File name:

Process Lasso Pro 9.0.0.466 Crack License Key Download.7z

Full analysis: https://app.any.run/tasks/82c64bbf-668d-4928-9d50-db9afaefd421
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: March 31, 2025, 10:39:07
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
lumma
stealer
loader
autoit-loader
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

84E9D166E99D405BA7C7EFB7011FCC3A

SHA1:

4BE2503AEE2B1717BC5F5F161A52B53227F739CE

SHA256:

3C9530C312A51EB7F9277744D632CF92607D8F6AE540E881149026BF26BA7EC3

SSDEEP:

98304:7o3lx7XwfLPxP8BVNwxJdmzeUbv9f90TTi3bCTvy7BVxZHAkMO9d5myXNyEWoC5R:cDcIPVQLrttP16saihStnqGz0XqO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Actions looks like stealing of personal data

      • Strengthening.com (PID: 780)
    • AutoIt loader has been detected (YARA)

      • Strengthening.com (PID: 780)
    • LUMMA mutex has been found

      • Strengthening.com (PID: 780)
    • Steals credentials from Web Browsers

      • Strengthening.com (PID: 780)
    • Run PowerShell with an invisible window

      • powershell.exe (PID: 7316)
  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • process lasso pro 9.0.0.466 crack license key download.exe (PID: 7740)
      • WinRAR.exe (PID: 4424)
    • Starts CMD.EXE for commands execution

      • process lasso pro 9.0.0.466 crack license key download.exe (PID: 7740)
      • cmd.exe (PID: 7788)
    • Get information on the list of running processes

      • cmd.exe (PID: 7788)
    • Executing commands from a ".bat" file

      • process lasso pro 9.0.0.466 crack license key download.exe (PID: 7740)
    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 7788)
    • Application launched itself

      • cmd.exe (PID: 7788)
    • The executable file from the user directory is run by the CMD process

      • Strengthening.com (PID: 780)
    • Starts application with an unusual extension

      • cmd.exe (PID: 7788)
    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 7788)
    • There is functionality for taking screenshot (YARA)

      • process lasso pro 9.0.0.466 crack license key download.exe (PID: 7740)
      • Strengthening.com (PID: 780)
    • Searches for installed software

      • Strengthening.com (PID: 780)
    • Potential Corporate Privacy Violation

      • Strengthening.com (PID: 780)
    • Connects to the server without a host name

      • Strengthening.com (PID: 780)
    • Process requests binary or script from the Internet

      • Strengthening.com (PID: 780)
    • Starts POWERSHELL.EXE for commands execution

      • QQGKT8OFW17E6LSDFDKFOJ7Y.exe (PID: 3240)
    • Executable content was dropped or overwritten

      • Strengthening.com (PID: 780)
    • Connects to unusual port

      • QQGKT8OFW17E6LSDFDKFOJ7Y.exe (PID: 3240)
  • INFO

    • Reads the computer name

      • process lasso pro 9.0.0.466 crack license key download.exe (PID: 7740)
      • extrac32.exe (PID: 8164)
      • Strengthening.com (PID: 780)
    • Checks supported languages

      • process lasso pro 9.0.0.466 crack license key download.exe (PID: 7740)
      • extrac32.exe (PID: 8164)
      • Strengthening.com (PID: 780)
      • QQGKT8OFW17E6LSDFDKFOJ7Y.exe (PID: 3240)
    • Process checks computer location settings

      • process lasso pro 9.0.0.466 crack license key download.exe (PID: 7740)
    • Create files in a temporary directory

      • process lasso pro 9.0.0.466 crack license key download.exe (PID: 7740)
      • extrac32.exe (PID: 8164)
      • Strengthening.com (PID: 780)
    • Creates a new folder

      • cmd.exe (PID: 8144)
    • Reads mouse settings

      • Strengthening.com (PID: 780)
    • Reads the software policy settings

      • Strengthening.com (PID: 780)
      • slui.exe (PID: 7248)
      • slui.exe (PID: 2236)
    • Drops encrypted JS script (Microsoft Script Encoder)

      • QQGKT8OFW17E6LSDFDKFOJ7Y.exe (PID: 3240)
    • Changes the registry key values via Powershell

      • QQGKT8OFW17E6LSDFDKFOJ7Y.exe (PID: 3240)
    • Creates files or folders in the user directory

