URL:

https://www.keysfull.net/camtasia-studio-2020-fully-working-serial-key/

Full analysis: https://app.any.run/tasks/e3886571-0c0f-4304-932d-3e715f84657f
Verdict: Malicious activity
Analysis date: December 30, 2021, 09:32:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
Indicators:
MD5:

101AD640F3395FC040DE6879153E7306

SHA1:

26526EDE9F2EB92152A5222586D0AD5E23F6AD47

SHA256:

4CC0ADA8654B2E05D864D64B2699D1C6D5055D043E88ADCEE8D86AD78EE13C69

SSDEEP:

3:N8DSLkH//MM0VTF4KIj:2OLkH90v4bj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Reads the computer name

      • firefox.exe (PID: 3640)
      • firefox.exe (PID: 1920)
      • firefox.exe (PID: 3096)
      • firefox.exe (PID: 1432)
      • firefox.exe (PID: 528)
      • firefox.exe (PID: 3928)
      • firefox.exe (PID: 1132)
      • firefox.exe (PID: 1344)

    • Checks supported languages

      • firefox.exe (PID: 3640)
      • firefox.exe (PID: 1004)
      • firefox.exe (PID: 1920)
      • firefox.exe (PID: 3096)
      • firefox.exe (PID: 1432)
      • firefox.exe (PID: 528)
      • firefox.exe (PID: 1344)
      • firefox.exe (PID: 3928)
      • firefox.exe (PID: 1132)

    • Application launched itself

      • firefox.exe (PID: 1004)
      • firefox.exe (PID: 3640)

    • Reads CPU info

      • firefox.exe (PID: 3640)

    • Creates files in the program directory

      • firefox.exe (PID: 3640)

    • Reads the date of Windows installation

      • firefox.exe (PID: 3640)

    • Dropped object may contain Bitcoin addresses

      • firefox.exe (PID: 3640)

    • Creates files in the user directory

      • firefox.exe (PID: 3640)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
9
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
528"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3640.20.1013222097\325520122" -childID 3 -isForBrowser -prefsHandle 3784 -prefMapHandle 3788 -prefsLen 7470 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3640 "\\.\pipe\gecko-crash-server-pipe.3640" 3808 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
1004"C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.keysfull.net/camtasia-studio-2020-fully-working-serial-key/"C:\Program Files\Mozilla Firefox\firefox.exe—Explorer.EXE
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
1132"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3640.28.1040857529\803288989" -childID 5 -isForBrowser -prefsHandle 7824 -prefMapHandle 7828 -prefsLen 7857 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3640 "\\.\pipe\gecko-crash-server-pipe.3640" 7792 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
1344"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3640.29.674212541\679805643" -childID 6 -isForBrowser -prefsHandle 7764 -prefMapHandle 7776 -prefsLen 7857 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3640 "\\.\pipe\gecko-crash-server-pipe.3640" 7696 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
1432"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3640.13.271579988\49460467" -childID 2 -isForBrowser -prefsHandle 3128 -prefMapHandle 2816 -prefsLen 6644 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3640 "\\.\pipe\gecko-crash-server-pipe.3640" 3152 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msasn1.dll
1920"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3640.0.981970078\582310802" -parentBuildID 20201112153044 -prefsHandle 912 -prefMapHandle 872 -prefsLen 1 -prefMapSize 238726 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3640 "\\.\pipe\gecko-crash-server-pipe.3640" 1184 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msasn1.dll
3096"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3640.6.601576512\605712497" -childID 1 -isForBrowser -prefsHandle 2412 -prefMapHandle 2408 -prefsLen 245 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3640 "\\.\pipe\gecko-crash-server-pipe.3640" 2424 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
3640"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.keysfull.net/camtasia-studio-2020-fully-working-serial-key/C:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msasn1.dll
3928"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3640.27.1403007842\1054911773" -childID 4 -isForBrowser -prefsHandle 7876 -prefMapHandle 7852 -prefsLen 7857 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3640 "\\.\pipe\gecko-crash-server-pipe.3640" 7808 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msasn1.dll
Total events
9 348
Read events
9 324
Write events
24
Delete events
0

Modification events

(PID) Process:(1004) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Launcher
Value:
1E50384455000000
(PID) Process:(3640) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Browser
Value:
DF57384455000000
(PID) Process:(3640) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry
Value:
0
(PID) Process:(3640) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\DllPrefetchExperiment
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
0
(PID) Process:(3640) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|DisableTelemetry
Value:
1
(PID) Process:(3640) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|DisableDefaultBrowserAgent
Value:
0
(PID) Process:(3640) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|ServicesSettingsServer
Value:
https://firefox.settings.services.mozilla.com/v1
(PID) Process:(3640) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|SecurityContentSignatureRootHash
Value:
97:E8:BA:9C:F1:2F:B3:DE:53:CC:42:A4:E6:57:7E:D6:4D:F4:93:C2:47:B4:14:FE:A0:36:81:8D:38:23:56:0E
(PID) Process:(3640) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3640) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000003B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
0
Suspicious files
132
Text files
32
Unknown types
34

