File name:

epson_L3110_AdjPro.7z

Full analysis: https://app.any.run/tasks/d4961495-2029-44ea-8ddd-538716d8a48f
Verdict: Malicious activity
Analysis date: April 01, 2020, 22:41:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

56F402410639C7DF9912CCF3E94D3C0F

SHA1:

59FBB2A16562A187DCAF94FDDF494E8359B9C444

SHA256:

A528A41DD6F5C1A07AE4682A2FF61A624CB3A4CAC902A966D3463C38B3561568

SSDEEP:

98304:adopgTQR6xacCiKkUgyzX23E5wMUuECZWZil8r+fP438TPwqkKK+U4:uopgMR6xM5Vj28wMzhlCIP43kwqkKNU4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • Adjprog.exe (PID: 3440)
      • SearchProtocolHost.exe (PID: 3548)
      • explorer.exe (PID: 372)
      • Adjprog.exe (PID: 3408)
      • Adjprog.exe (PID: 2160)

    • Application was dropped or rewritten from another process

      • Adjprog.exe (PID: 3440)
      • Adjprog.exe (PID: 3408)
      • Adjprog.exe (PID: 2160)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1692)

    • Creates files in the program directory

      • Adjprog.exe (PID: 3440)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
8
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe searchprotocolhost.exe no specs explorer.exe no specs adjprog.exe wlgen_epson l3110.exe no specs wlgen_epson l3110.exe no specs adjprog.exe adjprog.exe

Process information

PID
CMD
Path
Indicators
Parent process
372C:\Windows\Explorer.EXEC:\Windows\explorer.exe——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1016"C:\Users\admin\Desktop\epson_L3110_AdjPro\epson 3110\Keygen\Keygen\WLGen_Epson L3110.exe" C:\Users\admin\Desktop\epson_L3110_AdjPro\epson 3110\Keygen\Keygen\WLGen_Epson L3110.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\epson_l3110_adjpro\epson 3110\keygen\keygen\wlgen_epson l3110.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1692"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\epson_L3110_AdjPro.7z"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2160"C:\Users\admin\Desktop\epson_L3110_AdjPro\epson 3110\Epson L3110 multi pc\Epson L3110 multi pc\Adjprog.exe" C:\Users\admin\Desktop\epson_L3110_AdjPro\epson 3110\Epson L3110 multi pc\Epson L3110 multi pc\Adjprog.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Adjustment program for EPSON Inkjet Printer / Scanner
Exit code:
0
Version:
1, 0, 0, 0
Modules
Images
c:\users\admin\desktop\epson_l3110_adjpro\epson 3110\epson l3110 multi pc\epson l3110 multi pc\adjprog.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
3240"C:\Users\admin\Desktop\epson_L3110_AdjPro\epson 3110\Keygen\Keygen\WLGen_Epson L3110.exe" C:\Users\admin\Desktop\epson_L3110_AdjPro\epson 3110\Keygen\Keygen\WLGen_Epson L3110.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\epson_l3110_adjpro\epson 3110\keygen\keygen\wlgen_epson l3110.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3408"C:\Users\admin\Desktop\epson_L3110_AdjPro\epson 3110\Epson L3110 multi pc\Epson L3110 multi pc\Adjprog.exe" C:\Users\admin\Desktop\epson_L3110_AdjPro\epson 3110\Epson L3110 multi pc\Epson L3110 multi pc\Adjprog.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Adjustment program for EPSON Inkjet Printer / Scanner
Exit code:
2
Version:
1, 0, 0, 0
Modules
Images
c:\users\admin\desktop\epson_l3110_adjpro\epson 3110\epson l3110 multi pc\epson l3110 multi pc\adjprog.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
3440"C:\Users\admin\Desktop\epson_L3110_AdjPro\epson 3110\Epson L3110 multi pc\Epson L3110 multi pc\Adjprog.exe" C:\Users\admin\Desktop\epson_L3110_AdjPro\epson 3110\Epson L3110 multi pc\Epson L3110 multi pc\Adjprog.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Adjustment program for EPSON Inkjet Printer / Scanner
Exit code:
2
Version:
1, 0, 0, 0
Modules
Images
c:\users\admin\desktop\epson_l3110_adjpro\epson 3110\epson l3110 multi pc\epson l3110 multi pc\adjprog.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
3548"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
8 008
Read events
7 250
Write events
756
Delete events
2

