File name: | Panel for all emulators Latest.zip |
Full analysis: | https://app.any.run/tasks/fd88e839-e713-4664-8347-c0d3f4e0d7da |
Verdict: | Malicious activity |
Analysis date: | May 21, 2022, 05:24:25 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/zip |
File info: | Zip archive data, at least v1.0 to extract |
MD5: | 477B2BA80DF9F81FAE21F6A986F3CB2A |
SHA1: | 2EE58B4F77C58CB9395C6F3F8C30E11EC6AC1D32 |
SHA256: | 85B1ECBD025F9ACB2C1DD74A3761522D476AF09527FCEB4CC890CA5E44D9DD1A |
SSDEEP: | 24576:bdcW3g4Kw6kAEGBrKbEI/bsRyYcK27K6a7KA1r1RQ7BKTS18/znWkVTqduJQ:b9Q48HEArKbEI/9Yk7K62Ku1RQ7gS182 |
.zip | | | ZIP compressed archive (100) |
---|
ZipFileName: | Panel for all emulators Latest/ |
---|---|
ZipUncompressedSize: | - |
ZipCompressedSize: | - |
ZipCRC: | 0x00000000 |
ZipModifyDate: | 2022:05:21 10:53:02 |
ZipCompression: | None |
ZipBitFlag: | - |
ZipRequiredVersion: | 10 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2492 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Panel for all emulators Latest.zip" | C:\Program Files\WinRAR\WinRAR.exe | Explorer.EXE | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 | ||||
336 | "C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\Rar$DIa2492.33157\KEY.txt | C:\Windows\system32\NOTEPAD.EXE | — | WinRAR.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
708 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa2492.33869\Panel for all emulators Latest\Runtime Broker.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa2492.33869\Panel for all emulators Latest\Runtime Broker.exe | — | WinRAR.exe |
User: admin Integrity Level: MEDIUM Description: No_Thing_Else_Cheats Exit code: 3221226540 Version: 1.0.0.0 | ||||
3280 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa2492.33869\Panel for all emulators Latest\Runtime Broker.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa2492.33869\Panel for all emulators Latest\Runtime Broker.exe | WinRAR.exe | |
User: admin Integrity Level: HIGH Description: No_Thing_Else_Cheats Exit code: 0 Version: 1.0.0.0 | ||||
188 | "cmd.exe" /c start cmd /C "color b && title Error && echo Not initialized Check if KeyAuthApp.init() does exist && timeout /t 5" | C:\Windows\system32\cmd.exe | — | Runtime Broker.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
1260 | cmd /C "color b && title Error && echo Not initialized Check if KeyAuthApp.init() does exist && timeout /t 5" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2376 | timeout /t 5 | C:\Windows\system32\timeout.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: timeout - pauses command processing Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2656 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa2492.35955\Panel for all emulators Latest\Runtime Broker.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa2492.35955\Panel for all emulators Latest\Runtime Broker.exe | — | WinRAR.exe |
User: admin Integrity Level: MEDIUM Description: No_Thing_Else_Cheats Exit code: 3221226540 Version: 1.0.0.0 | ||||
2036 | "C:\Users\admin\AppData\Local\Temp\Rar$EXa2492.35955\Panel for all emulators Latest\Runtime Broker.exe" | C:\Users\admin\AppData\Local\Temp\Rar$EXa2492.35955\Panel for all emulators Latest\Runtime Broker.exe | WinRAR.exe | |
User: admin Integrity Level: HIGH Description: No_Thing_Else_Cheats Exit code: 0 Version: 1.0.0.0 | ||||
2772 | "cmd.exe" /c start cmd /C "color b && title Error && echo Not initialized Check if KeyAuthApp.init() does exist && timeout /t 5" | C:\Windows\system32\cmd.exe | — | Runtime Broker.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) |
(PID) Process: | (2492) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (2492) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (2492) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (2492) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
(PID) Process: | (2492) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
(PID) Process: | (2492) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Panel for all emulators Latest.zip | |||
(PID) Process: | (2492) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (2492) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (2492) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (2492) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2492 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIa2492.33157\KEY.txt | text | |
MD5:6B907539A6EF037527EE603D89EF5A13 | SHA256:F756B29222A8E5710A17DAEC2C858BAA4306CCA0E853697004B8A482F310F9E5 | |||
2492 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2492.33869\Panel for all emulators Latest\KEY.txt | text | |
MD5:6B907539A6EF037527EE603D89EF5A13 | SHA256:F756B29222A8E5710A17DAEC2C858BAA4306CCA0E853697004B8A482F310F9E5 | |||
2492 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2492.33869\Panel for all emulators Latest\Memory.dll | executable | |
MD5:8C7A3DB56C91E79D73D229836EF3D2D8 | SHA256:89F07A0440959C3B9D99C30539AA16F5FADEF4D60E75C81F7C18A7104F2D91CB | |||
2492 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2492.35955\Panel for all emulators Latest\KEY.txt | text | |
MD5:6B907539A6EF037527EE603D89EF5A13 | SHA256:F756B29222A8E5710A17DAEC2C858BAA4306CCA0E853697004B8A482F310F9E5 | |||
2492 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2492.33869\Panel for all emulators Latest\Runtime Broker.exe | executable | |
MD5:703F838EF0AD94A536922AFC6C3C2237 | SHA256:714F584839554E62A08896A26B39901507429C0B4090D8EE5C1B2D3D7020BC91 | |||
2492 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2492.35955\Panel for all emulators Latest\discord-rpc.dll | executable | |
MD5:5882C37B79BAE47A0D090006564EDB22 | SHA256:5CC2E504800CF4ED2F4781364F661EA22349658DDC391B5D54195E573109D87B | |||
2492 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2492.33869\Panel for all emulators Latest\discord-rpc.dll | executable | |
MD5:5882C37B79BAE47A0D090006564EDB22 | SHA256:5CC2E504800CF4ED2F4781364F661EA22349658DDC391B5D54195E573109D87B | |||
2492 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2492.35955\Panel for all emulators Latest\MetroFramework.dll | executable | |
MD5:44538B311E9EC2BCF0A6452702628D99 | SHA256:BAF326F52D39155D722465947F4CC67E6E90CFD0F89954EAB959568E9BC342AA | |||
2492 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2492.35955\Panel for all emulators Latest\Runtime Broker.exe | executable | |
MD5:703F838EF0AD94A536922AFC6C3C2237 | SHA256:714F584839554E62A08896A26B39901507429C0B4090D8EE5C1B2D3D7020BC91 | |||
2492 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa2492.35955\Panel for all emulators Latest\Memory.dll | executable | |
MD5:8C7A3DB56C91E79D73D229836EF3D2D8 | SHA256:89F07A0440959C3B9D99C30539AA16F5FADEF4D60E75C81F7C18A7104F2D91CB |