File name:

0cdeecdaadc2850a3edee77d62e369cb5b640eac30da2a553a788b2953a568c6.zip

Full analysis: https://app.any.run/tasks/28fb84a7-f49a-4d84-8ef5-87035a3fbc23
Verdict: Malicious activity
Analysis date: July 31, 2024, 15:22:15
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
payload
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

F9D876051F86AC36ABBBB29A616A6211

SHA1:

1CEF5FE54CF2D0A57809B70C7D788C1DAA8CBA76

SHA256:

FEA90F49736812CF4382AC08502FFB57CE8EFEFD936A0CEB7C1C78507BBEB741

SSDEEP:

12288:fjGTY1t+LJd5D1NE6c39e0IR5GKVBWNTGLLOFgSA:fjG01t+9d5D1y6c393+7VBWNTGLLOFg3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 0cdeecdaadc2850a3edee77d62e369cb5b640eac30da2a553a788b2953a568c6.exe (PID: 6980)
      • CrashReport.exe (PID: 1488)
      • updater.exe (PID: 6008)
      • updater.exe (PID: 6480)
      • 127.0.6533.73_chrome_installer.exe (PID: 6588)
      • setup.exe (PID: 3908)
      • updater.exe (PID: 5504)
      • setup.exe (PID: 2768)
      • setup.exe (PID: 6148)

    • Scans artifacts that could help determine the target

      • updater.exe (PID: 6008)

    • Changes the autorun value in the registry

      • setup.exe (PID: 3908)
      • setup.exe (PID: 2768)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • 0cdeecdaadc2850a3edee77d62e369cb5b640eac30da2a553a788b2953a568c6.exe (PID: 6980)

    • Potential Corporate Privacy Violation

      • 0cdeecdaadc2850a3edee77d62e369cb5b640eac30da2a553a788b2953a568c6.exe (PID: 6980)

    • Reads security settings of Internet Explorer

      • 0cdeecdaadc2850a3edee77d62e369cb5b640eac30da2a553a788b2953a568c6.exe (PID: 6980)
      • updater.exe (PID: 6008)

    • Executable content was dropped or overwritten

      • 0cdeecdaadc2850a3edee77d62e369cb5b640eac30da2a553a788b2953a568c6.exe (PID: 6980)
      • CrashReport.exe (PID: 1488)
      • updater.exe (PID: 6008)
      • updater.exe (PID: 6480)
      • 127.0.6533.73_chrome_installer.exe (PID: 6588)
      • setup.exe (PID: 3908)
      • updater.exe (PID: 5504)
      • setup.exe (PID: 2768)
      • setup.exe (PID: 6148)

    • Application launched itself

      • updater.exe (PID: 6008)
      • updater.exe (PID: 6480)
      • updater.exe (PID: 2608)
      • setup.exe (PID: 1812)
      • updater.exe (PID: 5504)
      • setup.exe (PID: 3908)
      • setup.exe (PID: 2768)
      • setup.exe (PID: 6148)
      • setup.exe (PID: 1664)
      • setup.exe (PID: 3160)
      • setup.exe (PID: 6444)

    • Executes as Windows Service

      • updater.exe (PID: 6480)
      • updater.exe (PID: 2608)
      • updater.exe (PID: 5504)

    • Checks Windows Trust Settings

      • updater.exe (PID: 6008)

    • Connects to unusual port

      • svchost.exe (PID: 2336)

    • Payload loading activity detected

      • 0cdeecdaadc2850a3edee77d62e369cb5b640eac30da2a553a788b2953a568c6.exe (PID: 6980)
      • svchost.exe (PID: 2336)

    • Creates a software uninstall entry

      • setup.exe (PID: 3908)
      • setup.exe (PID: 2768)

    • Searches for installed software

      • setup.exe (PID: 3908)
      • setup.exe (PID: 2768)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6312)

    • Manual execution by a user

      • 0cdeecdaadc2850a3edee77d62e369cb5b640eac30da2a553a788b2953a568c6.exe (PID: 6980)
      • chrome.exe (PID: 7112)

