File name:

binaries.7z

Full analysis: https://app.any.run/tasks/877cd101-61c6-4949-bb5e-316dc86a6c70
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: July 03, 2021, 22:51:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

CB33309B3C76278395422ACE5C1529DC

SHA1:

9C901F95A70ED67AC2C4BE781B3DD452758D1C47

SHA256:

8DE70EC83ECBA96CE98CE5DE65C64F7B2635C5C0F112D98A02BC25221ED46576

SSDEEP:

393216:8GG82WSlrJHKi3Pmq+9Dqhlc3VFXYLxYEQGFPx4DXDbT:Tboj3P69DyW7XcFWTbT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Everything-1.4.1.1009.x86-Setup.exe (PID: 2188)
      • Everything.exe (PID: 2500)
      • Everything.exe (PID: 2820)
      • Everything.exe (PID: 2748)
      • Everything.exe (PID: 4004)
      • Everything.exe (PID: 2104)
      • Everything.exe (PID: 1936)
      • codsp.exe (PID: 1368)
      • CR-MW356.EXE (PID: 3140)
      • cr-nsg15.exe (PID: 3360)
      • cr-kawa3.exe (PID: 2568)
      • crack(4).exe (PID: 2660)
      • crack(3).exe (PID: 3068)
      • crack(4).exe (PID: 1000)
      • crack.exe (PID: 2372)
      • crack(2).exe (PID: 3052)
      • Crack(1).exe (PID: 1768)
      • crk_LeonU.exe (PID: 2092)
      • damn_raduga30.exe (PID: 2316)
      • ECLCA113.exe (PID: 2972)
      • fff-k530.exe (PID: 356)
      • fff-o2k3.exe (PID: 3888)
      • IDM.patch.exe (PID: 2240)
      • crk_ClaireU.exe (PID: 3112)
      • Kagayak_IV.exe (PID: 3012)
      • IDM.patch.exe (PID: 2500)
      • KanjiBrowze.exe (PID: 1964)
      • Karaoke_Dream_(v.1.34)_Keygen.Exe (PID: 3908)
      • kassa.exe (PID: 3636)
      • katarnkg.exe (PID: 2680)
      • keygen(2).exe (PID: 2980)
      • KaZaAbannerKiller.exe (PID: 2976)
      • Keygen(1).exe (PID: 3792)
      • kara-kg.exe (PID: 4076)
      • keygen.exe (PID: 2444)
      • keygen.exe (PID: 3256)
      • Keygen.exe (PID: 3124)
      • KeyMaker.EXE (PID: 3404)
      • Adobe_Photoshop_CS_V8_by_ChLanKBooT.exe (PID: 3816)
      • amonl.exe (PID: 2040)
      • keymaker.exe (PID: 1020)
      • md5checker.exe (PID: 3932)
      • NOD32-CRK.exe (PID: 2664)
      • NOD32.exe (PID: 3784)
      • nod32ccl.exe (PID: 3092)
      • nod32l.exe (PID: 3600)
      • OS-Adobe_CS2_KeyGen_Tryout_to_Full.exe (PID: 4044)
      • patch.exe (PID: 532)
      • Loader.exe (PID: 2552)
      • patch.exe (PID: 2720)
      • Patcher.exe (PID: 2776)
      • Patch.exe (PID: 1312)
      • Patcher.exe (PID: 3436)
      • ra_Kalenderv2.04r2b36patch.exe (PID: 2992)
      • RapidshareHacking.exe (PID: 2084)
      • Patch.exe (PID: 2924)
      • ra_Kalenderv2.04r2b36patch.exe (PID: 3892)
      • start.exe (PID: 3856)
      • SwishMax.exe (PID: 3728)
      • Trainer.exe (PID: 3876)
      • War3x-TFT-Kg.exe (PID: 2100)
      • WindowsXP Product Key Viewer.exe (PID: 2912)
      • Sims2.exe (PID: 3184)
      • start(1).exe (PID: 324)
      • tmgmw357.EXE (PID: 3000)
      • cmdinfo.exe (PID: 2676)

    • Drops executable file immediately after starts

      • Everything-1.4.1.1009.x86-Setup.exe (PID: 2188)
      • Everything.exe (PID: 2500)
      • WinRAR.exe (PID: 3028)
      • fff-o2k3.exe (PID: 3888)
      • IDM.patch.exe (PID: 2500)
      • chrome.exe (PID: 2852)

