File name:

SamplePEC2.zip

Full analysis: https://app.any.run/tasks/71e3c76c-a789-49c4-9417-38e5569beee9
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 04, 2025, 04:23:25
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
loader
opendir
evasion
lumma
stealer
winscp
tool
tas17
hausbomber
netreactor
systembc
proxyware
themida
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

80EFFAD0D13E9E8030FE4C4910E39D86

SHA1:

7363F3E6C419E3D1ADFE35C8A964EDCEC70CE86A

SHA256:

EF9EA600B37205B89471CA612FF435C2095E76E5E36A5CF46175EF3DD8A264C4

SSDEEP:

6144:xWPAOUq9pmQ02sGO7wp9CaRcqWXQF+wKt7zvyG4v:xORpmQ02sbE9iqWg0wGyVv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • HAUSBOMBER has been detected (YARA)

      • New Text Document.exe (PID: 7652)

    • Executing a file with an untrusted certificate

      • reCAPTCHA.exe (PID: 6392)
      • netdriver.exe (PID: 5452)
      • winnet.exe (PID: 7408)
      • rundrive.exe (PID: 4620)
      • winnet.exe (PID: 4304)
      • oioq.exe (PID: 5204)
      • rundrive.exe (PID: 1452)
      • oioq.exe (PID: 7528)
      • reCAPTCHA.exe (PID: 1012)

    • Connects to the CnC server

      • svchost.exe (PID: 2196)

    • LUMMA has been detected (SURICATA)

      • 1337X-1.exe (PID: 4212)
      • TORRENTOLD-1.exe (PID: 5528)
      • svchost.exe (PID: 2196)

    • LUMMA mutex has been found

      • 1337X-1.exe (PID: 4212)
      • TORRENTOLD-1.exe (PID: 5528)

    • Actions looks like stealing of personal data

      • TORRENTOLD-1.exe (PID: 5528)
      • 1337X-1.exe (PID: 4212)

    • Steals credentials from Web Browsers

      • TORRENTOLD-1.exe (PID: 5528)
      • 1337X-1.exe (PID: 4212)

    • TAS17 has been detected

      • netdriver.exe (PID: 5452)
      • winnet.exe (PID: 7408)
      • rundrive.exe (PID: 4620)
      • winnet.exe (PID: 4304)
      • rundrive.exe (PID: 1452)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6384)
      • powershell.exe (PID: 5304)
      • powershell.exe (PID: 6516)
      • powershell.exe (PID: 4172)
      • powershell.exe (PID: 5972)
      • powershell.exe (PID: 7152)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6384)
      • powershell.exe (PID: 5304)
      • powershell.exe (PID: 6516)
      • powershell.exe (PID: 4172)
      • powershell.exe (PID: 5972)
      • powershell.exe (PID: 7152)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 5964)
      • cmd.exe (PID: 7580)
      • cmd.exe (PID: 6032)
      • cmd.exe (PID: 8016)
      • cmd.exe (PID: 7248)
      • cmd.exe (PID: 8168)

    • Request from PowerShell which ran from CMD.EXE

      • powershell.exe (PID: 6384)
      • powershell.exe (PID: 5304)
      • powershell.exe (PID: 6516)
      • powershell.exe (PID: 4172)
      • powershell.exe (PID: 7152)
      • powershell.exe (PID: 5972)

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 6384)
      • powershell.exe (PID: 5304)
      • powershell.exe (PID: 6516)
      • powershell.exe (PID: 4172)
      • powershell.exe (PID: 5972)
      • powershell.exe (PID: 7152)

    • Dynamically loads an assembly (POWERSHELL)

      • powershell.exe (PID: 6384)
      • powershell.exe (PID: 6516)
      • powershell.exe (PID: 5304)
      • powershell.exe (PID: 4172)
      • powershell.exe (PID: 7152)
      • powershell.exe (PID: 5972)

    • LUMMA has been detected (YARA)

      • TORRENTOLD-1.exe (PID: 5528)
      • 1337X-1.exe (PID: 4212)

    • SYSTEMBC mutex has been found

      • oioq.exe (PID: 7528)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • New Text Document.bin.exe (PID: 5344)

    • There is functionality for taking screenshot (YARA)

