File name:

14ef0e1602c97030ac84d3ec70da1c6f41c2cc6300d1becd7b5b19fa4c5cc20c.zip

Full analysis: https://app.any.run/tasks/be1a1475-9149-4140-adf0-4893ea8c70fc
Verdict: Malicious activity
Analysis date: May 17, 2025, 22:00:03
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-scr
arch-html
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

36F7E7CF03849EE6FB1D414FA54BEED1

SHA1:

3852F724FC74C9FD234183F00A30E04277395827

SHA256:

F88861055951CC924FC360F1E013AEB8722A364F1E2A1A6585ECD9E8BDEE8628

SSDEEP:

98304:12/K7maaKErH9bXZ8/5f0O60yWkAxDttdQjLUQreQK5EYPlmXPALHUFFBpOoL2F8:ahjy3o+re

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 4400)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 5244)

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 5244)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 5244)

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 5244)

  • INFO

    • Manual execution by a user

      • wscript.exe (PID: 1532)
      • WinRAR.exe (PID: 5244)
      • wscript.exe (PID: 3100)
      • wscript.exe (PID: 6632)
      • wscript.exe (PID: 5960)
      • wscript.exe (PID: 4784)
      • wscript.exe (PID: 3272)
      • wscript.exe (PID: 4172)
      • wscript.exe (PID: 1128)
      • wscript.exe (PID: 5668)
      • wscript.exe (PID: 5436)

    • JScript runtime error (SCRIPT)

      • wscript.exe (PID: 1532)
      • wscript.exe (PID: 3100)
      • wscript.exe (PID: 6632)
      • wscript.exe (PID: 5960)
      • wscript.exe (PID: 4784)
      • wscript.exe (PID: 3272)
      • wscript.exe (PID: 1128)
      • wscript.exe (PID: 5436)

    • Checks proxy server information

      • slui.exe (PID: 6828)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5244)

    • Reads the software policy settings

      • slui.exe (PID: 6828)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 5244)

    • Reads the computer name

      • MpCmdRun.exe (PID: 3024)

    • Checks supported languages

      • MpCmdRun.exe (PID: 3024)

    • Create files in a temporary directory

      • MpCmdRun.exe (PID: 3024)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0801
ZipCompression: Deflated
ZipModifyDate: 2025:05:17 21:59:48
ZipCRC: 0xffe158a3
ZipCompressedSize: 5385314
ZipUncompressedSize: 5400324
ZipFileName: Xeno-v1.1.95.zip
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
16
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs slui.exe cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1128"C:\Windows\System32\WScript.exe" C:\Users\admin\Desktop\editor.main.nls.it.jsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1532"C:\Windows\System32\WScript.exe" C:\Users\admin\Desktop\editor.main.nls.ko.jsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3024"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\admin\AppData\Local\Temp\Rar$VR5244.15154"C:\Program Files\Windows Defender\MpCmdRun.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Malware Protection Command Line Utility
Exit code:
2
Version:
4.18.1909.6 (WinBuild.160101.0800)
Modules
Images
c:\program files\windows defender\mpcmdrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
3100"C:\Windows\System32\WScript.exe" C:\Users\admin\Desktop\editor.main.nls.fr.jsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3272"C:\Windows\System32\WScript.exe" C:\Users\admin\Desktop\editor.main.nls.es.jsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4172"C:\Windows\System32\WScript.exe" C:\Users\admin\Desktop\lua.jsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
1
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4400"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\14ef0e1602c97030ac84d3ec70da1c6f41c2cc6300d1becd7b5b19fa4c5cc20c.zipC:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4448C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$VR5244.15154\Rar$Scan124357.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
4784"C:\Windows\System32\WScript.exe" C:\Users\admin\Desktop\editor.main.nls.zh-cn.jsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5124\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
7 475
Read events
7 453
Write events
22
Delete events
0

Modification events

(PID) Process:(4400) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4400) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4400) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4400) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\14ef0e1602c97030ac84d3ec70da1c6f41c2cc6300d1becd7b5b19fa4c5cc20c.zip
(PID) Process:(4400) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4400) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4400) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4400) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5244) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5244) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
Executable files
24
Suspicious files
10
Text files
15
Unknown types
0