    • Loads dropped or rewritten executable

      • Everything-1.4.1.1009.x86-Setup.exe (PID: 2188)
      • SearchProtocolHost.exe (PID: 2440)
      • cmdinfo.exe (PID: 2676)
      • Patch.exe (PID: 1312)
      • fff-o2k3.exe (PID: 3888)
      • IDM.patch.exe (PID: 2500)

    • Changes the autorun value in the registry

      • Everything.exe (PID: 2748)

  • SUSPICIOUS

    • Reads the computer name

      • WinRAR.exe (PID: 2376)
      • Everything-1.4.1.1009.x86-Setup.exe (PID: 2188)
      • Everything.exe (PID: 2820)
      • Everything.exe (PID: 2500)
      • Everything.exe (PID: 2748)
      • Everything.exe (PID: 2104)
      • Everything.exe (PID: 4004)
      • Everything.exe (PID: 1936)
      • WinRAR.exe (PID: 3028)
      • cmdinfo.exe (PID: 2676)
      • crack(4).exe (PID: 2660)
      • IDM.patch.exe (PID: 2500)
      • fff-o2k3.exe (PID: 3888)
      • keygen.exe (PID: 3256)
      • Patch.exe (PID: 1312)
      • start.exe (PID: 3856)
      • Crack(1).exe (PID: 1768)
      • ECLCA113.exe (PID: 2972)

    • Checks supported languages

      • WinRAR.exe (PID: 2376)
      • Everything.exe (PID: 2820)
      • Everything.exe (PID: 2500)
      • Everything-1.4.1.1009.x86-Setup.exe (PID: 2188)
      • Everything.exe (PID: 4004)
      • Everything.exe (PID: 2104)
      • Everything.exe (PID: 2748)
      • Everything.exe (PID: 1936)
      • WinRAR.exe (PID: 3028)
      • cmdinfo.exe (PID: 2676)
      • cr-kawa3.exe (PID: 2568)
      • cr-nsg15.exe (PID: 3360)
      • crack(2).exe (PID: 3052)
      • crack(3).exe (PID: 3068)
      • crack(4).exe (PID: 2660)
      • CR-MW356.EXE (PID: 3140)
      • Crack(1).exe (PID: 1768)
      • crack.exe (PID: 2372)
      • crk_ClaireU.exe (PID: 3112)
      • crk_LeonU.exe (PID: 2092)
      • damn_raduga30.exe (PID: 2316)
      • ECLCA113.exe (PID: 2972)
      • fff-k530.exe (PID: 356)
      • fff-o2k3.exe (PID: 3888)
      • IDM.patch.exe (PID: 2500)
      • Kagayak_IV.exe (PID: 3012)
      • kara-kg.exe (PID: 4076)
      • Karaoke_Dream_(v.1.34)_Keygen.Exe (PID: 3908)
      • kassa.exe (PID: 3636)
      • Keygen(1).exe (PID: 3792)
      • KanjiBrowze.exe (PID: 1964)
      • katarnkg.exe (PID: 2680)
      • keygen.exe (PID: 3256)
      • Keygen.exe (PID: 3124)
      • KeyMaker.EXE (PID: 3404)
      • Adobe_Photoshop_CS_V8_by_ChLanKBooT.exe (PID: 3816)
      • amonl.exe (PID: 2040)
      • keymaker.exe (PID: 1020)
      • keygen(2).exe (PID: 2980)
      • KaZaAbannerKiller.exe (PID: 2976)
      • Loader.exe (PID: 2552)
      • NOD32.exe (PID: 3784)
      • md5checker.exe (PID: 3932)
      • NOD32-CRK.exe (PID: 2664)
      • nod32ccl.exe (PID: 3092)
      • nod32l.exe (PID: 3600)
      • OS-Adobe_CS2_KeyGen_Tryout_to_Full.exe (PID: 4044)
      • keygen.exe (PID: 2444)
      • patch.exe (PID: 532)
      • Patch.exe (PID: 1312)
      • Patcher.exe (PID: 3436)
      • ra_Kalenderv2.04r2b36patch.exe (PID: 3892)
      • tmgmw357.EXE (PID: 3000)
      • start.exe (PID: 3856)
      • Trainer.exe (PID: 3876)
      • War3x-TFT-Kg.exe (PID: 2100)
      • RapidshareHacking.exe (PID: 2084)
      • start(1).exe (PID: 324)
      • WindowsXP Product Key Viewer.exe (PID: 2912)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 2216)
      • chrome.exe (PID: 2608)
      • Everything-1.4.1.1009.x86-Setup.exe (PID: 2188)
      • Everything.exe (PID: 2500)
      • WinRAR.exe (PID: 3028)
      • fff-o2k3.exe (PID: 3888)
      • IDM.patch.exe (PID: 2500)
      • chrome.exe (PID: 2852)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 2216)

