File name:

14ef0e1602c97030ac84d3ec70da1c6f41c2cc6300d1becd7b5b19fa4c5cc20c.zip

Full analysis: https://app.any.run/tasks/be1a1475-9149-4140-adf0-4893ea8c70fc
Verdict: Malicious activity
Analysis date: May 17, 2025, 22:00:03
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-scr
arch-html
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

36F7E7CF03849EE6FB1D414FA54BEED1

SHA1:

3852F724FC74C9FD234183F00A30E04277395827

SHA256:

F88861055951CC924FC360F1E013AEB8722A364F1E2A1A6585ECD9E8BDEE8628

SSDEEP:

98304:12/K7maaKErH9bXZ8/5f0O60yWkAxDttdQjLUQreQK5EYPlmXPALHUFFBpOoL2F8:ahjy3o+re

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 4400)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 5244)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 5244)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 5244)

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 5244)

  • INFO

    • Manual execution by a user

      • wscript.exe (PID: 1532)
      • WinRAR.exe (PID: 5244)
      • wscript.exe (PID: 3100)
      • wscript.exe (PID: 6632)
      • wscript.exe (PID: 4784)
      • wscript.exe (PID: 5960)
      • wscript.exe (PID: 4172)
      • wscript.exe (PID: 3272)
      • wscript.exe (PID: 5668)
      • wscript.exe (PID: 1128)
      • wscript.exe (PID: 5436)

    • JScript runtime error (SCRIPT)

      • wscript.exe (PID: 1532)
      • wscript.exe (PID: 3100)
      • wscript.exe (PID: 6632)
      • wscript.exe (PID: 4784)
      • wscript.exe (PID: 5960)
      • wscript.exe (PID: 3272)
      • wscript.exe (PID: 1128)
      • wscript.exe (PID: 5436)

    • Checks proxy server information

      • slui.exe (PID: 6828)

    • Reads the software policy settings

      • slui.exe (PID: 6828)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5244)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 5244)

    • Checks supported languages

      • MpCmdRun.exe (PID: 3024)

    • Create files in a temporary directory

      • MpCmdRun.exe (PID: 3024)

    • Reads the computer name

      • MpCmdRun.exe (PID: 3024)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0801
ZipCompression: Deflated
ZipModifyDate: 2025:05:17 21:59:48
ZipCRC: 0xffe158a3
ZipCompressedSize: 5385314
ZipUncompressedSize: 5400324
ZipFileName: Xeno-v1.1.95.zip
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
16
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs slui.exe cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1128"C:\Windows\System32\WScript.exe" C:\Users\admin\Desktop\editor.main.nls.it.jsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1532"C:\Windows\System32\WScript.exe" C:\Users\admin\Desktop\editor.main.nls.ko.jsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3024"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\admin\AppData\Local\Temp\Rar$VR5244.15154"C:\Program Files\Windows Defender\MpCmdRun.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Malware Protection Command Line Utility
Exit code:
2
Version:
4.18.1909.6 (WinBuild.160101.0800)
Modules
Images
c:\program files\windows defender\mpcmdrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
3100"C:\Windows\System32\WScript.exe" C:\Users\admin\Desktop\editor.main.nls.fr.jsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3272"C:\Windows\System32\WScript.exe" C:\Users\admin\Desktop\editor.main.nls.es.jsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4172"C:\Windows\System32\WScript.exe" C:\Users\admin\Desktop\lua.jsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
1
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4400"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\14ef0e1602c97030ac84d3ec70da1c6f41c2cc6300d1becd7b5b19fa4c5cc20c.zipC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4448C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$VR5244.15154\Rar$Scan124357.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
4784"C:\Windows\System32\WScript.exe" C:\Users\admin\Desktop\editor.main.nls.zh-cn.jsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5124\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
7 475
Read events
7 453
Write events
22
Delete events
0

Modification events

(PID) Process:(4400) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4400) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4400) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4400) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\14ef0e1602c97030ac84d3ec70da1c6f41c2cc6300d1becd7b5b19fa4c5cc20c.zip
(PID) Process:(4400) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4400) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4400) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4400) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5244) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5244) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
Executable files
24
Suspicious files
10
Text files
15
Unknown types
0