Dropped files

PID
Process
Filename
Type
5244WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5244.15154\Xeno-v1.1.95.zip\Xeno-v1.1.95\api-ms-win-crt-locale-l1-1-0.dllexecutable
MD5:FF48B107B2449A647C64BAABD49408A1
SHA256:7BB8644E565AD4BCFD890F9044BCCB4D99953A740E9A500B1F820B2FDC3FC240
5244WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5244.15154\Xeno-v1.1.95.zip\Xeno-v1.1.95\bin\Monaco\vs\basic-languages\lua\lua.jsbinary
MD5:EEBDA1FDD970433750C115EAE2F03865
SHA256:AC729EFB3164F48D6B08F74D4B15060C126A30D40FB4CD4FC9CC94F2E19BD7C7
5244WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5244.15154\Xeno-v1.1.95.zip\Xeno-v1.1.95\api-ms-win-crt-stdio-l1-1-0.dllexecutable
MD5:429C26ED27A026442F89C95FF16CE8C2
SHA256:2A466648AFFD3D51B944F563BB65046A3DA91006A0D90FB2C0B123487A1FC1B3
5244WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5244.15154\Xeno-v1.1.95.zip\Xeno-v1.1.95\bin\Monaco\vs\base\worker\workerMain.jsbinary
MD5:D0AC5294C58E523CDDF25BC6D785FA48
SHA256:E90D1A8F116FA74431117A3AD78DDE16DDE060A4BF7528DFE3D5A3AD6156504B
5244WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5244.15154\Xeno-v1.1.95.zip\Xeno-v1.1.95\bin\Monaco\vs\editor\editor.main.jsbinary
MD5:2DC0068CDBC03CE43A75AB0B2DF664E2
SHA256:B604B6148F70FE9DB882CCE2A7D327B2422AD2F203A805491002A8C564E3C3FF
5244WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5244.15154\Xeno-v1.1.95.zip\Xeno-v1.1.95\api-ms-win-crt-math-l1-1-0.dllexecutable
MD5:E10E077BB06209AEDD0D0D378C758F73
SHA256:8A7BFF1C918539A75C25568DB25933D653C003E016FD7791A37186B42BBB7C20
5244WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5244.15154\Xeno-v1.1.95.zip\Xeno-v1.1.95\bin\Monaco\vs\editor\editor.main.csstext
MD5:23C7DB6E12F6454EF6E7FB98D17924D8
SHA256:615824C59ED1E07F5924286E9F02F3120B9064D59E115D3F668A914E07839451
5244WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5244.15154\Xeno-v1.1.95.zip\Xeno-v1.1.95\api-ms-win-crt-heap-l1-1-0.dllexecutable
MD5:98DA186FD7D7873C164A51C5D7B77F1A
SHA256:80139E4CAA379D87B1D1DAFC23ACE71D2B330368115F6314140D4AE59C2A78E8
5244WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5244.15154\Xeno-v1.1.95.zip\Xeno-v1.1.95\api-ms-win-crt-filesystem-l1-1-0.dllexecutable
MD5:42A2A95F1BB940D01F55EB1674A81FE2
SHA256:51541EC6684B43157A85EA46A42EBED4555BE06BED0D0D07FF3EA6377301318D
5244WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR5244.15154\Xeno-v1.1.95.zip\Xeno-v1.1.95\api-ms-win-crt-string-l1-1-0.dllexecutable
MD5:0F593E50BE4715AA8E1F6EB39434EDD5
SHA256:BF4EA10BE1B64C442AC0CCF4BDF69F6703467176A27E9E14A488D26448A6E179
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
38
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4448
SIHClient.exe
GET
200
23.216.77.30:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4448
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
4448
SIHClient.exe
GET
200
23.216.77.30:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
4448
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4448
SIHClient.exe
GET
200
23.216.77.30:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
4448
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
4448
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
4448
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4448
SIHClient.exe
4.245.163.56:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4448
SIHClient.exe
23.216.77.30:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4448
SIHClient.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4448
SIHClient.exe
13.95.31.18:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1676
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.110
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
crl.microsoft.com
  • 23.216.77.30
  • 23.216.77.37
  • 23.216.77.18
  • 23.216.77.8
  • 23.216.77.26
  • 23.216.77.35
  • 23.216.77.19
  • 23.216.77.13
  • 23.216.77.41
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.11
whitelisted
login.live.com
  • 20.190.159.23
  • 20.190.159.71
  • 40.126.31.73
  • 20.190.159.130
  • 40.126.31.71
  • 20.190.159.129
  • 40.126.31.128
  • 20.190.159.4
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
14ef0e1602c97030ac84d3ec70da1c6f41c2cc6300d1becd7b5b19fa4c5cc20c.zip