    • Application launched itself

      • Everything.exe (PID: 2820)

    • Creates a directory in Program Files

      • Everything.exe (PID: 2500)

    • Creates files in the program directory

      • Everything.exe (PID: 2500)
      • Everything.exe (PID: 2748)

    • Creates a software uninstall entry

      • Everything.exe (PID: 2500)

    • Starts itself from another location

      • Everything.exe (PID: 2500)

    • Changes default file association

      • Everything.exe (PID: 2748)

    • Executed as Windows Service

      • Everything.exe (PID: 4004)

    • Creates files in the user directory

      • Everything.exe (PID: 2104)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 3028)
      • chrome.exe (PID: 2852)

    • Creates files like Ransomware instruction

      • WinRAR.exe (PID: 3028)

    • Drops a file with too old compile date

      • WinRAR.exe (PID: 3028)
      • fff-o2k3.exe (PID: 3888)
      • IDM.patch.exe (PID: 2500)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 3028)

    • Reads Windows owner or organization settings

      • cmdinfo.exe (PID: 2676)
      • keygen.exe (PID: 3256)

    • Reads Environment values

      • cmdinfo.exe (PID: 2676)

    • Reads the Windows organization settings

      • cmdinfo.exe (PID: 2676)

    • Executes application which crashes

      • Everything.exe (PID: 1936)

    • Creates files in the Windows directory

      • IDM.patch.exe (PID: 2500)

  • INFO

    • Manual execution by user

      • chrome.exe (PID: 2216)
      • WinRAR.exe (PID: 3028)

    • Checks supported languages

      • chrome.exe (PID: 2216)
      • chrome.exe (PID: 2500)
      • chrome.exe (PID: 1332)
      • chrome.exe (PID: 2608)
      • chrome.exe (PID: 432)
      • chrome.exe (PID: 1248)
      • chrome.exe (PID: 3644)
      • chrome.exe (PID: 3556)
      • chrome.exe (PID: 3488)
      • chrome.exe (PID: 2156)
      • chrome.exe (PID: 2436)
      • chrome.exe (PID: 440)
      • chrome.exe (PID: 1744)
      • chrome.exe (PID: 2820)
      • chrome.exe (PID: 2492)
      • chrome.exe (PID: 3124)
      • chrome.exe (PID: 3312)
      • chrome.exe (PID: 2600)
      • chrome.exe (PID: 3248)
      • chrome.exe (PID: 2044)
      • chrome.exe (PID: 3900)
      • chrome.exe (PID: 3216)
      • chrome.exe (PID: 3588)
      • chrome.exe (PID: 1268)
      • chrome.exe (PID: 3028)
      • chrome.exe (PID: 2384)
      • chrome.exe (PID: 1464)
      • chrome.exe (PID: 4048)
      • chrome.exe (PID: 592)
      • chrome.exe (PID: 3052)
      • chrome.exe (PID: 2924)
      • chrome.exe (PID: 1952)
      • chrome.exe (PID: 1756)
      • chrome.exe (PID: 2296)
      • chrome.exe (PID: 2712)
      • chrome.exe (PID: 2716)
      • chrome.exe (PID: 3996)
      • chrome.exe (PID: 3600)
      • chrome.exe (PID: 1952)
      • chrome.exe (PID: 2224)
      • chrome.exe (PID: 2052)
      • chrome.exe (PID: 2700)
      • chrome.exe (PID: 3280)
      • chrome.exe (PID: 3248)
      • chrome.exe (PID: 2096)
      • ntvdm.exe (PID: 2864)
      • ntvdm.exe (PID: 3424)
      • chrome.exe (PID: 3280)
      • pcaui.exe (PID: 3316)
      • chrome.exe (PID: 2292)
      • Explorer.exe (PID: 1836)
      • chrome.exe (PID: 3488)
      • chrome.exe (PID: 2852)
      • chrome.exe (PID: 2968)
      • chrome.exe (PID: 3580)
      • chrome.exe (PID: 3440)
      • chrome.exe (PID: 1444)
      • chrome.exe (PID: 3828)
      • chrome.exe (PID: 3636)
      • chrome.exe (PID: 1168)