      • QQGKT8OFW17E6LSDFDKFOJ7Y.exe (PID: 3240)
    • Checks proxy server information

      • slui.exe (PID: 2236)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
163
Monitored processes
25
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe no specs slui.exe process lasso pro 9.0.0.466 crack license key download.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs #LUMMA strengthening.com choice.exe no specs slui.exe qqgkt8ofw17e6lsdfdkfoj7y.exe powershell.exe no specs conhost.exe no specs ucpdmgr.exe no specs conhost.exe no specs ucpdmgr.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
780Strengthening.com p C:\Users\admin\AppData\Local\Temp\747480\Strengthening.com
cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Version:
3, 3, 15, 5
Modules
Images
c:\users\admin\appdata\local\temp\747480\strengthening.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\user32.dll
976cmd /c copy /b ..\Varies.wmz + ..\Springs.wmz + ..\Times.wmz + ..\Len.wmz + ..\V.wmz + ..\Pattern.wmz + ..\Bishop.wmz p C:\Windows\SysWOW64\cmd.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1760cmd /c copy /b 747480\Strengthening.com + Ima + Patents + Raised + Heat + Satisfaction + Beginners + Potato + Nurse + Worlds + Lifestyle + Skills 747480\Strengthening.comC:\Windows\SysWOW64\cmd.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2152choice /d y /t 5C:\Windows\SysWOW64\choice.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Offers the user a choice
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\choice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll
2236C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3240"C:\Users\admin\AppData\Local\Temp\QQGKT8OFW17E6LSDFDKFOJ7Y.exe"C:\Users\admin\AppData\Local\Temp\QQGKT8OFW17E6LSDFDKFOJ7Y.exe
Strengthening.com
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\qqgkt8ofw17e6lsdfdkfoj7y.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4424"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Process Lasso Pro 9.0.0.466 Crack License Key Download.7z"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4464\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exeUCPDMgr.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4652findstr /V "Pokemon" Inspections C:\Windows\SysWOW64\findstr.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll
4996"C:\WINDOWS\system32\UCPDMgr.exe"C:\Windows\System32\UCPDMgr.exesvchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
User Choice Protection Manager
Exit code:
0
Version:
1.0.0.414301
Modules
Images
c:\windows\system32\ucpdmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
9 126
Read events
9 116
Write events
10
Delete events
0

Modification events

(PID) Process:(4424) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4424) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4424) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4424) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Process Lasso Pro 9.0.0.466 Crack License Key Download.7z
(PID) Process:(4424) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4424) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4424) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4424) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4424) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(7316) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:App
Value:
C:\Users\admin\AppData\Local\Temp\QQGKT8OFW17E6LSDFDKFOJ7Y.exe
Executable files
1
Suspicious files
23
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
4424WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb4424.37706\process lasso pro 9.0.0.466 crack license key download.exe
MD5:
SHA256:
7740process lasso pro 9.0.0.466 crack license key download.exeC:\Users\admin\AppData\Local\Temp\Times.wmzbinary
MD5:03A116C5DCDB3CA1508E3AFF1D1DB7D7
SHA256:483D1626D2F6FF62E82E748B16B1AEB33DC40418C3CED1DAFBFE2BB0DCD1F5F4
7740process lasso pro 9.0.0.466 crack license key download.exeC:\Users\admin\AppData\Local\Temp\Bishop.wmzbinary
MD5:8C5AD8C0571F27B0893605794E3FBD69
SHA256:997235C8DD6668CA19C5D3A374DAAFE01C738808AF355C6E8D390DEF3E2BB1E8
7740process lasso pro 9.0.0.466 crack license key download.exeC:\Users\admin\AppData\Local\Temp\V.wmzbinary
MD5:03E11301B6E0D123A3143D1BFB9B38B9
SHA256:DAA6B5D270A88F30E0E084A206A8CDDFFA348CF44356CAD45D95D36520F8EABE
8164extrac32.exeC:\Users\admin\AppData\Local\Temp\Imabinary
MD5:E7E8DC40F2CD02B822E69666DC12109F
SHA256:F31C73830580B2DD309C93582BFEFFB245FD82D72B01F52BCDC3719A4694C746
7740process lasso pro 9.0.0.466 crack license key download.exeC:\Users\admin\AppData\Local\Temp\Len.wmzbinary
MD5:6E2C6340EB9AD8B3B151ECE91CF100C1
SHA256:879681162CC1608F2B3F00AFCC87F39C436E84EDA3DA2626089FC13491826D20
7740process lasso pro 9.0.0.466 crack license key download.exeC:\Users\admin\AppData\Local\Temp\Trigger.wmzcompressed
MD5:3AFE6E7BF480BBB03A7138889D701781
SHA256:10FEEBEAA468A1B44E17BB0AC7216AE3DBCEFCBD169AD76F09769892FFCB03E2
7740process lasso pro 9.0.0.466 crack license key download.exeC:\Users\admin\AppData\Local\Temp\Varies.wmzbinary
MD5:B8BA506156CE48E0652598711FC32C0C
SHA256:3812D7A05214F9BE738C994CC83505C0D0B839EA06760E414ED174D1F21396B4
7740process lasso pro 9.0.0.466 crack license key download.exeC:\Users\admin\AppData\Local\Temp\Pattern.wmzbinary
MD5:EA4A6EDBF5D8AC0632CFA65B6034A071
SHA256:0B7F6CAE60EB95ABD585671933F32C50FCE99D95892F6651FA8F488392208B0F
7740process lasso pro 9.0.0.466 crack license key download.exeC:\Users\admin\AppData\Local\Temp\Springs.wmzbinary
MD5:9326D9DF12EEBD402027927DEFF0A636
SHA256:A32D546EF142ADD499AB8857EF3D3D87CEB870FB7791802F04C7F7434C5F53C4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
33
DNS requests
19
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
7968
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
7968
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
780
Strengthening.com
GET
200
195.82.146.34:80
http://195.82.146.34/888.exe
unknown
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
20.197.71.89:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
6544
svchost.exe
40.126.31.3:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
7968
SIHClient.exe
4.245.163.56:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.110
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
client.wns.windows.com
  • 20.197.71.89
  • 172.172.255.216
whitelisted
login.live.com
  • 40.126.31.3
  • 20.190.159.73
  • 40.126.31.67
  • 20.190.159.75
  • 40.126.31.2
  • 20.190.159.128
  • 40.126.31.71
  • 20.190.159.23
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
FNHiJhWONrMhshfKrgUb.FNHiJhWONrMhshfKrgUb
unknown

Threats

PID
Process
Class
Message
780
Strengthening.com
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
780
Strengthening.com
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
780
Strengthening.com
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
780
Strengthening.com
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
No debug info