9E9D443CD3B347A241215DFB03FAAD336FBEDA1
3532WinRAR.exeC:\Users\admin\Desktop\grgs\Newtonsoft.Json.dllexecutable
MD5:6815034209687816D8CF401877EC8133
SHA256:7F912B28A07C226E0BE3ACFB2F57F050538ABA0100FA1F0BF2C39F1A1F1DA814
3212WinRAR.exeC:\Users\admin\AppData\Local\Temp\ZFLIX By YashvirGaming#0388\ZFLIX By YashvirGaming#0388\Newtonsoft.Json.dllexecutable
MD5:6815034209687816D8CF401877EC8133
SHA256:7F912B28A07C226E0BE3ACFB2F57F050538ABA0100FA1F0BF2C39F1A1F1DA814
3212WinRAR.exeC:\Users\admin\AppData\Local\Temp\ZFLIX By YashvirGaming#0388\ZFLIX By YashvirGaming#0388\Leaf.xNet.dllexecutable
MD5:C56DE89F88B5E8203A637FC0CC1FA0DB
SHA256:5F4938C1140BE5E19F0BFD0FE9838DCCF8554DB781C56482660AA7DC751FB4BB
3532WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3532.19543\ZFLIX By YashvirGaming#0388\Leaf.xNet.dllexecutable
MD5:C56DE89F88B5E8203A637FC0CC1FA0DB
SHA256:5F4938C1140BE5E19F0BFD0FE9838DCCF8554DB781C56482660AA7DC751FB4BB
3532WinRAR.exeC:\Users\admin\Desktop\grgs\Colorful.Console.dllexecutable
MD5:5F3D2CFBC21591B8FEEF1EFA3E59A4D0
SHA256:F31D4FD7E729FC6CF4ECAB972B6B1EE897918A325B1CA572030966F831E768FB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1008
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1076
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ZFLIX By YashvirGaming#0388.rar