    • Reads the computer name

      • chrome.exe (PID: 2216)
      • chrome.exe (PID: 2500)
      • chrome.exe (PID: 2608)
      • chrome.exe (PID: 1248)
      • chrome.exe (PID: 2712)
      • chrome.exe (PID: 3600)
      • chrome.exe (PID: 3052)
      • chrome.exe (PID: 3280)
      • chrome.exe (PID: 2096)
      • pcaui.exe (PID: 3316)
      • Explorer.exe (PID: 1836)

    • Application launched itself

      • chrome.exe (PID: 2216)

    • Reads the hosts file

      • chrome.exe (PID: 2216)
      • chrome.exe (PID: 2608)

    • Reads settings of System Certificates

      • chrome.exe (PID: 2608)
      • chrome.exe (PID: 2216)

    • Checks Windows Trust Settings

      • chrome.exe (PID: 2216)

    • Reads the date of Windows installation

      • chrome.exe (PID: 3280)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
187
Monitored processes
129
Malicious processes
33
Suspicious processes
13

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start winrar.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs everything-1.4.1.1009.x86-setup.exe everything.exe no specs everything.exe everything.exe everything.exe no specs everything.exe no specs everything.exe no specs chrome.exe no specs winrar.exe chrome.exe no specs searchprotocolhost.exe no specs chrome.exe no specs chrome.exe no specs amonl.exe no specs adobe_photoshop_cs_v8_by_chlankboot.exe no specs cmdinfo.exe no specs codsp.exe no specs cr-kawa3.exe no specs cr-mw356.exe no specs cr-nsg15.exe no specs crack(1).exe no specs crack(2).exe no specs crack(3).exe crack(4).exe no specs crack(4).exe ntvdm.exe no specs crack.exe no specs crk_claireu.exe no specs crk_leonu.exe no specs ntvdm.exe no specs damn_raduga30.exe no specs eclca113.exe no specs fff-k530.exe no specs fff-o2k3.exe idm.patch.exe no specs idm.patch.exe kagayak_iv.exe no specs kanjibrowze.exe no specs kara-kg.exe no specs karaoke_dream_(v.1.34)_keygen.exe no specs kassa.exe no specs katarnkg.exe no specs kazaabannerkiller.exe no specs keygen(1).exe no specs keygen(2).exe no specs keygen.exe no specs keygen.exe no specs keygen.exe no specs keymaker.exe no specs keymaker.exe no specs loader.exe no specs md5checker.exe no specs nod32-crk.exe no specs nod32.exe no specs nod32ccl.exe no specs nod32l.exe no specs os-adobe_cs2_keygen_tryout_to_full.exe no specs patch.exe no specs patch.exe patch.exe no specs chrome.exe no specs patch.exe patcher.exe no specs patcher.exe ra_kalenderv2.04r2b36patch.exe no specs ra_kalenderv2.04r2b36patch.exe rapidsharehacking.exe no specs sims2.exe no specs pcaui.exe no specs start(1).exe no specs start.exe no specs swishmax.exe no specs tmgmw357.exe no specs trainer.exe no specs war3x-tft-kg.exe no specs windowsxp product key viewer.exe no specs chrome.exe no specs chrome.exe no specs explorer.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
324"C:\Users\admin\Desktop\start(1).exe" C:\Users\admin\Desktop\start(1).exe—Everything.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\start(1).exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
356"C:\Users\admin\Desktop\fff-k530.exe" C:\Users\admin\Desktop\fff-k530.exe—Everything.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\fff-k530.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
432"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,18386185435858157118,16887273117254116954,131072 --enable-features=PasswordImport --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1908 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
440"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,18386185435858157118,16887273117254116954,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3004 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\version.dll
532"C:\Users\admin\Desktop\patch.exe" C:\Users\admin\Desktop\patch.exe
Everything.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\patch.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
592"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,18386185435858157118,16887273117254116954,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\version.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
1000"C:\Users\admin\Desktop\crack(4).exe" C:\Users\admin\Desktop\crack(4).exe—Everything.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\crack(4).exe
c:\windows\system32\ntdll.dll
1020"C:\Users\admin\Desktop\Adobe.Photoshop.CS2.v9.0.German.Incl.Keymaker.READ.NFO-AGAiN\AGAiN\keymaker.exe" C:\Users\admin\Desktop\Adobe.Photoshop.CS2.v9.0.German.Incl.Keymaker.READ.NFO-AGAiN\AGAiN\keymaker.exe—Everything.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\adobe.photoshop.cs2.v9.0.german.incl.keymaker.read.nfo-again\again\keymaker.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
1168"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=patch.mojom.FilePatcher --field-trial-handle=1056,18386185435858157118,16887273117254116954,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1840 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
1248"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1056,18386185435858157118,16887273117254116954,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1052 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
Total events
25 427
Read events
25 146
Write events
273
Delete events
8

