File name:

Guna UI Framework Ultimate 2.0.0.1 worldfreeware.com.zip

Full analysis: https://app.any.run/tasks/6fc4bafd-c14e-4a67-b139-9521892e6f01
Verdict: Malicious activity
Analysis date: July 20, 2021, 02:24:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

340AD223F6BB20C94553F97DE6299032

SHA1:

CFCBCBF0B13A7C65BEAD03C337EB62E3F65343B8

SHA256:

5F0C8A01CDB94D3ABF07217701444DEF69BFBF9296047815D144439A9EF39150

SSDEEP:

49152:rheNSnWwsoWKxdG99hPFkGwq4cyWvnfmnyz6gtgwBMy:rheoZsoW4dq9hPxwPctnunY6gtgwKy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Keygen.exe (PID: 1820)
      • ndp48-web.exe (PID: 1996)
      • ndp48-web.exe (PID: 1892)
      • Setup.exe (PID: 3432)
      • SetupUtility.exe (PID: 2548)
      • SetupUtility.exe (PID: 1984)
      • ServiceModelReg.exe (PID: 1916)
      • regtlibv12.exe (PID: 3876)
      • regtlibv12.exe (PID: 932)
      • regtlibv12.exe (PID: 2424)
      • regtlibv12.exe (PID: 4068)
      • regtlibv12.exe (PID: 3512)
      • regtlibv12.exe (PID: 116)
      • regtlibv12.exe (PID: 3124)
      • ngen.exe (PID: 2524)
      • mscorsvw.exe (PID: 3836)
      • aspnet_regiis.exe (PID: 2108)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3512)
      • Setup.exe (PID: 3432)
      • MsiExec.exe (PID: 3588)
      • MsiExec.exe (PID: 1008)
      • Keygen.exe (PID: 1820)
      • msiexec.exe (PID: 1828)
      • svchost.exe (PID: 768)
      • aspnet_regiis.exe (PID: 2108)
      • ngen.exe (PID: 2524)
      • mscorsvw.exe (PID: 3836)

    • Actions looks like stealing of personal data

      • ndp48-web.exe (PID: 1892)

    • Changes settings of System certificates

      • Setup.exe (PID: 3432)

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 1828)

    • Loads the Task Scheduler COM API

      • ngen.exe (PID: 2524)

  • SUSPICIOUS

    • Drops a file with too old compile date

      • WinRAR.exe (PID: 1532)
      • msiexec.exe (PID: 1828)

    • Checks supported languages

      • WinRAR.exe (PID: 1532)
      • Keygen.exe (PID: 1820)
      • ndp48-web.exe (PID: 1892)
      • Setup.exe (PID: 3432)
      • SetupUtility.exe (PID: 2548)
      • SetupUtility.exe (PID: 1984)
      • TMPB357.tmp.exe (PID: 332)
      • ServiceModelReg.exe (PID: 1916)
      • regtlibv12.exe (PID: 932)
      • regtlibv12.exe (PID: 3876)
      • regtlibv12.exe (PID: 116)
      • regtlibv12.exe (PID: 2424)
      • regtlibv12.exe (PID: 4068)
      • regtlibv12.exe (PID: 3512)
      • regtlibv12.exe (PID: 3124)
      • mofcomp.exe (PID: 2776)
      • mofcomp.exe (PID: 1936)
      • aspnet_regiis.exe (PID: 2108)
      • mofcomp.exe (PID: 2516)
      • ngen.exe (PID: 2524)
      • mscorsvw.exe (PID: 3836)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 1532)
      • iexplore.exe (PID: 404)
      • iexplore.exe (PID: 2868)
      • ndp48-web.exe (PID: 1892)
      • msiexec.exe (PID: 1828)

