File name:

All-in-One Checker_cracked.rar

Full analysis: https://app.any.run/tasks/c12f405c-7ed6-4aae-b39b-e00b1c6dfad0
Verdict: Malicious activity
Analysis date: March 15, 2018, 21:46:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

F86CA765916112D73261B3A6EC30700A

SHA1:

DA7E74148E3992CE7264F96FEEAC396BA5D1DC59

SHA256:

664E55CD9E7A0B8A61E220F5B4A5D5601F32C87AE19F3029A824848F8FD1D477

SSDEEP:

49152:pinblRMivrA/0T2kusb/BD7UTtFbElUdZWZt5rJgtu299QR8zIC:+5R9n2PYRUDYWwt5VoPQuzIC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • All-in-One Checker_cracked.exe (PID: 2168)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Dropped object may contain URL's

      • 7zG.exe (PID: 3000)

    • Loads the .NET runtime environment

      • All-in-One Checker_cracked.exe (PID: 2168)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 7zfm.exe no specs 7zg.exe all-in-one checker_cracked.exe

Process information

PID
CMD
Path
Indicators
Parent process
2168"C:\Users\admin\Desktop\All-in-One Checker_cracked\All-in-One Checker_cracked.exe" C:\Users\admin\Desktop\All-in-One Checker_cracked\All-in-One Checker_cracked.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
All-in-One Checker
Exit code:
0
Version:
4.9.8.3
Modules
Images
c:\users\admin\desktop\all-in-one checker_cracked\all-in-one checker_cracked.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2816"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\admin\AppData\Local\Temp\All-in-One Checker_cracked.rar"C:\Program Files\7-Zip\7zFM.exe—explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip File Manager
Exit code:
0
Version:
16.04
Modules
Images
c:\program files\7-zip\7zfm.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3000"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\admin\Desktop\All-in-One Checker_cracked\" -spe -slp- -an -ai#7zMap25993:110:7zEvent1517C:\Program Files\7-Zip\7zG.exe
explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip GUI
Exit code:
0
Version:
16.04
Modules
Images
c:\program files\7-zip\7zg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
76
Read events
59
Write events
17
Delete events
0

Modification events

(PID) Process:(2816) 7zFM.exeKey:HKEY_CURRENT_USER\Software\7-Zip\FM\Columns
Operation:writeName:7-Zip.Rar5
Value:
0100000004000000010000000400000001000000A00000000700000001000000640000000800000001000000640000000C00000001000000640000000A00000001000000640000000B00000001000000640000000900000001000000640000003F00000001000000640000000F00000001000000640000000D00000001000000640000001000000001000000640000001100000001000000640000001300000001000000640000001700000001000000640000001600000001000000640000003600000001000000640000005A00000001000000640000005F00000001000000640000001F00000001000000640000002000000001000000640000002E00000001000000640000003E0000000100000064000000
(PID) Process:(2816) 7zFM.exeKey:HKEY_CURRENT_USER\Software\7-Zip\FM
Operation:writeName:FolderShortcuts
Value:
(PID) Process:(2816) 7zFM.exeKey:HKEY_CURRENT_USER\Software\7-Zip\FM
Operation:writeName:FolderHistory
Value:
43003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C00000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C0041006C006C002D0069006E002D004F006E006500200043006800650063006B00650072005F0063007200610063006B00650064002E007200610072005C000000
(PID) Process:(2816) 7zFM.exeKey:HKEY_CURRENT_USER\Software\7-Zip\FM
Operation:writeName:PanelPath0
Value:
C:\Users\admin\AppData\Local\Temp\
(PID) Process:(2816) 7zFM.exeKey:HKEY_CURRENT_USER\Software\7-Zip\FM
Operation:writeName:FlatViewArc0
Value:
0
(PID) Process:(2816) 7zFM.exeKey:HKEY_CURRENT_USER\Software\7-Zip\FM
Operation:writeName:PanelPath1
Value:
(PID) Process:(2816) 7zFM.exeKey:HKEY_CURRENT_USER\Software\7-Zip\FM
Operation:writeName:FlatViewArc1
Value:
0
(PID) Process:(2816) 7zFM.exeKey:HKEY_CURRENT_USER\Software\7-Zip\FM
Operation:writeName:ListMode
Value:
771
(PID) Process:(2816) 7zFM.exeKey:HKEY_CURRENT_USER\Software\7-Zip\FM
Operation:writeName:Position
Value:
1600000016000000D60300000B02000000000000
(PID) Process:(2816) 7zFM.exeKey:HKEY_CURRENT_USER\Software\7-Zip\FM
Operation:writeName:Panels
Value:
0100000000000000DA010000
Executable files
1
Suspicious files
0
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
30007zG.exeC:\Users\admin\Desktop\All-in-One Checker_cracked\DefaultServers.json —
MD5:—
SHA256:—
30007zG.exeC:\Users\admin\Desktop\All-in-One Checker_cracked\Config\All-in-One Checker.confxml
MD5:—
SHA256:—
30007zG.exeC:\Users\admin\Desktop\All-in-One Checker_cracked\Results\23.08_04.27\Bad.txttext
MD5:—
SHA256:—
30007zG.exeC:\Users\admin\Desktop\All-in-One Checker_cracked\Results\23.08_04.27\Good.txttext
MD5:—
SHA256:—
30007zG.exeC:\Users\admin\Desktop\All-in-One Checker_cracked\Results\23.08_04.29\Bad.txttext
MD5:—
SHA256:—
30007zG.exeC:\Users\admin\Desktop\All-in-One Checker_cracked\Results\23.08_04.27\Error.txttext
MD5:—
SHA256:—
30007zG.exeC:\Users\admin\Desktop\All-in-One Checker_cracked\All-in-One Checker_cracked.exeexecutable
MD5:DB3B640C51AC0883ED4326EFD068459C
SHA256:1571C83B0C8BB5A4E0728896553836101354FA899056943673C23DCB951A4932
30007zG.exeC:\Users\admin\Desktop\All-in-One Checker_cracked\Results\23.08_04.29\Blocked.txttext
MD5:—
SHA256:—
30007zG.exeC:\Users\admin\Desktop\All-in-One Checker_cracked\Results\23.08_04.29\Error.txttext
MD5:—
SHA256:—
30007zG.exeC:\Users\admin\Desktop\All-in-One Checker_cracked\Results\23.08_04.29\Good.txttext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
All-in-One Checker_cracked.rar