Modification events

(PID) Process:(2376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2376) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2376) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(2376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\binaries.7z
(PID) Process:(2376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
71
Suspicious files
171
Text files
374
Unknown types
30

Dropped files

PID
Process
Filename
Type
2376WinRAR.exeC:\Users\admin\Desktop\Adobe_Photoshop_CS2_Tryout_to_Full_Activation.zipcompressed
MD5:—
SHA256:—
2376WinRAR.exeC:\Users\admin\Desktop\Call_of_Duty_Crack_by_Unknown.zipcompressed
MD5:—
SHA256:—
2376WinRAR.exeC:\Users\admin\Desktop\Colin_McRae_Rally_2005_Crash_Fix_by_IND.zipcompressed
MD5:—
SHA256:—
2376WinRAR.exeC:\Users\admin\Desktop\Adobe_Photoshop_CS2_v9.0_German_READ_NFO_by_AGAiN.zipcompressed
MD5:—
SHA256:—
2376WinRAR.exeC:\Users\admin\Desktop\DBC_Kali_II_For_Windows_9598NT_Serial.zipcompressed
MD5:—
SHA256:—
2376WinRAR.exeC:\Users\admin\Desktop\CR-NSG15.ZIPcompressed
MD5:—
SHA256:—
2376WinRAR.exeC:\Users\admin\Desktop\crkcas.zipcompressed
MD5:—
SHA256:—
2376WinRAR.exeC:\Users\admin\Desktop\DBC_Resident_Evil_2_v1.04_Patch.zipcompressed
MD5:—
SHA256:—
2376WinRAR.exeC:\Users\admin\Desktop\GameHouse_Zuma_Deluxe_v1.0.0.1_Trainer_by_FFF.zipcompressed
MD5:—
SHA256:—
2376WinRAR.exeC:\Users\admin\Desktop\Adobe_Photoshop_CS_v8.0_by_Chlankboot.zipcompressed
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
73
TCP/UDP connections
47
DNS requests
38
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1796
svchost.exe
HEAD
302
142.250.185.110:80
http://redirector.gvt1.com/edgedl/release2/chrome_component/AIQWwBRSWwfx2JCxD0aw30k_2657/I-4-aBwqaCFG5rMUT0QDpg
US
—
—
whitelisted
1796
svchost.exe
HEAD
403
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/AIDSJGrIAR_6GKekQJvhOSI_1.3.36.81/FlU1w6tFdzzsxVNvvqMiCQ
US
—
—
whitelisted
1796
svchost.exe
HEAD
200
173.194.137.74:80
http://r5---sn-aigzrn76.gvt1.com/edgedl/release2/chrome_component/AIQWwBRSWwfx2JCxD0aw30k_2657/I-4-aBwqaCFG5rMUT0QDpg?cms_redirect=yes&mh=o2&mip=85.203.34.115&mm=28&mn=sn-aigzrn76&ms=nvh&mt=1625352354&mv=u&mvi=5&pl=24&rmhost=r1---sn-aigzrn76.gvt1.com&shardbypass=yes&smhost=r1---sn-aigzrn7l.gvt1.com
US
—
—
whitelisted
1796
svchost.exe
HEAD
200
173.194.183.102:80
http://r1---sn-aigl6nek.gvt1.com/edgedl/release2/chrome_component/AIDSJGrIAR_6GKekQJvhOSI_1.3.36.81/FlU1w6tFdzzsxVNvvqMiCQ?cms_redirect=yes&mh=Pe&mip=85.203.34.115&mm=28&mn=sn-aigl6nek&ms=nvh&mt=1625352354&mv=u&mvi=1&pl=24&shardbypass=yes
US
—
—
whitelisted
2608
chrome.exe
GET
302
142.250.185.110:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx
US
html
556 b
whitelisted
1796
svchost.exe
GET
206
173.194.183.102:80