    • Reads the computer name

      • WinRAR.exe (PID: 1532)
      • Keygen.exe (PID: 1820)
      • ndp48-web.exe (PID: 1892)
      • Setup.exe (PID: 3432)
      • SetupUtility.exe (PID: 2548)
      • SetupUtility.exe (PID: 1984)
      • TMPB357.tmp.exe (PID: 332)
      • ServiceModelReg.exe (PID: 1916)
      • mofcomp.exe (PID: 2776)
      • mofcomp.exe (PID: 1936)
      • aspnet_regiis.exe (PID: 2108)
      • mofcomp.exe (PID: 2516)
      • ngen.exe (PID: 2524)
      • mscorsvw.exe (PID: 3836)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1532)
      • iexplore.exe (PID: 404)
      • iexplore.exe (PID: 2868)
      • ndp48-web.exe (PID: 1892)
      • TMPB357.tmp.exe (PID: 332)
      • Setup.exe (PID: 3432)
      • msiexec.exe (PID: 1828)

    • Starts Internet Explorer

      • Keygen.exe (PID: 1820)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2868)

    • Reads CPU info

      • Setup.exe (PID: 3432)

    • Reads Environment values

      • Setup.exe (PID: 3432)

    • Executed as Windows Service

      • msiexec.exe (PID: 1828)

    • Reads Windows owner or organization settings

      • msiexec.exe (PID: 1828)

    • Application launched itself

      • msiexec.exe (PID: 1828)

    • Reads the Windows organization settings

      • msiexec.exe (PID: 1828)

    • Creates/Modifies COM task schedule object

      • msiexec.exe (PID: 1828)
      • aspnet_regiis.exe (PID: 2108)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 1828)

    • Searches for installed software

      • msiexec.exe (PID: 1828)

    • Checks for the .NET to be installed

      • msiexec.exe (PID: 1828)

    • Removes files from Windows directory

      • msiexec.exe (PID: 1828)
      • lodctr.exe (PID: 3640)
      • aspnet_regiis.exe (PID: 2108)
      • lodctr.exe (PID: 3420)
      • lodctr.exe (PID: 3096)
      • lodctr.exe (PID: 2408)
      • lodctr.exe (PID: 3184)

    • Creates files in the Windows directory

      • msiexec.exe (PID: 1828)
      • lodctr.exe (PID: 3640)
      • ngen.exe (PID: 2524)
      • aspnet_regiis.exe (PID: 2108)
      • lodctr.exe (PID: 3420)
      • lodctr.exe (PID: 3096)
      • lodctr.exe (PID: 2408)
      • lodctr.exe (PID: 3184)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 404)
      • iexplore.exe (PID: 2868)
      • msiexec.exe (PID: 1828)
      • MsiExec.exe (PID: 3588)
      • MsiExec.exe (PID: 1008)
      • wevtutil.exe (PID: 3392)
      • wevtutil.exe (PID: 3592)
      • lodctr.exe (PID: 3640)
      • lodctr.exe (PID: 3492)
      • lodctr.exe (PID: 2328)
      • lodctr.exe (PID: 3420)
      • lodctr.exe (PID: 3096)
      • lodctr.exe (PID: 3184)
      • lodctr.exe (PID: 636)
      • lodctr.exe (PID: 2408)

    • Manual execution by user

      • Keygen.exe (PID: 1820)

    • Changes internet zones settings

      • iexplore.exe (PID: 404)

    • Checks supported languages

      • iexplore.exe (PID: 2868)
      • iexplore.exe (PID: 404)
      • msiexec.exe (PID: 1828)
      • MsiExec.exe (PID: 3588)
      • MsiExec.exe (PID: 1008)
      • wevtutil.exe (PID: 3392)
      • wevtutil.exe (PID: 3592)
      • lodctr.exe (PID: 3640)
      • lodctr.exe (PID: 2328)
      • lodctr.exe (PID: 3492)
      • lodctr.exe (PID: 3420)
      • lodctr.exe (PID: 3096)
      • lodctr.exe (PID: 2408)
      • lodctr.exe (PID: 3184)
      • lodctr.exe (PID: 636)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2868)
      • Setup.exe (PID: 3432)
      • msiexec.exe (PID: 1828)
      • iexplore.exe (PID: 404)

