| download: | ExitLag+Crack |
| Full analysis: | https://app.any.run/tasks/edf4e5b0-5728-444b-ac97-4310f8a5d421 |
| Verdict: | Malicious activity |
| Analysis date: | November 21, 2021, 10:45:02 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | text/html |
| File info: | HTML document, ASCII text, with very long lines, with CRLF, LF line terminators |
| MD5: | B0CF89B808DCDE85D8A7A2EABB34AE22 |
| SHA1: | F205955CA0FB0E9DD51B948735B397D215B7C21A |
| SHA256: | 8B6EE0FF8DBA9A4F13CC1A64D80CDAC803ADA7DCB3B897A1D3558483DDFED607 |
| SSDEEP: | 3072:MIHm8xGy4oNF5bFoR7qqHY5NRs32HccNPXK+g3n6+3x0g1:jv9buS5NRsGHccNPXK+g3n6+3x06 |
MALICIOUS
No malicious indicators.SUSPICIOUS
Reads the date of Windows installation
- rundll32.exe (PID: 1988)
INFO
Reads the computer name
- rundll32.exe (PID: 3204)
- AcroRd32.exe (PID: 2256)
- AcroRd32.exe (PID: 2552)
- RdrCEF.exe (PID: 2600)
- rundll32.exe (PID: 1988)
- firefox.exe (PID: 1304)
- firefox.exe (PID: 2652)
- firefox.exe (PID: 3252)
- firefox.exe (PID: 2452)
- firefox.exe (PID: 4040)
- firefox.exe (PID: 3076)
Checks supported languages
- rundll32.exe (PID: 3204)
- AcroRd32.exe (PID: 2256)
- AcroRd32.exe (PID: 2552)
- RdrCEF.exe (PID: 2600)
- RdrCEF.exe (PID: 3464)
- RdrCEF.exe (PID: 3104)
- RdrCEF.exe (PID: 2628)
- RdrCEF.exe (PID: 3384)
- RdrCEF.exe (PID: 2912)
- RdrCEF.exe (PID: 984)
- rundll32.exe (PID: 1988)
- firefox.exe (PID: 3744)
- firefox.exe (PID: 1304)
- firefox.exe (PID: 2652)
- firefox.exe (PID: 3252)
- firefox.exe (PID: 2452)
- firefox.exe (PID: 3076)
- firefox.exe (PID: 4040)
Reads CPU info
- AcroRd32.exe (PID: 2552)
- firefox.exe (PID: 1304)
Searches for installed software
- AcroRd32.exe (PID: 2256)
- AcroRd32.exe (PID: 2552)
Application launched itself
- AcroRd32.exe (PID: 2256)
- RdrCEF.exe (PID: 2600)
- firefox.exe (PID: 3744)
- firefox.exe (PID: 1304)
Reads the hosts file
- RdrCEF.exe (PID: 2600)
Reads settings of System Certificates
- AcroRd32.exe (PID: 2256)
- RdrCEF.exe (PID: 2600)
Checks Windows Trust Settings
- AcroRd32.exe (PID: 2256)
Manual execution by user
- rundll32.exe (PID: 1988)
Creates files in the user directory
- firefox.exe (PID: 1304)
Creates files in the program directory
- firefox.exe (PID: 1304)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
EXIF
HTML
| ContentType: | text/html; charset=iso-8859-1 |
|---|---|
| Title: | My Files |
| Keywords: | online storage, free storage, cloud Storage, collaboration, backup file Sharing, share Files, photo backup, photo sharing, ftp replacement, cross platform, remote access, mobile access, send large files, recover files, file versioning, undelete, Windows, PC, Mac, OS X, Linux, iPhone, iPad, Android |
| Description: | MediaFire is a simple to use free service that lets you put all your photos, documents, music, and video in a single place so you can access them anywhere and share them everywhere. |
| Robots: | NOINDEX,FOLLOW |
| GoogleBot: | NOINDEX,FOLLOW |
| SLURP: | NOINDEX,FOLLOW |
| googleTranslateCustomization: | 5587c1b0a958bf07-62a8e309de686e87-gc92f61279a2c8524-11 |
| CacheControl: | no-store, no-cache, must-revalidate, post-check=0, pre-check=0 |
| Pragma: | no-cache |
| Expires: | - |
| HTTPEquivXUACompatible: | IE=edge,chrome=1 |
| appleItunesApp: | app-id=555646196 |
| viewport: | width=device-width, initial-scale=1.0 |
| msapplicationTileImage: | favicon.png |
| msapplicationTileColor: | #0077ff |
| themeColor: | #0077ff |
Total processes
53
Monitored processes
18
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 984 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1180,459129065020193308,15840365432209842180,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-gpu-compositing --lang=en-US --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.13.20064 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=17172671217669031557 --renderer-client-id=7 --mojo-platform-channel-handle=1524 --allow-no-sandbox-job /prefetch:1 | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe | — | RdrCEF.exe | |||||||||||
User: admin Company: Adobe Systems Incorporated Integrity Level: LOW Description: Adobe RdrCEF Exit code: 0 Version: 20.13.20064.405839 Modules
| |||||||||||||||
| 1304 | "C:\Program Files\Mozilla Firefox\firefox.exe" -url C:\Users\admin\Desktop\ExitLag+Crack | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 83.0 Modules
| |||||||||||||||
| 1988 | "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\ExitLag+Crack | C:\Windows\system32\rundll32.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2256 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\admin\Desktop\ExitLag+Crack" | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | rundll32.exe | ||||||||||||