Dropped files

PID
Process
Filename
Type
5244WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5244.15154\Xeno-v1.1.95.zip\Xeno-v1.1.95\api-ms-win-crt-filesystem-l1-1-0.dllexecutable
MD5:42A2A95F1BB940D01F55EB1674A81FE2
SHA256:51541EC6684B43157A85EA46A42EBED4555BE06BED0D0D07FF3EA6377301318D
5244WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5244.15154\Xeno-v1.1.95.zip\Xeno-v1.1.95\api-ms-win-crt-runtime-l1-1-0.dllexecutable
MD5:F91E1FF896B5616919AC97C7095C513E
SHA256:07382C0D91DAD2BB6BA8BD06EA02F12C57ABF7C4E5A70672E9F2954D09A4FFD4
5244WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5244.15154\Xeno-v1.1.95.zip\Xeno-v1.1.95\api-ms-win-crt-locale-l1-1-0.dllexecutable
MD5:FF48B107B2449A647C64BAABD49408A1
SHA256:7BB8644E565AD4BCFD890F9044BCCB4D99953A740E9A500B1F820B2FDC3FC240
5244WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5244.15154\Xeno-v1.1.95.zip\Xeno-v1.1.95\bin\Monaco\index.htmlhtml
MD5:001DCBB8F41CDCBF9B4D1E3A0ED4B2D2
SHA256:F1D2C52F2803C29585B81D2EFF74C56242D27E9619EE6D38081D5604C5BB1951
5244WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5244.15154\Xeno-v1.1.95.zip\Xeno-v1.1.95\api-ms-win-crt-convert-l1-1-0.dllexecutable
MD5:C8DBF0CA88FACFE87899168A7F7DB52C
SHA256:94B6E91B93C2202DABD659BFF294BEE87C22897A30A6B4930B49051C2FB502DC
5244WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5244.15154\Xeno-v1.1.95.zip\Xeno-v1.1.95\api-ms-win-crt-stdio-l1-1-0.dllexecutable
MD5:429C26ED27A026442F89C95FF16CE8C2
SHA256:2A466648AFFD3D51B944F563BB65046A3DA91006A0D90FB2C0B123487A1FC1B3
5244WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5244.15154\Xeno-v1.1.95.zip\Xeno-v1.1.95\api-ms-win-crt-string-l1-1-0.dllexecutable
MD5:0F593E50BE4715AA8E1F6EB39434EDD5
SHA256:BF4EA10BE1B64C442AC0CCF4BDF69F6703467176A27E9E14A488D26448A6E179
5244WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5244.15154\Xeno-v1.1.95.zip\Xeno-v1.1.95\api-ms-win-crt-heap-l1-1-0.dllexecutable
MD5:98DA186FD7D7873C164A51C5D7B77F1A
SHA256:80139E4CAA379D87B1D1DAFC23ACE71D2B330368115F6314140D4AE59C2A78E8
5244WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5244.15154\Xeno-v1.1.95.zip\Xeno-v1.1.95\bin\Monaco\vs\editor\editor.main.nls.jstext
MD5:E871D4D9539C26D7D2BF32801EBDECF0
SHA256:5FF0084E6A7EEE82A735616239AAF2190EA9D90E89E19340831F3D590828016A
5244WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5244.15154\Xeno-v1.1.95.zip\Xeno-v1.1.95\bin\Monaco\vs\editor\editor.main.nls.ja.jstext
MD5:3BF851CC70F515CBBE1D39DA93E4F041
SHA256:1F3556EA7233843B9E08B3C97B6727C533D702563E195C2090A438070DC85F0F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
38
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4448
SIHClient.exe
GET
200
23.216.77.30:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4448
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
4448
SIHClient.exe
GET
200
23.216.77.30:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
4448
SIHClient.exe
GET
200
23.216.77.30:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
4448
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4448
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
4448
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
4448
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4448
SIHClient.exe
4.245.163.56:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4448
SIHClient.exe
23.216.77.30:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4448
SIHClient.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4448
SIHClient.exe
13.95.31.18:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1676
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.110
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
crl.microsoft.com
  • 23.216.77.30
  • 23.216.77.37
  • 23.216.77.18
  • 23.216.77.8
  • 23.216.77.26
  • 23.216.77.35
  • 23.216.77.19
  • 23.216.77.13
  • 23.216.77.41
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.11
whitelisted
login.live.com
  • 20.190.159.23
  • 20.190.159.71
  • 40.126.31.73
  • 20.190.159.130
  • 40.126.31.71
  • 20.190.159.129
  • 40.126.31.128
  • 20.190.159.4
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
14ef0e1602c97030ac84d3ec70da1c6f41c2cc6300d1becd7b5b19fa4c5cc20c.zip