    • Application launched itself

      • iexplore.exe (PID: 404)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2868)
      • iexplore.exe (PID: 404)
      • Setup.exe (PID: 3432)
      • msiexec.exe (PID: 1828)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 404)
      • svchost.exe (PID: 768)
      • SetupUtility.exe (PID: 2548)
      • Setup.exe (PID: 3432)
      • msiexec.exe (PID: 1828)
      • mscorsvw.exe (PID: 3836)

    • Changes settings of System certificates

      • iexplore.exe (PID: 404)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 404)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 404)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 404)

    • Creates files in the user directory

      • iexplore.exe (PID: 404)
      • iexplore.exe (PID: 2868)

    • Creates or modifies windows services

      • msiexec.exe (PID: 1828)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2868)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: Guna UI Framework Ultimate 2.0.0.1 worldfreeware.com/Crack/
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2020:05:23 21:25:14
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
99
Monitored processes
39
Malicious processes
17
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start winrar.exe searchprotocolhost.exe no specs keygen.exe no specs iexplore.exe iexplore.exe ndp48-web.exe no specs ndp48-web.exe setup.exe setuputility.exe no specs setuputility.exe no specs tmpb357.tmp.exe msiexec.exe msiexec.exe no specs msiexec.exe no specs servicemodelreg.exe no specs wevtutil.exe no specs wevtutil.exe no specs svchost.exe no specs lodctr.exe no specs regtlibv12.exe no specs regtlibv12.exe no specs regtlibv12.exe no specs regtlibv12.exe no specs regtlibv12.exe no specs regtlibv12.exe no specs regtlibv12.exe no specs mofcomp.exe no specs mofcomp.exe no specs aspnet_regiis.exe no specs mofcomp.exe no specs ngen.exe no specs mscorsvw.exe no specs lodctr.exe no specs lodctr.exe no specs lodctr.exe no specs lodctr.exe no specs lodctr.exe no specs lodctr.exe no specs lodctr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.tlb"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
RegTLib
Exit code:
0
Version:
14.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regtlibv12.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
332TMPB357.tmp.exe /Q /X:C:\2e22b0a275581af8288861d85274dd\TMPB357.tmp.exe.tmpC:\2e22b0a275581af8288861d85274dd\TMPB357.tmp.exe
Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Framework 4.8 Setup
Exit code:
0
Version:
4.8.03761.00
Modules
Images
c:\2e22b0a275581af8288861d85274dd\tmpb357.tmp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
404"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.7.2&processName=Keygen.exe&platform=0000&osver=5&isServer=0&shimver=4.0.30319.34209C:\Program Files\Internet Explorer\iexplore.exe
Keygen.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
636"C:\Windows\system32\lodctr.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\_DataOracleClientPerfCounters_shared12_neutral.iniC:\Windows\system32\lodctr.exe—MsiExec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Load PerfMon Counters
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\lodctr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\loadperf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
768C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedC:\Windows\System32\svchost.exe—services.exe
User:
LOCAL SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
932"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.tlb"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
RegTLib
Exit code:
0
Version:
14.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regtlibv12.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1008C:\Windows\system32\MsiExec.exe -Embedding 8196A786D027244DF124C4153B29731D E Global\MSI0000C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows� installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1532"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Guna UI Framework Ultimate 2.0.0.1 worldfreeware.com.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1820"C:\Users\admin\Desktop\Guna UI Framework Ultimate 2.0.0.1 worldfreeware.com\Crack\Keygen.exe" C:\Users\admin\Desktop\Guna UI Framework Ultimate 2.0.0.1 worldfreeware.com\Crack\Keygen.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
GMW
Exit code:
2148734720
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\guna ui framework ultimate 2.0.0.1 worldfreeware.com\crack\keygen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1828C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows� installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
85 969
Read events
69 638
Write events
14 529
Delete events
1 802

