| File name: | Process Lasso Pro 9.0.0.466 Crack License Key Download.7z |
| Full analysis: | https://app.any.run/tasks/82c64bbf-668d-4928-9d50-db9afaefd421 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | March 31, 2025, 10:39:07 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-7z-compressed |
| File info: | 7-zip archive data, version 0.4 |
| MD5: | 84E9D166E99D405BA7C7EFB7011FCC3A |
| SHA1: | 4BE2503AEE2B1717BC5F5F161A52B53227F739CE |
| SHA256: | 3C9530C312A51EB7F9277744D632CF92607D8F6AE540E881149026BF26BA7EC3 |
| SSDEEP: | 98304:7o3lx7XwfLPxP8BVNwxJdmzeUbv9f90TTi3bCTvy7BVxZHAkMO9d5myXNyEWoC5R:cDcIPVQLrttP16saihStnqGz0XqO |
| .7z | | | 7-Zip compressed archive (v0.4) (57.1) |
|---|---|---|
| .7z | | | 7-Zip compressed archive (gen) (42.8) |
| FileVersion: | 7z v0.04 |
|---|
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 780 | Strengthening.com p | C:\Users\admin\AppData\Local\Temp\747480\Strengthening.com | cmd.exe | ||||||||||||
User: admin Company: AutoIt Team Integrity Level: MEDIUM Description: AutoIt v3 Script (Beta) Version: 3, 3, 15, 5 Modules
| |||||||||||||||
| 976 | cmd /c copy /b ..\Varies.wmz + ..\Springs.wmz + ..\Times.wmz + ..\Len.wmz + ..\V.wmz + ..\Pattern.wmz + ..\Bishop.wmz p | C:\Windows\SysWOW64\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1760 | cmd /c copy /b 747480\Strengthening.com + Ima + Patents + Raised + Heat + Satisfaction + Beginners + Potato + Nurse + Worlds + Lifestyle + Skills 747480\Strengthening.com | C:\Windows\SysWOW64\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2152 | choice /d y /t 5 | C:\Windows\SysWOW64\choice.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Offers the user a choice Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2236 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3240 | "C:\Users\admin\AppData\Local\Temp\QQGKT8OFW17E6LSDFDKFOJ7Y.exe" | C:\Users\admin\AppData\Local\Temp\QQGKT8OFW17E6LSDFDKFOJ7Y.exe | Strengthening.com | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 4424 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Process Lasso Pro 9.0.0.466 Crack License Key Download.7z" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
| 4464 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | UCPDMgr.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4652 | findstr /V "Pokemon" Inspections | C:\Windows\SysWOW64\findstr.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Find String (QGREP) Utility Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4996 | "C:\WINDOWS\system32\UCPDMgr.exe" | C:\Windows\System32\UCPDMgr.exe | — | svchost.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: User Choice Protection Manager Exit code: 0 Version: 1.0.0.414301 Modules
| |||||||||||||||
| (PID) Process: | (4424) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (4424) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (4424) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (4424) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Process Lasso Pro 9.0.0.466 Crack License Key Download.7z | |||
| (PID) Process: | (4424) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (4424) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (4424) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (4424) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (4424) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface |
| Operation: | write | Name: | ShowPassword |
Value: 0 | |||
| (PID) Process: | (7316) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | App |
Value: C:\Users\admin\AppData\Local\Temp\QQGKT8OFW17E6LSDFDKFOJ7Y.exe | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4424 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXb4424.37706\process lasso pro 9.0.0.466 crack license key download.exe | — | |
MD5:— | SHA256:— | |||
| 7740 | process lasso pro 9.0.0.466 crack license key download.exe | C:\Users\admin\AppData\Local\Temp\Times.wmz | binary | |
MD5:03A116C5DCDB3CA1508E3AFF1D1DB7D7 | SHA256:483D1626D2F6FF62E82E748B16B1AEB33DC40418C3CED1DAFBFE2BB0DCD1F5F4 | |||
| 7740 | process lasso pro 9.0.0.466 crack license key download.exe | C:\Users\admin\AppData\Local\Temp\Bishop.wmz | binary | |
MD5:8C5AD8C0571F27B0893605794E3FBD69 | SHA256:997235C8DD6668CA19C5D3A374DAAFE01C738808AF355C6E8D390DEF3E2BB1E8 | |||
| 7740 | process lasso pro 9.0.0.466 crack license key download.exe | C:\Users\admin\AppData\Local\Temp\V.wmz | binary | |
MD5:03E11301B6E0D123A3143D1BFB9B38B9 | SHA256:DAA6B5D270A88F30E0E084A206A8CDDFFA348CF44356CAD45D95D36520F8EABE | |||
| 8164 | extrac32.exe | C:\Users\admin\AppData\Local\Temp\Ima | binary | |
MD5:E7E8DC40F2CD02B822E69666DC12109F | SHA256:F31C73830580B2DD309C93582BFEFFB245FD82D72B01F52BCDC3719A4694C746 | |||
| 7740 | process lasso pro 9.0.0.466 crack license key download.exe | C:\Users\admin\AppData\Local\Temp\Len.wmz | binary | |
MD5:6E2C6340EB9AD8B3B151ECE91CF100C1 | SHA256:879681162CC1608F2B3F00AFCC87F39C436E84EDA3DA2626089FC13491826D20 | |||
| 7740 | process lasso pro 9.0.0.466 crack license key download.exe | C:\Users\admin\AppData\Local\Temp\Trigger.wmz | compressed | |
MD5:3AFE6E7BF480BBB03A7138889D701781 | SHA256:10FEEBEAA468A1B44E17BB0AC7216AE3DBCEFCBD169AD76F09769892FFCB03E2 | |||
| 7740 | process lasso pro 9.0.0.466 crack license key download.exe | C:\Users\admin\AppData\Local\Temp\Varies.wmz | binary | |
MD5:B8BA506156CE48E0652598711FC32C0C | SHA256:3812D7A05214F9BE738C994CC83505C0D0B839EA06760E414ED174D1F21396B4 | |||
| 7740 | process lasso pro 9.0.0.466 crack license key download.exe | C:\Users\admin\AppData\Local\Temp\Pattern.wmz | binary | |
MD5:EA4A6EDBF5D8AC0632CFA65B6034A071 | SHA256:0B7F6CAE60EB95ABD585671933F32C50FCE99D95892F6651FA8F488392208B0F | |||
| 7740 | process lasso pro 9.0.0.466 crack license key download.exe | C:\Users\admin\AppData\Local\Temp\Springs.wmz | binary | |
MD5:9326D9DF12EEBD402027927DEFF0A636 | SHA256:A32D546EF142ADD499AB8857EF3D3D87CEB870FB7791802F04C7F7434C5F53C4 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.53.40.176:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
7968 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
7968 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
780 | Strengthening.com | GET | 200 | 195.82.146.34:80 | http://195.82.146.34/888.exe | unknown | — | — | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2104 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.53.40.176:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2112 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3216 | svchost.exe | 20.197.71.89:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | SG | whitelisted |
6544 | svchost.exe | 40.126.31.3:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
7968 | SIHClient.exe | 4.245.163.56:443 | slscr.update.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
FNHiJhWONrMhshfKrgUb.FNHiJhWONrMhshfKrgUb |
| unknown |
PID | Process | Class | Message |
|---|---|---|---|
780 | Strengthening.com | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |
780 | Strengthening.com | Potential Corporate Privacy Violation | ET INFO PE EXE or DLL Windows file download HTTP |
780 | Strengthening.com | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
780 | Strengthening.com | Potentially Bad Traffic | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response |