http://r1---sn-aigl6nek.gvt1.com/edgedl/release2/chrome_component/AIDSJGrIAR_6GKekQJvhOSI_1.3.36.81/FlU1w6tFdzzsxVNvvqMiCQ?cms_redirect=yes&mh=Pe&mip=85.203.34.115&mm=28&mn=sn-aigl6nek&ms=nvh&mt=1625352354&mv=u&mvi=1&pl=24&shardbypass=yes
US
binary
21.5 Kb
whitelisted
1796
svchost.exe
GET
302
142.250.185.110:80
http://redirector.gvt1.com/edgedl/release2/chrome_component/AIQWwBRSWwfx2JCxD0aw30k_2657/I-4-aBwqaCFG5rMUT0QDpg
US
html
544 b
whitelisted
1796
svchost.exe
GET
206
173.194.183.102:80
http://r1---sn-aigl6nek.gvt1.com/edgedl/release2/chrome_component/AIDSJGrIAR_6GKekQJvhOSI_1.3.36.81/FlU1w6tFdzzsxVNvvqMiCQ?cms_redirect=yes&mh=Pe&mip=85.203.34.115&mm=28&mn=sn-aigl6nek&ms=nvh&mt=1625352354&mv=u&mvi=1&pl=24&shardbypass=yes
US
binary
11.2 Kb
whitelisted
1796
svchost.exe
GET
302
142.250.185.110:80
http://redirector.gvt1.com/edgedl/release2/chrome_component/AIDSJGrIAR_6GKekQJvhOSI_1.3.36.81/FlU1w6tFdzzsxVNvvqMiCQ
US
html
475 b
whitelisted
1796
svchost.exe
GET
206
173.194.137.74:80
http://r5---sn-aigzrn76.gvt1.com/edgedl/release2/chrome_component/AIQWwBRSWwfx2JCxD0aw30k_2657/I-4-aBwqaCFG5rMUT0QDpg?cms_redirect=yes&mh=o2&mip=85.203.34.115&mm=28&mn=sn-aigzrn76&ms=nvh&mt=1625352354&mv=u&mvi=5&pl=24&rmhost=r1---sn-aigzrn76.gvt1.com&shardbypass=yes&smhost=r1---sn-aigzrn7l.gvt1.com
US
binary
3.23 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2608
chrome.exe
142.250.185.141:443
accounts.google.com
Google Inc.
US
whitelisted
2608
chrome.exe
142.250.185.195:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
2608
chrome.exe
142.250.184.238:443
clients2.google.com
Google Inc.
US
whitelisted
2608
chrome.exe
142.250.186.100:443
www.google.com
Google Inc.
US
whitelisted
2608
chrome.exe
142.250.186.42:443
fonts.googleapis.com
Google Inc.
US
whitelisted
2608
chrome.exe
172.217.18.99:443
fonts.gstatic.com
Google Inc.
US
whitelisted
2608
chrome.exe
142.250.186.163:443
www.gstatic.com
Google Inc.
US
whitelisted
2608
chrome.exe
142.250.186.110:443
encrypted-tbn0.gstatic.com
Google Inc.
US
whitelisted
2608
chrome.exe
142.250.185.99:443
update.googleapis.com
Google Inc.
US
whitelisted
2608
chrome.exe
142.250.186.46:443
apis.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
clients2.google.com
  • 142.250.184.238
whitelisted
accounts.google.com
  • 142.250.185.141
shared
clientservices.googleapis.com
  • 142.250.185.195
whitelisted
www.google.com
  • 142.250.186.100
malicious
fonts.googleapis.com
  • 142.250.186.42
whitelisted
www.gstatic.com
  • 142.250.186.163
whitelisted
fonts.gstatic.com
  • 172.217.18.99
whitelisted
encrypted-tbn0.gstatic.com
  • 142.250.186.110
whitelisted
apis.google.com
  • 142.250.186.46
whitelisted
ogs.google.com
  • 216.58.212.174
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
binaries.7z