Modification events

(PID) Process:(1532) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1532) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1532) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1532) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1532) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Guna UI Framework Ultimate 2.0.0.1 worldfreeware.com.zip
(PID) Process:(1532) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1532) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1532) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1532) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1532) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
2 485
Suspicious files
79
Text files
557
Unknown types
31

Dropped files

PID
Process
Filename
Type
1532WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1532.22927\Guna UI Framework Ultimate 2.0.0.1 worldfreeware.com\Crack\Readme.txttext
MD5:—
SHA256:—
1532WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1532.22927\Guna UI Framework Ultimate 2.0.0.1 worldfreeware.com\Guna UI Framework Ultimate v2.0.0.1 Lib-Master\.gitignoretext
MD5:—
SHA256:—
1532WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1532.22927\Guna UI Framework Ultimate 2.0.0.1 worldfreeware.com\Guna UI Framework Ultimate v2.0.0.1 Lib-Master\.gitattributestext
MD5:13F0AECD22CC1F06C8225AE5E692FF31
SHA256:45A7CBB7D9942BA7FFCE0B20BC8DBE2D1196533BC6E4BD245871D77FB1EEDFDC
1532WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1532.22927\Guna UI Framework Ultimate 2.0.0.1 worldfreeware.com\Guna UI Framework Ultimate v2.0.0.1 Lib-Master\Guna UI Activation\Guna UI Activation.slntext
MD5:36E1F640B83FB42B2708C0CAF61514B5
SHA256:7E851F80A4C2A694F0855062435FCC7C31724693375E5CD3BBA05CBE09687DE0
1532WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1532.22927\Guna UI Framework Ultimate 2.0.0.1 worldfreeware.com\Guna UI Framework Ultimate v2.0.0.1 Lib-Master\Guna UI Activation\Guna UI Activation\bin\Debug\Guna UI Activation.xmlxml
MD5:3C39AE459596B6A2B563BF33E043C69E
SHA256:2C9AF4FA0B26201143B19EBE2E140E722E98DB656157F6D738E4A0BD20F0E821
1532WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1532.22927\Guna UI Framework Ultimate 2.0.0.1 worldfreeware.com\Crack\Keygen.pdbpdb
MD5:061D770937FCA83E70FC3838EFE389A5
SHA256:1771EDEB0F66BB54F43000DA2DDBEB7A84245CD19D98F4F3B5A765797B2713A7
1532WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1532.22927\Guna UI Framework Ultimate 2.0.0.1 worldfreeware.com\Guna UI Framework Ultimate v2.0.0.1 Lib-Master\Guna UI Activation\Guna UI Activation\bin\Debug\Guna UI Activation.vshost.exe.manifestxml
MD5:13C5BAC1F09AADF2C1F85E0729F69236
SHA256:F60B78D1D3CA2A3EADA7FBAFE3AA0F12803821B4828CDC7CFE88C24BB78A67BF
1532WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1532.22927\Guna UI Framework Ultimate 2.0.0.1 worldfreeware.com\Guna UI Framework Ultimate v2.0.0.1 Lib-Master\Guna UI Activation\Guna UI Activation\Form1.resxxml
MD5:E2C2EB8EC028F62C7CD5AEC9D653C7E0
SHA256:68E8DD852A3041220CE85BB0AF59D85FA42FF991F339586420CB792CEDA9A516
1532WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1532.22927\Guna UI Framework Ultimate 2.0.0.1 worldfreeware.com\Guna UI Framework Ultimate v2.0.0.1 Lib-Master\Guna UI Activation\Guna UI Activation\My Project\Application.myappxml
MD5:CC4DAA93C203BF95D8098A0D6426BFDE
SHA256:D8244F945551135BCDBC41B350A9796DC368CDDC73EEF4AC625C76BDD6DFCD0D
