| URL: | https://dl03.magix.net/trial_3d_maker7_dlv_dlm.exe?dwl=1 |
| Full analysis: | https://app.any.run/tasks/885342fd-3771-47ba-a6ed-882c34b5f297 |
| Verdict: | Malicious activity |
| Threats: | Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security. |
| Analysis date: | May 01, 2020, 15:15:55 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 22F8F15452CF4BAB65A0875C74076E79 |
| SHA1: | 94E1FA206E43CF4EBB5496EC1F3AFAB3AB2FB7A3 |
| SHA256: | 73CC46371D79BB2BF051C56288BA2AFC9542C06647E842485C1BA504DF2EDD55 |
| SSDEEP: | 3:N8RDY6iME0WKv5/2l/2:2NVeKvd |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 772 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3336.20.804425676\812130801" -childID 3 -isForBrowser -prefsHandle 3592 -prefMapHandle 3588 -prefsLen 6718 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3336 "\\.\pipe\gecko-crash-server-pipe.3336" 3612 tab | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 68.0.1 Modules
| |||||||||||||||
| 1456 | "C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Documents\MAGIX Downloads\Installationsmanager\3D_Maker_7_DLV_de-DE_120926_10-48_7_0_0_499.exe" "C:\Users\admin\Documents\MAGIX Downloads\Installationsmanager\3D_Maker_7_DLV_de-DE_120926_10-48_7_0_0_499\" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 6 Version: 5.60.0 Modules
| |||||||||||||||
| 1564 | "C:\Program Files\WinRAR\WinRAR.exe" a -ep1 -scul -r0 -iext -- 3D_Maker_7_DLV_de-DE_120926_10-48_7_0_0_499.rar "C:\Users\admin\Documents\MAGIX Downloads\Installationsmanager\3D_Maker_7_DLV_de-DE_120926_10-48_7_0_0_499.exe" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 2124 | "C:\Users\admin\AppData\Local\Temp\mgx43kxfcmm\addon\Ask\AskInstallChecker-1.5.0.0.exe" MGX /nowzup | C:\Users\admin\AppData\Local\Temp\mgx43kxfcmm\addon\Ask\AskInstallChecker-1.5.0.0.exe | 3D_Maker_7_de-DE_setup.exe | ||||||||||||
User: admin Company: Ask.com Integrity Level: HIGH Description: Install Checker Exit code: 0 Version: 1.5.0.0 Modules
| |||||||||||||||
| 2228 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3336.0.1190186956\906235439" -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3336 "\\.\pipe\gecko-crash-server-pipe.3336" 1152 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 68.0.1 Modules
| |||||||||||||||
| 2536 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3336.34.102969303\504056164" -childID 5 -isForBrowser -prefsHandle 3752 -prefMapHandle 4000 -prefsLen 8268 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3336 "\\.\pipe\gecko-crash-server-pipe.3336" 3040 tab | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 68.0.1 Modules
| |||||||||||||||
| 2644 | "C:\Users\admin\AppData\Local\Temp\mgx43kxfcmm\product\3D_Maker_7_de-DE_setup.exe" /M="C:\Users\admin\AppData\Local\Temp\mgxnnir3w66ma\SetupValues.dat" | C:\Users\admin\AppData\Local\Temp\mgx43kxfcmm\product\3D_Maker_7_de-DE_setup.exe | — | 3D_Maker_7_DLV_de-DE_120926_10-48_7_0_0_499.exe | |||||||||||
User: admin Company: MAGIX AG Integrity Level: HIGH Description: MAGIX 3D Maker 7 Download-Version Exit code: 0 Version: 3.3.4480.0 Modules
| |||||||||||||||
| 2972 | "C:\Users\admin\Documents\MAGIX Downloads\Installationsmanager\3D_Maker_7_DLV_de-DE_120926_10-48_7_0_0_499.exe" /M="C:\Users\admin\AppData\Local\Temp\mgxnnir3w66ma\SetupValues.dat" | C:\Users\admin\Documents\MAGIX Downloads\Installationsmanager\3D_Maker_7_DLV_de-DE_120926_10-48_7_0_0_499.exe | MxDownloadManager.exe | ||||||||||||
User: admin Company: MAGIX AG Integrity Level: HIGH Description: MAGIX 3D Maker 7 Download-Version (de-DE) Exit code: 0 Version: 7.0.0.499 Modules
| |||||||||||||||
| 3064 | "C:\Users\admin\AppData\Local\Temp\mgxnnir3w66ma\MxDownloadManager.exe" -m C:\Users\admin\AppData\Local\Temp\mgxnnir3w66ma\SetupValues.dat -s 3D7_trial -r | C:\Users\admin\AppData\Local\Temp\mgxnnir3w66ma\MxDownloadManager.exe | — | trial_3d_maker7_dlv_dlm.exe | |||||||||||
User: admin Company: MAGIX AG Integrity Level: MEDIUM Description: Installationsmanager Exit code: 3221226540 Version: 1, 0, 0, 12 Modules
| |||||||||||||||
| 3336 | "C:\Program Files\Mozilla Firefox\firefox.exe" https://dl03.magix.net/trial_3d_maker7_dlv_dlm.exe?dwl=1 | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 68.0.1 Modules
| |||||||||||||||
| (PID) Process: | (4052) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Launcher |
Value: 560F0EF408000000 | |||
| (PID) Process: | (3336) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Browser |
Value: 361B12F408000000 | |||
| (PID) Process: | (3336) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry |
Value: 1 | |||
| (PID) Process: | (3336) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
| (PID) Process: | (3336) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
| Operation: | write | Name: | SavedLegacySettings |
Value: 46000000A1000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000 | |||