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe Acrobat Reader DC Exit code: 0 Version: 20.13.20064.405839 Modules
| |||||||||||||||
| 2452 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1304.13.34993060\1944973279" -childID 2 -isForBrowser -prefsHandle 3212 -prefMapHandle 2088 -prefsLen 6644 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1304 "\\.\pipe\gecko-crash-server-pipe.1304" 3276 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 83.0 Modules
| |||||||||||||||
| 2552 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer "C:\Users\admin\Desktop\ExitLag+Crack" | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | — | AcroRd32.exe | |||||||||||
User: admin Company: Adobe Systems Incorporated Integrity Level: LOW Description: Adobe Acrobat Reader DC Exit code: 0 Version: 20.13.20064.405839 Modules
| |||||||||||||||
| 2600 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043 | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe | AcroRd32.exe | ||||||||||||
User: admin Company: Adobe Systems Incorporated Integrity Level: LOW Description: Adobe RdrCEF Exit code: 0 Version: 20.13.20064.405839 Modules
| |||||||||||||||
| 2628 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --field-trial-handle=1180,459129065020193308,15840365432209842180,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.13.20064 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --service-request-channel-token=8692148732685275002 --mojo-platform-channel-handle=1412 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2 | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe | — | RdrCEF.exe | |||||||||||
User: admin Company: Adobe Systems Incorporated Integrity Level: LOW Description: Adobe RdrCEF Exit code: 1 Version: 20.13.20064.405839 Modules
| |||||||||||||||
| 2652 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1304.0.1006169998\1723765827" -parentBuildID 20201112153044 -prefsHandle 1116 -prefMapHandle 1132 -prefsLen 1 -prefMapSize 238726 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1304 "\\.\pipe\gecko-crash-server-pipe.1304" 1204 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 83.0 Modules
| |||||||||||||||
| 2912 | "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1180,459129065020193308,15840365432209842180,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-gpu-compositing --lang=en-US --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.13.20064 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=6777107805912125443 --renderer-client-id=6 --mojo-platform-channel-handle=1380 --allow-no-sandbox-job /prefetch:1 | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe | — | RdrCEF.exe | |||||||||||
User: admin Company: Adobe Systems Incorporated Integrity Level: LOW Description: Adobe RdrCEF Exit code: 0 Version: 20.13.20064.405839 Modules
| |||||||||||||||
Total events
16 684
Read events
16 527
Write events
154
Delete events
3
Modification events
| (PID) Process: | (3204) rundll32.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
| Operation: | write | Name: | C:\Windows\eHome\ehshell.exe |
Value: Windows Media Center | |||
| (PID) Process: | (3204) rundll32.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe |
Value: Firefox | |||
| (PID) Process: | (3204) rundll32.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
| Operation: | write | Name: | C:\Windows\system32\mspaint.exe |
Value: Paint | |||
| (PID) Process: | (3204) rundll32.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
| Operation: | write | Name: | C:\Windows\system32\NOTEPAD.EXE |
Value: Notepad | |||
| (PID) Process: | (3204) rundll32.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
| Operation: | write | Name: | C:\PROGRA~1\MICROS~1\Office14\OIS.EXE |
Value: Microsoft Office 2010 | |||
| (PID) Process: | (3204) rundll32.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
| Operation: | write | Name: | C:\Program Files\Opera\Opera.exe |
Value: Opera Internet Browser | |||
| (PID) Process: | (3204) rundll32.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
| Operation: | write | Name: | C:\Program Files\Windows Photo Viewer\PhotoViewer.dll |
Value: Windows Photo Viewer | |||
| (PID) Process: | (3204) rundll32.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
| Operation: | write | Name: | C:\Program Files\VideoLAN\VLC\vlc.exe |
Value: VLC media player | |||