      • New Text Document.bin.exe (PID: 5344)
      • TORRENTOLD-1.exe (PID: 5528)
      • 1337X-1.exe (PID: 4212)

    • Reads security settings of Internet Explorer

      • New Text Document.bin.exe (PID: 5344)
      • New Text Document.exe (PID: 7652)
      • reCAPTCHA.exe (PID: 6392)
      • reCAPTCHA.exe (PID: 1012)

    • Reads Internet Explorer settings

      • New Text Document.bin.exe (PID: 5344)

    • Executable content was dropped or overwritten

      • New Text Document.bin.exe (PID: 5344)
      • New Text Document.exe (PID: 7652)
      • netdriver.exe (PID: 5452)

    • Process requests binary or script from the Internet

      • New Text Document.exe (PID: 7652)
      • powershell.exe (PID: 6384)
      • powershell.exe (PID: 5304)
      • powershell.exe (PID: 4172)
      • powershell.exe (PID: 6516)
      • powershell.exe (PID: 7152)
      • powershell.exe (PID: 5972)

    • Connects to the server without a host name

      • New Text Document.exe (PID: 7652)
      • powershell.exe (PID: 6384)
      • powershell.exe (PID: 5304)
      • powershell.exe (PID: 6516)
      • powershell.exe (PID: 4172)
      • powershell.exe (PID: 5972)
      • powershell.exe (PID: 7152)

    • Reads the date of Windows installation

      • New Text Document.exe (PID: 7652)

    • Potential Corporate Privacy Violation

      • New Text Document.exe (PID: 7652)
      • powershell.exe (PID: 5304)
      • powershell.exe (PID: 6516)
      • powershell.exe (PID: 4172)
      • powershell.exe (PID: 5972)
      • powershell.exe (PID: 7152)

    • Start notepad (likely ransomware note)

      • reCAPTCHA.exe (PID: 6392)
      • reCAPTCHA.exe (PID: 1012)

    • Checks for external IP

      • curl.exe (PID: 2392)
      • curl.exe (PID: 1244)

    • WINSCP has been detected

      • netdriver.exe (PID: 5452)

    • Connects to unusual port

      • reCAPTCHA.exe (PID: 6392)
      • service.exe (PID: 7732)
      • InstallUtil.exe (PID: 8152)
      • service.exe (PID: 7212)
      • service.exe (PID: 2268)
      • oioq.exe (PID: 7528)
      • reCAPTCHA.exe (PID: 1012)

    • Application launched itself

      • 1337X-1.exe (PID: 4008)
      • TORRENTOLD-1.exe (PID: 3968)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2196)
      • 1337X-1.exe (PID: 4212)
      • TORRENTOLD-1.exe (PID: 5528)

    • Reads the BIOS version

      • netdriver.exe (PID: 5452)
      • winnet.exe (PID: 7408)
      • rundrive.exe (PID: 4620)
      • winnet.exe (PID: 4304)
      • oioq.exe (PID: 5204)
      • rundrive.exe (PID: 1452)
      • oioq.exe (PID: 7528)

    • Executes application which crashes

      • TORRENTOLD-1.exe (PID: 3968)
      • 1337X-1.exe (PID: 4008)
      • reCAPTCHA.exe (PID: 6392)

    • Starts a Microsoft application from unusual location

      • kinddevelopers.exe (PID: 7988)
      • rocktrainingss.exe (PID: 720)
      • tg01985462ss.exe (PID: 7196)
      • tg01985462s.exe (PID: 7612)
      • kinddevelopers.exe (PID: 728)
      • kinddevelopers.exe (PID: 6676)

    • Process drops legitimate windows executable

      • New Text Document.exe (PID: 7652)

    • Executing commands from a ".bat" file

      • kinddevelopers.exe (PID: 7988)
      • rocktrainingss.exe (PID: 720)
      • tg01985462s.exe (PID: 7612)
      • tg01985462ss.exe (PID: 7196)
      • kinddevelopers.exe (PID: 728)
      • kinddevelopers.exe (PID: 6676)