| (PID) Process: | (3336) firefox.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3336) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (3336) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (3680) trial_3d_maker7_dlv_dlm.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (3680) trial_3d_maker7_dlv_dlm.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3336 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin | — | |
MD5:— | SHA256:— | |||
| 3336 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js | — | |
MD5:— | SHA256:— | |||
| 3336 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp | — | |
MD5:— | SHA256:— | |||
| 3336 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4.tmp | — | |
MD5:— | SHA256:— | |||
| 3336 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.js | text | |
MD5:— | SHA256:— | |||
| 3336 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4 | jsonlz4 | |
MD5:— | SHA256:— | |||
| 3336 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-child-current.bin | binary | |
MD5:— | SHA256:— | |||
| 3336 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.bin | binary | |
MD5:— | SHA256:— | |||
| 3336 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\base-track-digest256.sbstore | binary | |
MD5:— | SHA256:— | |||
| 3336 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3336 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
3336 | firefox.exe | POST | 200 | 99.86.7.108:80 | http://ocsp.sca1b.amazontrust.com/ | US | der | 471 b | whitelisted |
3336 | firefox.exe | POST | 200 | 172.217.23.99:80 | http://ocsp.pki.goog/gts1o1 | US | der | 471 b | whitelisted |
3336 | firefox.exe | POST | 200 | 172.217.23.99:80 | http://ocsp.pki.goog/gts1o1 | US | der | 472 b | whitelisted |
3336 | firefox.exe | POST | 200 | 172.217.23.99:80 | http://ocsp.pki.goog/gts1o1 | US | der | 471 b | whitelisted |
3336 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 471 b | whitelisted |
3336 | firefox.exe | POST | 200 | 172.217.23.99:80 | http://ocsp.pki.goog/gts1o1 | US | der | 471 b | whitelisted |
3336 | firefox.exe | POST | 200 | 2.20.190.17:80 | http://ocsp.int-x3.letsencrypt.org/ | unknown | der | 527 b | whitelisted |
3336 | firefox.exe | POST | 200 | 172.217.23.99:80 | http://ocsp.pki.goog/gts1o1 | US | der | 472 b | whitelisted |
3336 | firefox.exe | POST | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/ | US | der | 280 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3336 | firefox.exe | 195.214.216.59:443 | dl03.magix.net | Interoute Communications Limited | DE | suspicious |
3336 | firefox.exe | 2.16.186.50:80 | detectportal.firefox.com | Akamai International B.V. | — | whitelisted |
3336 | firefox.exe | 52.38.153.3:443 | search.services.mozilla.com | Amazon.com, Inc. | US | unknown |
3336 | firefox.exe | 13.35.253.14:443 | snippets.cdn.mozilla.net | — | US | unknown |
3336 | firefox.exe | 172.217.22.10:443 | safebrowsing.googleapis.com | Google Inc. | US | whitelisted |
3336 | firefox.exe | 172.217.23.99:80 | ocsp.pki.goog | Google Inc. | US | whitelisted |
3336 | firefox.exe | 172.217.23.99:443 | ocsp.pki.goog | Google Inc. | US | whitelisted |
3336 | firefox.exe | 54.175.6.185:443 | async-px.dynamicyield.com | Amazon.com, Inc. | US | unknown |
3336 | firefox.exe | 99.86.7.108:80 | ocsp.sca1b.amazontrust.com | AT&T Services, Inc. | US | whitelisted |
3336 | firefox.exe | 172.217.22.67:443 | fonts.gstatic.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
detectportal.firefox.com |
| whitelisted |
dl03.magix.net |
| malicious |
a1089.dscd.akamai.net |
| whitelisted |
search.services.mozilla.com |
| whitelisted |
search.r53-2.services.mozilla.com |
| whitelisted |
push.services.mozilla.com |
| whitelisted |
autopush.prod.mozaws.net |
| whitelisted |
snippets.cdn.mozilla.net |
| whitelisted |
d228z91au11ukj.cloudfront.net |
| whitelisted |
safebrowsing.googleapis.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
3956 | MxDownloadManager.exe | Misc activity | ADWARE [PTsecurity] NSIS.DealPly.xiazai |
3956 | MxDownloadManager.exe | Misc activity | ADWARE [PTsecurity] NSIS.DealPly.xiazai |
3956 | MxDownloadManager.exe | Misc activity | ADWARE [PTsecurity] NSIS.DealPly.xiazai |
3956 | MxDownloadManager.exe | Misc activity | ADWARE [PTsecurity] NSIS.DealPly.xiazai |
3956 | MxDownloadManager.exe | Misc activity | ADWARE [PTsecurity] NSIS.DealPly.xiazai |
3956 | MxDownloadManager.exe | Misc activity | ADWARE [PTsecurity] NSIS.DealPly.xiazai |
3956 | MxDownloadManager.exe | Misc activity | ADWARE [PTsecurity] NSIS.DealPly.xiazai |
3956 | MxDownloadManager.exe | Misc activity | ADWARE [PTsecurity] NSIS.DealPly.xiazai |
3956 | MxDownloadManager.exe | Misc activity | ADWARE [PTsecurity] NSIS.DealPly.xiazai |
3956 | MxDownloadManager.exe | Misc activity | ADWARE [PTsecurity] NSIS.DealPly.xiazai |