1532WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1532.22927\Guna UI Framework Ultimate 2.0.0.1 worldfreeware.com\Guna UI Framework Ultimate v2.0.0.1 Lib-Master\Guna UI Activation\Guna UI Activation\My Project\Application.Designer.vbtext
MD5:5F0D5BE0B87086798CDB0F3CDA5A7705
SHA256:2422F184DE18ED1BC7F3302C6F70A0EB42DC24C6013CE2A2FE413239C04D2B83
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
26
TCP/UDP connections
41
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
HEAD
302
23.15.254.176:80
http://go.microsoft.com/fwlink/?prd=11324&pver=netfx&sbp=Net48Rel1&plcid=0x409&clcid=0x409&ar=03761.00&sar=x86&o1=netfx_Full.mzz
NL
—
—
whitelisted
—
—
GET
302
23.15.254.176:80
http://go.microsoft.com/fwlink/?prd=11324&pver=netfx&sbp=Net48Rel1&plcid=0x409&clcid=0x409&ar=03761.00&sar=x86&o1=netfx_Full.mzz
NL
—
—
whitelisted
—
—
HEAD
302
23.15.254.176:80
http://go.microsoft.com/fwlink/?prd=11324&pver=netfx&sbp=Net48Rel1&plcid=0x409&clcid=0x409&ar=03761.00&sar=amd64&o1=netfx_Full_x86.msi
NL
—
—
whitelisted
2868
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA9bw6F2y3ieICDHiTyBZ7Q%3D
US
der
1.47 Kb
whitelisted
2868
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
US
der
471 b
whitelisted
2868
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D
US
der
471 b
whitelisted
2868
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAtb9ltrp%2FvQiykNkEU33uA%3D
US
der
471 b
whitelisted
3432
Setup.exe
GET
200
95.101.129.121:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
der
1.11 Kb
whitelisted
2868
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
3432
Setup.exe
GET
200
2.18.233.62:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
unknown
der
1.05 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2868
iexplore.exe
23.15.254.176:443
go.microsoft.com
Akamai Technologies, Inc.
NL
malicious
2868
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2868
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2868
iexplore.exe
13.107.213.45:443
dotnet.microsoft.com
Microsoft Corporation
US
suspicious
2868
iexplore.exe
2.18.233.62:443
www.microsoft.com
Akamai International B.V.
—
whitelisted
2868
iexplore.exe
2.16.170.26:443
statics-marketingsites-wcus-ms-com.akamaized.net
Akamai International B.V.
DE
unknown
2868
iexplore.exe
2.16.170.25:443
img-prod-cms-rt-microsoft-com.akamaized.net
Akamai International B.V.
DE
unknown
2868
iexplore.exe
13.107.246.45:443
dotnet.microsoft.com
Microsoft Corporation
US
malicious
2868
iexplore.exe
173.194.198.101:443
www.google-analytics.com
Google Inc.
US
unknown
2868
iexplore.exe
142.250.186.131:80
ocsp.pki.goog
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
go.microsoft.com
  • 23.15.254.176
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
dotnet.microsoft.com
  • 13.107.213.45
  • 13.107.246.45
whitelisted
statics-marketingsites-wcus-ms-com.akamaized.net
  • 2.16.170.26
  • 2.16.170.10
whitelisted
www.microsoft.com
  • 2.18.233.62
whitelisted
img-prod-cms-rt-microsoft-com.akamaized.net
  • 2.16.170.25
  • 2.16.170.11
whitelisted
wcpstatic.microsoft.com
  • 13.107.246.45
  • 13.107.213.45
whitelisted
www.google-analytics.com
  • 173.194.198.101
  • 173.194.198.102
  • 173.194.198.138
  • 173.194.198.139
  • 173.194.198.113
  • 173.194.198.100
whitelisted
az416426.vo.msecnd.net
  • 152.199.21.175
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Guna UI Framework Ultimate 2.0.0.1 worldfreeware.com.zip