    • Starts CMD.EXE for commands execution

      • kinddevelopers.exe (PID: 7988)
      • rocktrainingss.exe (PID: 720)
      • tg01985462s.exe (PID: 7612)
      • tg01985462ss.exe (PID: 7196)
      • kinddevelopers.exe (PID: 728)
      • kinddevelopers.exe (PID: 6676)

    • Possibly malicious use of IEX has been detected

      • cmd.exe (PID: 5964)
      • cmd.exe (PID: 7580)
      • cmd.exe (PID: 6032)
      • cmd.exe (PID: 8016)
      • cmd.exe (PID: 7248)
      • cmd.exe (PID: 8168)

    • Executes script without checking the security policy

      • powershell.exe (PID: 6384)
      • powershell.exe (PID: 5304)
      • powershell.exe (PID: 6516)
      • powershell.exe (PID: 4172)
      • powershell.exe (PID: 5972)
      • powershell.exe (PID: 7152)

    • Searches for installed software

      • TORRENTOLD-1.exe (PID: 5528)
      • 1337X-1.exe (PID: 4212)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 5964)
      • cmd.exe (PID: 7580)
      • cmd.exe (PID: 6032)
      • cmd.exe (PID: 8016)
      • cmd.exe (PID: 7248)
      • cmd.exe (PID: 8168)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 5964)
      • cmd.exe (PID: 7580)
      • cmd.exe (PID: 6032)
      • cmd.exe (PID: 8016)
      • cmd.exe (PID: 7248)
      • cmd.exe (PID: 8168)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 6384)
      • powershell.exe (PID: 5304)
      • powershell.exe (PID: 6516)
      • powershell.exe (PID: 4172)
      • powershell.exe (PID: 5972)
      • powershell.exe (PID: 7152)

    • The process executes via Task Scheduler

      • oioq.exe (PID: 5204)
      • oioq.exe (PID: 7528)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1912)

    • Manual execution by a user

      • WinRAR.exe (PID: 1912)
      • New Text Document.bin.exe (PID: 5344)
      • New Text Document.exe (PID: 7652)
      • InstallUtil.exe (PID: 8152)
      • winnet.exe (PID: 4304)
      • rundrive.exe (PID: 1452)
      • service.exe (PID: 2268)
      • service.exe (PID: 7212)
      • Taskmgr.exe (PID: 6036)
      • Taskmgr.exe (PID: 7968)
      • alreadyorganization.exe (PID: 856)
      • alreadyorganization.exe (PID: 2236)
      • InstallUtil.exe (PID: 4976)
      • InstallUtil.exe (PID: 920)
      • kinddevelopers.exe (PID: 728)
      • kinddevelopers.exe (PID: 6676)
      • fscan.exe (PID: 7436)
      • reCAPTCHA.exe (PID: 1012)

    • Checks supported languages

      • New Text Document.bin.exe (PID: 5344)
      • New Text Document.exe (PID: 7652)
      • fscan.exe (PID: 7020)
      • helper.exe (PID: 7508)
      • reCAPTCHA.exe (PID: 6392)
      • curl.exe (PID: 2392)
      • 1337X-1.exe (PID: 4008)
      • TORRENTOLD-1.exe (PID: 3968)
      • 1337X-1.exe (PID: 4212)
      • TORRENTOLD-1.exe (PID: 5528)
      • netdriver.exe (PID: 5452)
      • winnet.exe (PID: 7408)
      • rundrive.exe (PID: 4620)
      • service.exe (PID: 7732)
      • kinddevelopers.exe (PID: 7988)
      • alreadyorganization.exe (PID: 6148)
      • InstallUtil.exe (PID: 8152)
      • rocktrainingss.exe (PID: 720)
      • tg01985462ss.exe (PID: 7196)
      • rocktraining.exe (PID: 736)
      • tg01985462s.exe (PID: 7612)
      • winnet.exe (PID: 4304)
      • oioq.exe (PID: 5204)
      • rundrive.exe (PID: 1452)
      • service.exe (PID: 2268)
      • service.exe (PID: 7212)
      • alreadyorganization.exe (PID: 856)
      • InstallUtil.exe (PID: 4976)
      • oioq.exe (PID: 7528)
      • InstallUtil.exe (PID: 920)
      • alreadyorganization.exe (PID: 2236)
      • fscan.exe (PID: 7436)
      • kinddevelopers.exe (PID: 728)
      • kinddevelopers.exe (PID: 6676)
      • reCAPTCHA.exe (PID: 1012)
      • curl.exe (PID: 1244)