    • Reads the computer name

      • 0cdeecdaadc2850a3edee77d62e369cb5b640eac30da2a553a788b2953a568c6.exe (PID: 6980)
      • updater.exe (PID: 6480)
      • updater.exe (PID: 2608)
      • updater.exe (PID: 6008)
      • setup.exe (PID: 3908)
      • setup.exe (PID: 1812)
      • elevation_service.exe (PID: 5940)
      • TextInputHost.exe (PID: 6220)
      • updater.exe (PID: 5504)
      • 127.0.6533.89_127.0.6533.73_chrome_updater.exe (PID: 252)
      • setup.exe (PID: 3160)
      • setup.exe (PID: 2768)
      • 127.0.6533.73_chrome_installer.exe (PID: 6588)
      • setup.exe (PID: 6444)
      • setup.exe (PID: 6148)
      • setup.exe (PID: 1664)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 6312)

    • Creates files in the program directory

      • 0cdeecdaadc2850a3edee77d62e369cb5b640eac30da2a553a788b2953a568c6.exe (PID: 6980)
      • ChromeSetup.exe (PID: 252)
      • updater.exe (PID: 6008)
      • updater.exe (PID: 6480)
      • updater.exe (PID: 2608)
      • updater.exe (PID: 6272)
      • setup.exe (PID: 3908)
      • setup.exe (PID: 1812)
      • updater.exe (PID: 5504)
      • setup.exe (PID: 3160)
      • setup.exe (PID: 2768)
      • setup.exe (PID: 6444)
      • setup.exe (PID: 6148)

    • Checks supported languages

      • ChromeSetup.exe (PID: 252)
      • CrashReport.exe (PID: 1488)
      • updater.exe (PID: 6008)
      • updater.exe (PID: 6272)
      • updater.exe (PID: 6480)
      • updater.exe (PID: 7088)
      • updater.exe (PID: 2608)
      • 0cdeecdaadc2850a3edee77d62e369cb5b640eac30da2a553a788b2953a568c6.exe (PID: 6980)
      • updater.exe (PID: 5408)
      • 127.0.6533.73_chrome_installer.exe (PID: 6588)
      • setup.exe (PID: 3036)
      • setup.exe (PID: 188)
      • elevation_service.exe (PID: 5940)
      • TextInputHost.exe (PID: 6220)
      • updater.exe (PID: 5504)
      • updater.exe (PID: 904)
      • setup.exe (PID: 3160)
      • setup.exe (PID: 4004)
      • 127.0.6533.89_127.0.6533.73_chrome_updater.exe (PID: 252)
      • setup.exe (PID: 2768)
      • setup.exe (PID: 6440)
      • setup.exe (PID: 1812)
      • setup.exe (PID: 3908)
      • setup.exe (PID: 6148)
      • setup.exe (PID: 608)
      • setup.exe (PID: 1664)
      • setup.exe (PID: 5940)
      • setup.exe (PID: 5408)
      • setup.exe (PID: 6444)

    • Create files in a temporary directory

      • CrashReport.exe (PID: 1488)
      • updater.exe (PID: 6008)

    • Process checks whether UAC notifications are on

      • updater.exe (PID: 6480)
      • updater.exe (PID: 2608)
      • updater.exe (PID: 6008)
      • updater.exe (PID: 5504)

    • Process checks computer location settings

      • 0cdeecdaadc2850a3edee77d62e369cb5b640eac30da2a553a788b2953a568c6.exe (PID: 6980)

    • Reads the machine GUID from the registry

      • updater.exe (PID: 2608)
      • updater.exe (PID: 6008)

    • Checks proxy server information

      • updater.exe (PID: 6008)

    • Reads the software policy settings

      • updater.exe (PID: 2608)
      • updater.exe (PID: 6008)
      • updater.exe (PID: 5504)

    • Creates files or folders in the user directory

      • updater.exe (PID: 6008)

    • Application launched itself

      • chrome.exe (PID: 7112)

    • Executes as Windows Service

      • elevation_service.exe (PID: 5940)

    • Reads Microsoft Office registry keys

      • chrome.exe (PID: 7112)