Modification events

(PID) Process:(1692) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1692) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1692) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1692) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\epson_L3110_AdjPro.7z
(PID) Process:(1692) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1692) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1692) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1692) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(372) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.7z\OpenWithList
Operation:writeName:a
Value:
WinRAR.exe
(PID) Process:(372) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.7z\OpenWithList
Operation:writeName:MRUList
Value:
a
Executable files
3
Suspicious files
6
Text files
25
Unknown types
2

Dropped files

PID
Process
Filename
Type
1692WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1692.24232\epson_L3110_AdjPro\epson 3110\Epson L3110 multi pc\Epson L3110 multi pc\extendkey.datbinary
MD5:2F92E1C5ABC0FAB71E2BD7255E8716B1
SHA256:C0B5C765CAE2BFD9EEAB6CA398B5D77D50E0B9085BFBAB2FFDC615639E1ECF88
1692WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1692.24232\epson_L3110_AdjPro\epson 3110\Epson L3110 multi pc\Epson L3110 multi pc\DynSmartKey.txttext
MD5:B49C507747E0A05F022D9A23E8DF7AEC
SHA256:074FE7AD603AA92EC32F3D16AD30EA8C3755429562ECA007395C9FD74A1984D3
1692WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1692.24232\epson_L3110_AdjPro\epson 3110\Epson L3110 multi pc\Epson L3110 multi pc\EditText.dattext
MD5:5B1E183F5CAD1ADF0799B514F5D31295
SHA256:85D5F3B287A4C34CA1FA3C6B221C1635689B53668571D05B6EDCCE55992B2BBB
1692WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1692.24232\epson_L3110_AdjPro\epson 3110\Epson L3110 multi pc\Epson L3110 multi pc\F2_discharge.prnbinary
MD5:EC4D13EAFEBF232702A15C7829A174D1
SHA256:76A465F3B4BDAA0BB83BD02EDE986E042428C71504F7192D4B9A430C951D8626
1692WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1692.24232\epson_L3110_AdjPro\epson 3110\Epson L3110 multi pc\Epson L3110 multi pc\license.regtext
MD5:A43F04909565EA0F07215C4A0D899B2C
SHA256:12E1734D0AF2A194B278A84668DBC9F3F9DFEC5BBEFE2D0D786661698C39F1E7
1692WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1692.24232\epson_L3110_AdjPro\epson 3110\Epson L3110 multi pc\Epson L3110 multi pc\StrGene.dll —
MD5:—
SHA256:—
1692WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1692.24232\epson_L3110_AdjPro\epson 3110\Keygen\Keygen\CustomWinlicenseSDK.dll —
MD5:—
SHA256:—
1692WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1692.24232\epson_L3110_AdjPro\epson 3110\Keygen\Keygen\ECCfunctions.dll —
MD5:—
SHA256:—
1692WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1692.24232\epson_L3110_AdjPro\epson 3110\Keygen\Keygen\WinLicenseSDK.dll —
MD5:—
SHA256:—
1692WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa1692.24232\epson_L3110_AdjPro\epson 3110\Keygen\Keygen\WLGen_Epson L3110.exe —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
Process
Message
Adjprog.exe
%s------------------------------------------------ --- WinLicense Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
Adjprog.exe
%s------------------------------------------------ --- WinLicense Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
Adjprog.exe
%s------------------------------------------------ --- WinLicense Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
epson_L3110_AdjPro.7z