    • Reads the computer name

      • New Text Document.bin.exe (PID: 5344)
      • New Text Document.exe (PID: 7652)
      • curl.exe (PID: 2392)
      • reCAPTCHA.exe (PID: 6392)
      • 1337X-1.exe (PID: 4008)
      • TORRENTOLD-1.exe (PID: 3968)
      • 1337X-1.exe (PID: 4212)
      • TORRENTOLD-1.exe (PID: 5528)
      • netdriver.exe (PID: 5452)
      • winnet.exe (PID: 7408)
      • rundrive.exe (PID: 4620)
      • alreadyorganization.exe (PID: 6148)
      • InstallUtil.exe (PID: 8152)
      • rocktraining.exe (PID: 736)
      • winnet.exe (PID: 4304)
      • oioq.exe (PID: 5204)
      • rundrive.exe (PID: 1452)
      • alreadyorganization.exe (PID: 856)
      • InstallUtil.exe (PID: 920)
      • alreadyorganization.exe (PID: 2236)
      • InstallUtil.exe (PID: 4976)
      • oioq.exe (PID: 7528)
      • reCAPTCHA.exe (PID: 1012)
      • curl.exe (PID: 1244)

    • Checks proxy server information

      • New Text Document.bin.exe (PID: 5344)
      • New Text Document.exe (PID: 7652)
      • reCAPTCHA.exe (PID: 6392)
      • powershell.exe (PID: 6384)
      • powershell.exe (PID: 5304)
      • powershell.exe (PID: 6516)
      • powershell.exe (PID: 4172)
      • slui.exe (PID: 7052)
      • powershell.exe (PID: 5972)
      • powershell.exe (PID: 7152)
      • reCAPTCHA.exe (PID: 1012)

    • Disables trace logs

      • New Text Document.exe (PID: 7652)
      • powershell.exe (PID: 6384)
      • powershell.exe (PID: 5304)
      • powershell.exe (PID: 4172)
      • powershell.exe (PID: 6516)
      • powershell.exe (PID: 5972)
      • powershell.exe (PID: 7152)

    • Reads the software policy settings

      • slui.exe (PID: 7524)
      • New Text Document.exe (PID: 7652)
      • 1337X-1.exe (PID: 4212)
      • TORRENTOLD-1.exe (PID: 5528)
      • slui.exe (PID: 7052)

    • Reads the machine GUID from the registry

      • New Text Document.exe (PID: 7652)
      • alreadyorganization.exe (PID: 6148)
      • InstallUtil.exe (PID: 8152)
      • rocktraining.exe (PID: 736)
      • alreadyorganization.exe (PID: 856)
      • InstallUtil.exe (PID: 920)
      • alreadyorganization.exe (PID: 2236)
      • InstallUtil.exe (PID: 4976)

    • Process checks computer location settings

      • New Text Document.exe (PID: 7652)

    • Application launched itself

      • Acrobat.exe (PID: 7836)
      • AcroCEF.exe (PID: 7760)

    • Execution of CURL command

      • reCAPTCHA.exe (PID: 6392)
      • reCAPTCHA.exe (PID: 1012)

    • Creates files in the program directory

      • netdriver.exe (PID: 5452)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 6872)
      • WerFault.exe (PID: 3896)
      • WerFault.exe (PID: 6416)

    • The sample compiled with english language support

      • New Text Document.exe (PID: 7652)

    • Create files in a temporary directory

      • kinddevelopers.exe (PID: 7988)
      • rocktrainingss.exe (PID: 720)
      • tg01985462s.exe (PID: 7612)
      • tg01985462ss.exe (PID: 7196)
      • kinddevelopers.exe (PID: 728)
      • kinddevelopers.exe (PID: 6676)

    • .NET Reactor protector has been detected

      • TORRENTOLD-1.exe (PID: 5528)
      • 1337X-1.exe (PID: 4212)