    • The process uses the downloaded file

      • chrome.exe (PID: 5472)
      • chrome.exe (PID: 6196)
      • chrome.exe (PID: 2628)
      • chrome.exe (PID: 4540)
      • chrome.exe (PID: 1948)
      • chrome.exe (PID: 6272)
      • chrome.exe (PID: 3908)
      • chrome.exe (PID: 5092)
      • chrome.exe (PID: 5940)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0003
ZipCompression: Unknown (99)
ZipModifyDate: 2024:07:31 15:21:56
ZipCRC: 0xed8096ea
ZipCompressedSize: 284579
ZipUncompressedSize: 562568
ZipFileName: 0cdeecdaadc2850a3edee77d62e369cb5b640eac30da2a553a788b2953a568c6.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
200
Monitored processes
62
Malicious processes
8
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe 0cdeecdaadc2850a3edee77d62e369cb5b640eac30da2a553a788b2953a568c6.exe chromesetup.exe no specs crashreport.exe svchost.exe updater.exe updater.exe no specs updater.exe updater.exe no specs updater.exe updater.exe no specs 127.0.6533.73_chrome_installer.exe setup.exe setup.exe no specs setup.exe no specs setup.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe elevation_service.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs textinputhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs updater.exe updater.exe no specs chrome.exe no specs 127.0.6533.89_127.0.6533.73_chrome_updater.exe no specs setup.exe no specs setup.exe no specs setup.exe chrome.exe no specs setup.exe no specs setup.exe no specs setup.exe no specs setup.exe setup.exe no specs setup.exe no specs setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188C:\WINDOWS\SystemTemp\chrome_Unpacker_BeginUnzipping2608_237479820\CR_FA7B4.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\WINDOWS\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=127.0.6533.73 --initial-client-data=0x29c,0x2a0,0x2a4,0x1e0,0x2a8,0x7ff6b47841f8,0x7ff6b4784204,0x7ff6b4784210C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2608_237479820\CR_FA7B4.tmp\setup.exe—setup.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Chrome Installer
Exit code:
0
Version:
127.0.6533.73
Modules
Images
c:\windows\systemtemp\chrome_unpacker_beginunzipping2608_237479820\cr_fa7b4.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
232"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3228,i,14608495259626010660,10678747140650475243,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
127.0.6533.73
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
252"C:\ProgramData\ChromeSetup.exe" C:\ProgramData\ChromeSetup.exe—0cdeecdaadc2850a3edee77d62e369cb5b640eac30da2a553a788b2953a568c6.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome Installer
Exit code:
0
Version:
128.0.6597.0
Modules
Images
c:\programdata\chromesetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
252"C:\WINDOWS\SystemTemp\chrome_Unpacker_BeginUnzipping5504_1580922945\127.0.6533.89_127.0.6533.73_chrome_updater.exe" --verbose-logging --do-not-launch-chrome --channel=stableC:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5504_1580922945\127.0.6533.89_127.0.6533.73_chrome_updater.exe—updater.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Chrome Installer
Exit code:
0
Version:
127.0.6533.89
Modules
Images
c:\windows\systemtemp\chrome_unpacker_beginunzipping5504_1580922945\127.0.6533.89_127.0.6533.73_chrome_updater.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\shell32.dll
608"C:\Program Files\Google\Chrome\Application\127.0.6533.89\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\WINDOWS\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=127.0.6533.89 --initial-client-data=0x29c,0x2a0,0x2a4,0x1f4,0x2a8,0x7ff71a8741f8,0x7ff71a874204,0x7ff71a874210C:\Program Files\Google\Chrome\Application\127.0.6533.89\Installer\setup.exe—setup.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Chrome Installer
Exit code:
0
Version:
127.0.6533.89
Modules
Images
c:\program files\google\chrome\application\127.0.6533.89\installer\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
904"C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=128.0.6597.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2b0,0x2b4,0x2b8,0xbc,0x2bc,0xccc694,0xccc6a0,0xccc6acC:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exe—updater.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
GoogleUpdater (x86)
Exit code:
0
Version:
128.0.6597.0
Modules
Images
c:\program files (x86)\google\googleupdater\128.0.6597.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
1132"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3240,i,14608495259626010660,10678747140650475243,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
127.0.6533.73
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1488"C:\ProgramData\CrashReport.exe" C:\ProgramData\CrashReport.exe
0cdeecdaadc2850a3edee77d62e369cb5b640eac30da2a553a788b2953a568c6.exe
User:
admin
Company:
美图秀秀
Integrity Level:
HIGH
Description:
美图秀秀
Exit code:
0
Version:
1, 3, 0, 1
Modules
Images
c:\programdata\crashreport.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1664"C:\Program Files\Google\Chrome\Application\127.0.6533.89\Installer\setup.exe" --channel=stable --delete-old-versions --system-level --verbose-loggingC:\Program Files\Google\Chrome\Application\127.0.6533.89\Installer\setup.exe—setup.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Chrome Installer
Version:
127.0.6533.89
Modules
Images
c:\program files\google\chrome\application\127.0.6533.89\installer\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1812"C:\WINDOWS\SystemTemp\chrome_Unpacker_BeginUnzipping2608_237479820\CR_FA7B4.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2608_237479820\CR_FA7B4.tmp\setup.exe—setup.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Chrome Installer
Exit code:
73
Version:
127.0.6533.73
Modules
Images
c:\windows\systemtemp\chrome_unpacker_beginunzipping2608_237479820\cr_fa7b4.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
33 737
Read events
33 295
Write events
391
Delete events
51

