File name:

Safengine.rar

Full analysis: https://app.any.run/tasks/d1b0c576-f938-49dd-8629-5c01ec470a65
Verdict: Malicious activity
Analysis date: April 12, 2020, 17:46:49
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

2D60A792020A69FB9D26148151C6CAF0

SHA1:

934996728DF45068B23663C47F7CBF6439464B45

SHA256:

66C9525BC7F57BC745EC989A7E9591AE9F5BB022D4EDEA905E19AF165B504691

SSDEEP:

196608:xGKjt2jzVXsEudvMLMZGTj/eoHIJo0FVUa4dwmFH+Df+1QKcgzrwYpZoM7i:xGTN4dEMoTjzN0v8XFea9cg3ZpA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 2104)
      • Shielden.exe (PID: 3352)
      • Shielden.exe (PID: 2668)

    • Application was dropped or rewritten from another process

      • GetHWID.exe (PID: 3568)
      • Shielden.exe (PID: 3352)
      • Shielden.exe (PID: 2668)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1948)
      • Shielden.exe (PID: 3352)

  • INFO

    • Manual execution by user

      • Shielden.exe (PID: 2668)
      • GetHWID.exe (PID: 3568)
      • cmd.exe (PID: 3292)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

CompressedSize: 891562
UncompressedSize: 5028352
OperatingSystem: Win32
ModifyDate: 2016:03:29 00:59:03
PackingMethod: Normal
ArchivedFileName: Safengine\Safengine\BinRes\libmysql.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
6
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe searchprotocolhost.exe no specs shielden.exe no specs gethwid.exe no specs cmd.exe no specs shielden.exe

Process information

PID
CMD
Path
Indicators
Parent process
1948"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Safengine.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2104"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2668"C:\Users\admin\Desktop\Safengine\Safengine\Shielden.exe" C:\Users\admin\Desktop\Safengine\Safengine\Shielden.exe—explorer.exe
User:
admin
Company:
Safengine
Integrity Level:
MEDIUM
Description:
Shielden - Professional Software Protection Tool
Exit code:
0
Version:
2.4.0.0
Modules
Images
c:\users\admin\desktop\safengine\safengine\shielden.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3292cmd /c ""C:\Users\admin\Desktop\Safengine\Safengine\Shielden_Slim.cmd" "C:\Windows\system32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3352Shielden.exe /slimC:\Users\admin\Desktop\Safengine\Safengine\Shielden.exe
cmd.exe
User:
admin
Company:
Safengine
Integrity Level:
MEDIUM
Description:
Shielden - Professional Software Protection Tool
Exit code:
0
Version:
2.4.0.0
Modules
Images
c:\users\admin\desktop\safengine\safengine\shielden.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3568"C:\Users\admin\Desktop\Safengine\Safengine\GetHWID.exe" C:\Users\admin\Desktop\Safengine\Safengine\GetHWID.exe—explorer.exe
User:
admin
Company:
Safengine
Integrity Level:
MEDIUM
Description:
Safengine - Professional Software Protection Tool
Exit code:
0
Version:
2.4.0.0
Modules
Images
c:\users\admin\desktop\safengine\safengine\gethwid.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
Total events
1 350
Read events
1 278
Write events
71
Delete events
1

Modification events

(PID) Process:(1948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1948) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Safengine.rar
(PID) Process:(1948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(1948) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\AppData\Local\Temp
Executable files
20
Suspicious files
6
Text files
343
Unknown types
5

Dropped files

PID
Process
Filename
Type
1948WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1948.46106\Safengine\Safengine\GetHWID.exeexecutable
MD5:B59B71515091F8CEA154332B5B70DEFD
SHA256:07EDA2020FF34FF8ED1F24A71305839BD5054B6635D3999B66823C850589D21C
1948WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1948.46106\Safengine\Safengine\BinRes\libmysql.dllexecutable
MD5:3CEB6BDC8FCEA51E364731499F8589B6
SHA256:F82789AB4BAC5F65BE0565A5FC6B41B8C47A35BFF47FEA6A8BB6219CFFE225AF
1948WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1948.46106\Safengine\Safengine\EULA\EULA_CN.txttext
MD5:91F26AEEA49C90E3853A24D7749D361C
SHA256:29793D5F7CA4B6CF5F44BDF9B012DAC4BD0B597DFAFD8495C2920DFD5FA32210
1948WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1948.46106\Safengine\Safengine\EULA\EULA_EN.txttext
MD5:2295D33BEF6360057B750156A6132AF9
SHA256:1931032C0673713618AB20EE0A242FA1BA6FD79EAB779861DD2F9595D1137368
1948WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1948.46106\Safengine\Safengine\EULA\TaggantLicense.txttext
MD5:90808DA4A6E2E1A1E3B48980FFEFA41E
SHA256:FA672628D6B45C5C4D56D5D00205C5D90C66A40FA801F67BA63523DF326E8051
1948WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1948.46106\Safengine\Safengine\HelpCN.chmchm
MD5:184444AE248B1C476DF648E408BB0717
SHA256:800180DA47DD2741A9BD37FDE29EC31A4693FCD84863F2F4474119943A244791
1948WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1948.46106\Safengine\Safengine\LicenseDB\createdb.sqltext
MD5:D49019E80DD54FEFB7CACCF700A395EA
SHA256:A44673DD8F669BB72AD251CE403F321694AFC8A55EF3C284FFAD95CF45ECB45E
1948WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1948.46106\Safengine\Safengine\Langs\CHT.dllexecutable
MD5:793BB9CED19FDF76238B15693D3CF4B5
SHA256:0C7C6C376AEE8E5D719BB4C026020047035262688E8D2BDB31E81C2DB06C8B4B
1948WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1948.46106\Safengine\Safengine\LicenseDB\Readme.txttext
MD5:752D4354B5F51695F6A79E864ACE31B5
SHA256:3DBED6F51FE711EB8AFCB21B41A82B530A995D2DCD36F9867975D936FD5C5238
1948WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1948.46106\Safengine\Safengine\LicenseDB\webfront\web\admin\index.phptext
MD5:E217B694BC7BBAA26C21C4984501AC38
SHA256:13E4C5A89DA806C47B1501D5543A384C80DC50AC26C1402AB4ED61A54F186722
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Safengine.rar