Dropped files

PID
Process
Filename
Type
3640firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
3640firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite —
MD5:—
SHA256:—
3640firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
3640firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.binbinary
MD5:994A33896BB41A278A315D0D796422B6
SHA256:54EC50A20FFF8CC016710E49437CF6A11D3FE5EE7B28C185E4A9AAFEE2908B63
3640firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
3640firefox.exeC:\Users\admin\AppData\Local\Temp\mz_etilqs_MxuPxQfUwidBEZXbinary
MD5:—
SHA256:—
3640firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-walbinary
MD5:—
SHA256:—
3640firefox.exeC:\Users\admin\AppData\Local\Temp\mz_etilqs_gtHX2QjENCW8k5wbinary
MD5:—
SHA256:—
3640firefox.exeC:\Users\admin\AppData\Local\Temp\mz_etilqs_JRzkKCuAhWQsxAcbinary
MD5:—
SHA256:—
3640firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\places.sqlite-walsqlite-wal
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
24
TCP/UDP connections
95
DNS requests
134
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3640
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3640
firefox.exe
POST
200
172.217.16.131:80
http://ocsp.pki.goog/gts1c3
US
der
472 b
whitelisted
3640
firefox.exe
POST
200
172.217.16.131:80
http://ocsp.pki.goog/gts1c3
US
der
471 b
whitelisted
3640
firefox.exe
POST
—
93.184.220.29:80
http://ocsp.digicert.com/
US
—
—
whitelisted
3640
firefox.exe
POST
—
172.217.16.131:80
http://ocsp.pki.goog/gts1c3
US
—
—
whitelisted
3640
firefox.exe
POST
200
172.217.16.131:80
http://ocsp.pki.goog/gts1c3
US
der
472 b
whitelisted
3640
firefox.exe
GET
200
172.67.199.135:80
http://tera336.xyz/~lp1/lander.php?lander=aHR0cDovL3JpcmEyMzYueHl6L35scDIvP3Q9MTY0MDg1NjkyMiZxPUNhbXRhc2lhLVN0dWRpby0yMDIwLUZ1bGx5LVdvcmtpbmctU2VyaWFsLUtleSZoPWRjZDQzMjk1ZWQ1OTJkNmVkYzVkMzE2Y2E3NzIyMTczM2RlMzQ4NjIwYzAyODdhZmEyMzA1NWIx&kod=&t=1640856812
US
html
380 b
suspicious
3640
firefox.exe
POST
—
172.217.16.131:80
http://ocsp.pki.goog/gts1c3
US
—
—
whitelisted
3640
firefox.exe
POST
200
143.204.101.52:80
http://ocsp.sca1b.amazontrust.com/
US
der
471 b
whitelisted
3640
firefox.exe
POST
200
2.22.118.162:80
http://r3.o.lencr.org/
GB
der
503 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3640
firefox.exe
34.107.221.82:80
detectportal.firefox.com
—
US
whitelisted
3640
firefox.exe
80.82.77.66:443
www.keysfull.net
Quasi Networks LTD.
SC
suspicious
3640
firefox.exe
143.204.98.76:443
firefox.settings.services.mozilla.com
—
US
suspicious
3640
firefox.exe
172.217.16.131:80
ocsp.pki.goog
Google Inc.
US
whitelisted
3640
firefox.exe
35.166.112.194:443
location.services.mozilla.com
Amazon.com, Inc.
US
unknown
3640
firefox.exe
143.204.98.120:443
content-signature-2.cdn.mozilla.net
—
US
suspicious
3640
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3640
firefox.exe
104.22.71.197:443
static.addtoany.com
Cloudflare Inc
US
suspicious
3640
firefox.exe
192.0.77.37:443
c0.wp.com
Automattic, Inc
US
suspicious
3640
firefox.exe
104.21.12.50:443
dolsoh2.club
Cloudflare Inc
US
unknown

DNS requests

Domain
IP
Reputation
detectportal.firefox.com
  • 34.107.221.82
whitelisted
www.keysfull.net
  • 80.82.77.66
suspicious
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
firefox.settings.services.mozilla.com
  • 143.204.98.76
  • 143.204.98.33
  • 143.204.98.29
  • 143.204.98.23
whitelisted
keysfull.net
  • 80.82.77.66
unknown
location.services.mozilla.com
  • 35.166.112.194
  • 52.37.202.88
  • 52.32.245.155
  • 52.27.24.187
  • 34.211.161.93
  • 35.163.213.238
whitelisted
locprod2-elb-us-west-2.prod.mozaws.net
  • 35.163.213.238
  • 34.211.161.93
  • 52.27.24.187
  • 52.32.245.155
  • 52.37.202.88
  • 35.166.112.194
whitelisted
example.org
  • 93.184.216.34
whitelisted
ipv4only.arpa
  • 192.0.0.170
  • 192.0.0.171
whitelisted
content-signature-2.cdn.mozilla.net
  • 143.204.98.120
  • 143.204.98.36
  • 143.204.98.118
  • 143.204.98.30
whitelisted

Threats

PID
Process
Class
Message
3640
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
3640
firefox.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3640
firefox.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3640
firefox.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3640
firefox.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3640
firefox.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3640
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
3640
firefox.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3640
firefox.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3640
firefox.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.keysfull.net/camtasia-studio-2020-fully-working-serial-key/