| (PID) Process: | (3204) rundll32.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
| Operation: | write | Name: | C:\Program Files\Microsoft Office\Office14\WINWORD.EXE |
Value: Microsoft Word | |||
| (PID) Process: | (3204) rundll32.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
Executable files
0
Suspicious files
126
Text files
7
Unknown types
9
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2600 | RdrCEF.exe | C:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0 | binary | |
MD5:— | SHA256:— | |||
| 2600 | RdrCEF.exe | C:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0 | binary | |
MD5:— | SHA256:— | |||
| 2600 | RdrCEF.exe | C:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0 | binary | |
MD5:— | SHA256:— | |||
| 2600 | RdrCEF.exe | C:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0 | binary | |
MD5:— | SHA256:— | |||
| 2600 | RdrCEF.exe | C:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0 | binary | |
MD5:— | SHA256:— | |||
| 2600 | RdrCEF.exe | C:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0 | binary | |
MD5:— | SHA256:— | |||
| 2600 | RdrCEF.exe | C:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\72d9f526d2e2e7c8_0 | binary | |
MD5:— | SHA256:— | |||
| 2600 | RdrCEF.exe | C:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0 | binary | |
MD5:— | SHA256:— | |||
| 2600 | RdrCEF.exe | C:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0 | binary | |
MD5:— | SHA256:— | |||
| 2600 | RdrCEF.exe | C:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\983b7a3da8f39a46_0 | binary | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
55
TCP/UDP connections
46
DNS requests
75
Threats
1
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1304 | firefox.exe | GET | 404 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt | US | xml | 341 b | whitelisted |
2256 | AcroRd32.exe | GET | 404 | 93.184.221.240:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6919f243072bf802 | US | xml | 341 b | whitelisted |
2256 | AcroRd32.exe | GET | 404 | 209.197.3.8:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c0f40b1caea2e2d4 | US | xml | 341 b | whitelisted |
2256 | AcroRd32.exe | GET | 404 | 92.123.225.59:80 | http://acroipm2.adobe.com/20/rdr/ENU/win/nooem/none/consumer/277_20_13_20064.zip | unknown | xml | 341 b | whitelisted |
1304 | firefox.exe | GET | 404 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt | US | xml | 341 b | whitelisted |
1304 | firefox.exe | GET | 404 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt | US | xml | 341 b | whitelisted |
1304 | firefox.exe | GET | 404 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt | US | xml | 341 b | whitelisted |
1304 | firefox.exe | GET | 404 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt | US | xml | 341 b | whitelisted |
1304 | firefox.exe | GET | 404 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt | US | xml | 341 b | whitelisted |
1304 | firefox.exe | GET | 404 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt | US | xml | 341 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2600 | RdrCEF.exe | 2.21.141.61:443 | geo2.adobe.com | Telia Company AB | — | suspicious |
2600 | RdrCEF.exe | 52.22.41.97:443 | p13n.adobe.io | Amazon.com, Inc. | US | unknown |
2256 | AcroRd32.exe | 92.123.225.59:443 | acroipm2.adobe.com | Akamai International B.V. | — | suspicious |
2256 | AcroRd32.exe | 209.197.3.8:80 | ctldl.windowsupdate.com | Highwinds Network Group, Inc. | US | whitelisted |
2256 | AcroRd32.exe | 92.123.225.59:80 | acroipm2.adobe.com | Akamai International B.V. | — | suspicious |
2256 | AcroRd32.exe | 93.184.221.240:80 | ctldl.windowsupdate.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
1304 | firefox.exe | 34.107.221.82:80 | detectportal.firefox.com | — | US | whitelisted |
— | — | 172.217.18.106:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
— | — | 142.250.181.228:443 | www.google.com | Google Inc. | US | whitelisted |
1304 | firefox.exe | 104.16.203.237:443 | www.mediafire.com | Cloudflare Inc | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
geo2.adobe.com |
| whitelisted |
p13n.adobe.io |
| whitelisted |
armmf.adobe.com |
| whitelisted |
acroipm2.adobe.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
detectportal.firefox.com |
| whitelisted |
prod.detectportal.prod.cloudops.mozgcp.net |
| whitelisted |
fonts.googleapis.com |
| whitelisted |
www.google.com |
| malicious |
ajax.googleapis.com |
| whitelisted |
Threats
1 ETPRO signatures available at the full report