Modification events

(PID) Process:(6312) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(6312) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(6312) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(6312) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\0cdeecdaadc2850a3edee77d62e369cb5b640eac30da2a553a788b2953a568c6.zip
(PID) Process:(6312) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6312) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6312) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6312) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6312) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(6312) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
Executable files
27
Suspicious files
176
Text files
60
Unknown types
0

Dropped files

PID
Process
Filename
Type
252ChromeSetup.exeC:\Windows\SystemTemp\Google252_1839103173\UPDATER.PACKED.7Z —
MD5:—
SHA256:—
1488CrashReport.exeC:\Users\admin\AppData\Local\Temp\appverifUl_x86.dll.tmpexecutable
MD5:DDCD85645C943002F8D3939666BA4A6E
SHA256:DBEC2C1591E69ED6885B8F75F88839862C804F03972F7760113670F5862BCC7E
6312WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6312.15443\0cdeecdaadc2850a3edee77d62e369cb5b640eac30da2a553a788b2953a568c6.exeexecutable
MD5:B81F5BB085D475A68E8C17F525B4A45B
SHA256:0CDEECDAADC2850A3EDEE77D62E369CB5B640EAC30DA2A553A788B2953A568C6
69800cdeecdaadc2850a3edee77d62e369cb5b640eac30da2a553a788b2953a568c6.exeC:\ProgramData\config.datbinary
MD5:D6933594650E845754EBC52BE66A3F7D
SHA256:E00F439493B9C35F81571D5DECD3D8391478CB467FB6FC8AA9B1D6D7222B5912
1488CrashReport.exeC:\Users\admin\AppData\Local\Temp\7BA5F019-26A2-46D1-B889-2582C8079353.datbinary
MD5:D6933594650E845754EBC52BE66A3F7D
SHA256:E00F439493B9C35F81571D5DECD3D8391478CB467FB6FC8AA9B1D6D7222B5912
69800cdeecdaadc2850a3edee77d62e369cb5b640eac30da2a553a788b2953a568c6.exeC:\ProgramData\zlib.dllexecutable
MD5:9B13494E74B4D6649F42F78F9F9DB836
SHA256:0D505D6C2DDD0CF5CE3DEDF7944CE2D1213C0D95F15E288346F384C3C845E798
6008updater.exeC:\Program Files (x86)\Google\GoogleUpdater\updater.logtext
MD5:0B67E01B176C16850B761F2635A78741
SHA256:92833AA66F0EA02EC45A3617AD8909356F9CFDDAB7E8DC2AB43F6A6B30EE337C
1488CrashReport.exeC:\Users\admin\AppData\Local\Temp\7BA5F019-26A2-46D1-B889-2582C8079353.dat.tmpbinary
MD5:D6933594650E845754EBC52BE66A3F7D
SHA256:E00F439493B9C35F81571D5DECD3D8391478CB467FB6FC8AA9B1D6D7222B5912
6008updater.exeC:\Program Files (x86)\Google\GoogleUpdater\128.0.6597.0\updater.exeexecutable
MD5:823816B4A601C69C89435EE17EF7B9E0
SHA256:C2A7C0FA80F228C2CE599E4427280997EA9E1A3F85ED32E5D5E4219DFB05DDB2
1488CrashReport.exeC:\Users\admin\AppData\Local\Temp\appverifUl_x86.dllexecutable
MD5:DDCD85645C943002F8D3939666BA4A6E
SHA256:DBEC2C1591E69ED6885B8F75F88839862C804F03972F7760113670F5862BCC7E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
70
DNS requests
40
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6980
0cdeecdaadc2850a3edee77d62e369cb5b640eac30da2a553a788b2953a568c6.exe
GET
—
47.79.64.204:80
http://hzkjabc.oss-cn-hongkong.aliyuncs.com/data/ChromeSetup.exe
unknown
—
—
malicious