    • Themida protector has been detected

      • rundrive.exe (PID: 4620)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 7968)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0001
ZipCompression: None
ZipModifyDate: 2024:05:09 01:02:54
ZipCRC: 0xda87f413
ZipCompressedSize: 193730
ZipUncompressedSize: 193730
ZipFileName: New Text Document.bin.zip
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
222
Monitored processes
84
Malicious processes
36
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe no specs slui.exe winrar.exe new text document.bin.exe slui.exe rundll32.exe no specs #HAUSBOMBER new text document.exe conhost.exe no specs acrobat.exe no specs acrobat.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs fscan.exe no specs conhost.exe no specs helper.exe no specs conhost.exe no specs recaptcha.exe curl.exe conhost.exe no specs notepad.exe no specs 1337x-1.exe torrentold-1.exe #LUMMA 1337x-1.exe #LUMMA torrentold-1.exe THREAT netdriver.exe #LUMMA svchost.exe #TAS17 winnet.exe no specs werfault.exe no specs werfault.exe no specs #TAS17 rundrive.exe no specs service.exe kinddevelopers.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe werfault.exe no specs alreadyorganization.exe no specs installutil.exe rocktraining.exe no specs rocktrainingss.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe tg01985462ss.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe tg01985462s.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe #TAS17 winnet.exe no specs oioq.exe no specs #TAS17 rundrive.exe no specs service.exe service.exe taskmgr.exe no specs taskmgr.exe alreadyorganization.exe no specs installutil.exe no specs alreadyorganization.exe no specs installutil.exe no specs #SYSTEMBC oioq.exe fscan.exe no specs conhost.exe no specs kinddevelopers.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe kinddevelopers.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe recaptcha.exe curl.exe conhost.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
720"C:\Users\admin\Desktop\New folder\a\rocktrainingss.exe" C:\Users\admin\Desktop\New folder\a\rocktrainingss.exe—New Text Document.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
11.00.22621.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\desktop\new folder\a\rocktrainingss.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
728"C:\Users\admin\Desktop\New folder\a\kinddevelopers.exe" C:\Users\admin\Desktop\New folder\a\kinddevelopers.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
11.00.22621.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\desktop\new folder\a\kinddevelopers.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
736"C:\Users\admin\Desktop\New folder\a\rocktraining.exe" C:\Users\admin\Desktop\New folder\a\rocktraining.exe—New Text Document.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Psmtcceefv
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\new folder\a\rocktraining.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
856"C:\Users\admin\Desktop\New folder\a\alreadyorganization.exe" C:\Users\admin\Desktop\New folder\a\alreadyorganization.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Tyesdh
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\new folder\a\alreadyorganization.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
920"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
.NET Framework installation utility
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\installutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1012"C:\Users\admin\Desktop\New folder\a\reCAPTCHA.exe" C:\Users\admin\Desktop\New folder\a\reCAPTCHA.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
PixlrUltimate Optimizer Inc.
Version:
3.0.0.0
Modules
Images
c:\users\admin\desktop\new folder\a\recaptcha.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\psapi.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1040"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=gpu-process --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --lang=en-US --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2796 --field-trial-handle=1412,i,10492769816856788330,3536615027479939223,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Exit code:
0
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1244"curl" ip.sbC:\Windows\System32\curl.exe
reCAPTCHA.exe
User:
admin
Company:
curl, https://curl.se/
Integrity Level:
MEDIUM
Description:
The curl executable
Exit code:
0
Version:
8.4.0
Modules
Images
c:\windows\system32\curl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
1388"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=gpu-process --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --lang=en-US --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2672 --field-trial-handle=1412,i,10492769816856788330,3536615027479939223,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Exit code:
0
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1452"C:\Users\admin\Desktop\New folder\a\rundrive.exe" C:\Users\admin\Desktop\New folder\a\rundrive.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\new folder\a\rundrive.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
58 854
Read events
58 739
Write events
86
Delete events
29

Modification events

(PID) Process:(7332) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7332) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7332) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7332) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\SamplePEC2.zip
(PID) Process:(7332) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7332) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7332) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7332) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7332) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(7332) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
20
Suspicious files
128
Text files
35
Unknown types
0

