File name:

3D Live Pool.exe.zip

Full analysis: https://app.any.run/tasks/90f61c07-97d8-4e7a-9d31-5d21fc81f17e
Verdict: Malicious activity
Analysis date: May 20, 2019, 20:17:14
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

9A55E8B79EF89FFB5F7D796B81277B93

SHA1:

D4CC3772DCB14915C4249524EFC07A4D46077E05

SHA256:

56419806804E331DC9A81D760C8C4CD1FA7254CA8DAA6BA77CF3DA82D5176103

SSDEEP:

49152:BgTA548UC0I//TLJpeaUQYKLvTAFUNqKPWrcnEHYIan4gIuAJif0wbmGHy5P:BYA54URTLJIw7vmq4YEH7Y4/u3fdbm99

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • 0468B1F79F3B2A62D10247F4A70FCC5969D2E3EE8DA3ED50701B8B2B47547FD5.exe (PID: 3572)
      • 0468B1F79F3B2A62D10247F4A70FCC5969D2E3EE8DA3ED50701B8B2B47547FD5.exe (PID: 4084)

  • SUSPICIOUS

    • Creates files in the user directory

      • 0468B1F79F3B2A62D10247F4A70FCC5969D2E3EE8DA3ED50701B8B2B47547FD5.exe (PID: 3572)

  • INFO

    • Manual execution by user

      • 0468B1F79F3B2A62D10247F4A70FCC5969D2E3EE8DA3ED50701B8B2B47547FD5.exe (PID: 3572)
      • 0468B1F79F3B2A62D10247F4A70FCC5969D2E3EE8DA3ED50701B8B2B47547FD5.exe (PID: 4084)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Deflated
ZipModifyDate: 2019:05:20 20:09:20
ZipCRC: 0x70927cbf
ZipCompressedSize: 2686530
ZipUncompressedSize: 2779046
ZipFileName: 0468B1F79F3B2A62D10247F4A70FCC5969D2E3EE8DA3ED50701B8B2B47547FD5
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
3
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs 0468b1f79f3b2a62d10247f4a70fcc5969d2e3ee8da3ed50701b8b2b47547fd5.exe no specs 0468b1f79f3b2a62d10247f4a70fcc5969d2e3ee8da3ed50701b8b2b47547fd5.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3196"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\3D Live Pool.exe.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3572"C:\Users\admin\Desktop\0468B1F79F3B2A62D10247F4A70FCC5969D2E3EE8DA3ED50701B8B2B47547FD5.exe" C:\Users\admin\Desktop\0468B1F79F3B2A62D10247F4A70FCC5969D2E3EE8DA3ED50701B8B2B47547FD5.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\0468b1f79f3b2a62d10247f4a70fcc5969d2e3ee8da3ed50701b8b2b47547fd5.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
4084"C:\Users\admin\Desktop\0468B1F79F3B2A62D10247F4A70FCC5969D2E3EE8DA3ED50701B8B2B47547FD5.exe" C:\Users\admin\Desktop\0468B1F79F3B2A62D10247F4A70FCC5969D2E3EE8DA3ED50701B8B2B47547FD5.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\0468b1f79f3b2a62d10247f4a70fcc5969d2e3ee8da3ed50701b8b2b47547fd5.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
Total events
524
Read events
515
Write events
9
Delete events
0

Modification events

(PID) Process:(3196) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3196) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3196) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3196) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\3D Live Pool.exe.zip
(PID) Process:(3196) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3196) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3196) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3196) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3196) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
Executable files
0
Suspicious files
3
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3196WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb3196.47095\0468B1F79F3B2A62D10247F4A70FCC5969D2E3EE8DA3ED50701B8B2B47547FD5 —
MD5:—
SHA256:—
35720468B1F79F3B2A62D10247F4A70FCC5969D2E3EE8DA3ED50701B8B2B47547FD5.exeC:\Users\admin\AppData\Roaming\Thinstall\3D Live Pool\Registry.rw.lck.USER-PC.ffffffffdf8 —
MD5:—
SHA256:—
35720468B1F79F3B2A62D10247F4A70FCC5969D2E3EE8DA3ED50701B8B2B47547FD5.exeC:\Users\admin\AppData\Roaming\Thinstall\3D Live Pool\Registry.rw.tvr.tmp-df8df8 —
MD5:—
SHA256:—
35720468B1F79F3B2A62D10247F4A70FCC5969D2E3EE8DA3ED50701B8B2B47547FD5.exeC:\Users\admin\Desktop\%x —
MD5:—
SHA256:—
35720468B1F79F3B2A62D10247F4A70FCC5969D2E3EE8DA3ED50701B8B2B47547FD5.exeC:\Users\admin\AppData\Roaming\Thinstall\3D Live Pool\Registry.tvr.backupbinary
MD5:—
SHA256:—
35720468B1F79F3B2A62D10247F4A70FCC5969D2E3EE8DA3ED50701B8B2B47547FD5.exeC:\Users\admin\AppData\Roaming\Thinstall\3D Live Pool\Registry.rw.tvrbinary
MD5:—
SHA256:—
35720468B1F79F3B2A62D10247F4A70FCC5969D2E3EE8DA3ED50701B8B2B47547FD5.exeC:\Users\admin\AppData\Roaming\Thinstall\3D Live Pool\Registry.rw.lckbinary
MD5:91CEA192F65D9ECE27A20A7E06475304
SHA256:A024913F8A254D6D6265013976B914476C33A4D099D3073BB358EF6EB63016F4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
3D Live Pool.exe.zip