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5552
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5552
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7112
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
7068
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6980
0cdeecdaadc2850a3edee77d62e369cb5b640eac30da2a553a788b2953a568c6.exe
GET
200
47.79.64.204:80
http://hzkjabc.oss-cn-hongkong.aliyuncs.com/data/CrashReport.exe
unknown
—
—
malicious
6980
0cdeecdaadc2850a3edee77d62e369cb5b640eac30da2a553a788b2953a568c6.exe
GET
200
47.79.64.204:80
http://hzkjabc.oss-cn-hongkong.aliyuncs.com/data/config.dat
unknown
—
—
malicious
6008
updater.exe
GET
200
172.217.18.99:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
—
—
whitelisted
6008
updater.exe
GET
200
172.217.18.99:80
http://c.pki.goog/r/r1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4016
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5408
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4016
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6980
0cdeecdaadc2850a3edee77d62e369cb5b640eac30da2a553a788b2953a568c6.exe
47.79.64.204:80
hzkjabc.oss-cn-hongkong.aliyuncs.com
WINDSTREAM
US
unknown
5336
SearchApp.exe
95.100.146.25:443
www.bing.com
Akamai International B.V.
CZ
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.110
whitelisted
hzkjabc.oss-cn-hongkong.aliyuncs.com
  • 47.79.64.204
unknown
www.bing.com
  • 95.100.146.25
  • 95.100.146.40
  • 95.100.146.27
  • 95.100.146.18
  • 95.100.146.16
  • 95.100.146.10
  • 95.100.146.35
  • 95.100.146.19
  • 95.100.146.32
  • 95.100.146.33
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.74
  • 40.126.32.133
  • 20.190.160.14
  • 40.126.32.68
  • 20.190.160.20
  • 20.190.160.22
  • 40.126.32.136
  • 40.126.32.138
whitelisted
client.wns.windows.com
  • 40.113.103.199
  • 40.115.3.253
whitelisted
th.bing.com
  • 95.100.146.18
  • 95.100.146.27
  • 95.100.146.19
  • 95.100.146.33
  • 95.100.146.16
  • 95.100.146.40
  • 95.100.146.25
whitelisted
fd.api.iris.microsoft.com
  • 20.103.156.88
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted

Threats

PID
Process
Class
Message
2256
svchost.exe
Misc activity
ET INFO DNS Query to Alibaba Cloud CDN Domain (aliyuncs .com)
6980
0cdeecdaadc2850a3edee77d62e369cb5b640eac30da2a553a788b2953a568c6.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
6980
0cdeecdaadc2850a3edee77d62e369cb5b640eac30da2a553a788b2953a568c6.exe
Misc activity
ET INFO Packed Executable Download
6980
0cdeecdaadc2850a3edee77d62e369cb5b640eac30da2a553a788b2953a568c6.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
6980
0cdeecdaadc2850a3edee77d62e369cb5b640eac30da2a553a788b2953a568c6.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
6980
0cdeecdaadc2850a3edee77d62e369cb5b640eac30da2a553a788b2953a568c6.exe
Potentially Bad Traffic
PAYLOAD [ANY.RUN] XORed Windows executable has been loaded
2336
svchost.exe
Potentially Bad Traffic
PAYLOAD [ANY.RUN] XORed Windows executable has been loaded
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
0cdeecdaadc2850a3edee77d62e369cb5b640eac30da2a553a788b2953a568c6.zip