Dropped files

PID
Process
Filename
Type
5344New Text Document.bin.exeC:\Users\admin\Desktop\New folder\New Text Document.exeexecutable
MD5:A239A27C2169AF388D4F5BE6B52F272C
SHA256:98E895F711226A32BFAB152E224279D859799243845C46E550C2D32153C619FC
7332WinRAR.exeC:\Users\admin\Desktop\New Text Document.bin.zipcompressed
MD5:C59612C21187904C10E535301CCC483D
SHA256:E8F2303344CC4C58A92EC053AA198F57431326D805624D5CE3A9E6A17DD50DEE
7856Acrobat.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTINGbinary
MD5:DC84B0D741E5BEAE8070013ADDCC8C28
SHA256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
7856Acrobat.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.jsonbinary
MD5:837C1211E392A24D64C670DC10E8DA1B
SHA256:8013AC030684B86D754BBFBAB8A9CEC20CAA4DD9C03022715FF353DC10E14031
7856Acrobat.exeC:\Users\admin\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.1.20093.6 2025-03-04 04-25-03-913.logtext
MD5:460C6041966002D8384A18C895A65EB0
SHA256:C83EC6E8FB3EC62481289C033238C1D9B08DB8076EAAD304099FD7A7F594F1B9
7856Acrobat.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEventsbinary
MD5:27885B0217DFC22A7A9BDDDE2D08EEB1
SHA256:CFF2F90849C7DA55ABAE217EB45A86C11F67DB2C86CAA6E6D36FC2B378ED49A0
7836Acrobat.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lstbinary
MD5:366B140BAFC863B7E366AA1E51604759
SHA256:CBC8B288DBD2C72432081CF33CEF431572A94C7FB89DBCD59973B99E3871814E
7760AcroCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.oldtext
MD5:2EF1F7C0782D1A46974286420D24F629
SHA256:D3A9BB7E09E1F4B0C41FF7808E930DDACF5DB3BACD98ECCF5BC7DB4863D1FCF5
7760AcroCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old~RF122e9a.TMPtext
MD5:ED7D8AAE48211E2BFAF557130572C62A
SHA256:A5CF8D8ADC86DCA357396AF7E3A24A116072D5C1E5552EEB76601AE2673DED6E
7856Acrobat.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7856binary
MD5:366B140BAFC863B7E366AA1E51604759
SHA256:CBC8B288DBD2C72432081CF33CEF431572A94C7FB89DBCD59973B99E3871814E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
39
TCP/UDP connections
246
DNS requests
25
Threats
95

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7680
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7224
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7224
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7652
New Text Document.exe
GET
—
195.201.179.80:80
http://pcbuilts.com/AntiRat.exe
unknown
—
—
unknown
7652
New Text Document.exe
GET
—
195.201.179.80:80
http://pcbuilts.com/AntiRat.exe
unknown
—
—
unknown
7652
New Text Document.exe
GET
—
195.201.179.80:80
http://pcbuilts.com/Ext.exe
unknown
—
—
unknown
7652
New Text Document.exe
GET
—
195.201.179.80:80
http://pcbuilts.com/Ext.exe
unknown
—
—
unknown
7652
New Text Document.exe
GET
—
195.201.179.80:80
http://pcbuilts.com/sonic.exe
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
7680
backgroundTaskHost.exe
20.103.156.88:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7680
backgroundTaskHost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7224
SIHClient.exe
20.12.23.50:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
whitelisted
google.com
  • 172.217.16.206
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 20.190.160.64
  • 20.190.160.67
  • 20.190.160.3
  • 20.190.160.17
  • 40.126.32.68
  • 20.190.160.20
  • 40.126.32.72
  • 20.190.160.128
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 184.30.131.245
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

PID
Process
Class
Message
7652
New Text Document.exe
Potentially Bad Traffic
ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
7652
New Text Document.exe
Potentially Bad Traffic
ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
7652
New Text Document.exe
Potentially Bad Traffic
ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
7652
New Text Document.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 31
7652
New Text Document.exe
Potentially Bad Traffic
ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
7652
New Text Document.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7652
New Text Document.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7652
New Text Document.exe
Misc activity
ET INFO Packed Executable Download
7652
New Text Document.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
7652
New Text Document.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SamplePEC2.zip