File name:

Xforce_keygen_by_KeygenSumo.zip

Full analysis: https://app.any.run/tasks/a662becf-b2c2-4b7b-aa68-48996347d4ed
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Analysis date: July 02, 2021, 04:18:49
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
trojan
rat
azorult
stealer
loader
miner
raccoon
fareit
pony
keylogger
agenttesla
redline
phishing
vidar
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

12E971A3C2BA08EECF2554A7982BE128

SHA1:

C32E1953EFBE09626B181C88CC76D34733E7291C

SHA256:

B6C5CEE94F3DCBA4570377CC032776DD5453291F7D36932AA50557C93E16C592

SSDEEP:

98304:W3Gj/vDBcShZQqeBI34nepmigVo5zpATCg/IOk3xqvRcdDgXQDrFrJMxSZn:WM/rOSiBI1nRpqCBsv2p0yJF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Stealing of credential data

      • keygen-step-3.exe (PID: 2756)
      • 43A1.tmp.exe (PID: 2172)
      • RunWW.exe (PID: 11172)
    • Application was dropped or rewritten from another process

      • keygen-step-1.exe (PID: 2416)
      • keygen-pr.exe (PID: 3996)
      • keygen-step-3.exe (PID: 2756)
      • keygen-step-6.exe (PID: 2152)
      • keygen-step-5.exe (PID: 1940)
      • JNCo2Vf2MC.EXE (PID: 2724)
      • key.exe (PID: 4056)
      • Crack.exe (PID: 2688)
      • Xforce_keygen_by_KeygenSumo.exe (PID: 2928)
      • keygen-step-4.exe (PID: 3580)
      • key.exe (PID: 2808)
      • 43A1.tmp.exe (PID: 2172)
      • note866.exe (PID: 4032)
      • GloryWSetp.exe (PID: 3552)
      • 5C0D.tmp.exe (PID: 4088)
      • 1710767.exe (PID: 3404)
      • 8602741.exe (PID: 2468)
      • 6937479.exe (PID: 3548)
      • IDWCH1.exe (PID: 2040)
      • IDWCH1.exe (PID: 4072)
      • WinHoster.exe (PID: 1320)
      • IDownload.exe (PID: 3484)
      • IDownload.App.exe (PID: 2476)
      • Wudalakawi.exe (PID: 2540)
      • SHigetinushae.exe (PID: 2960)
      • hbggg.exe (PID: 5260)
      • ifhwwyy.exe (PID: 13988)
      • hbggg.exe (PID: 12256)
      • jfiag3g_gg.exe (PID: 6504)
      • jfiag3g_gg.exe (PID: 4548)
      • Setup3310.exe (PID: 12972)
      • jfiag3g_gg.exe (PID: 13172)
      • jfiag3g_gg.exe (PID: 4336)
      • google-game.exe (PID: 12044)
      • SunLabsPlayer.exe (PID: 10548)
      • guihuali-game.exe (PID: 13856)
      • jfiag3g_gg.exe (PID: 6592)
      • lighteningplayer-cache-gen.exe (PID: 11192)
      • ns39F8.tmp (PID: 8572)
      • ns5A53.tmp (PID: 8364)
      • hjjgaa.exe (PID: 10188)
      • NMemo3Setp.exe (PID: 9928)
      • lylal220.exe (PID: 2096)
      • LabPicV3.exe (PID: 13008)
      • RunWW.exe (PID: 11172)
      • MediaBurner.exe (PID: 8940)
      • jfiag3g_gg.exe (PID: 13956)
      • 7233392.exe (PID: 11356)
      • 7451165.exe (PID: 9444)
      • 7625686.exe (PID: 4504)
      • ultramediaburner.exe (PID: 10248)
      • prolab.exe (PID: 6384)
      • UltraMediaBurner.exe (PID: 1548)
      • irecord.exe (PID: 12104)
      • Sezhaetyhaezhae.exe (PID: 924)
      • Cubaezhesihae.exe (PID: 13880)
      • Qizhozhegaezha.exe (PID: 11624)
      • ZHuxeshaewequ.exe (PID: 9728)
      • I-Record.exe (PID: 4804)
      • Fabikelaemu.exe (PID: 13604)
      • Pytikaedaepo.exe (PID: 7964)
      • ifhwwyy.exe (PID: 19700)
      • ifhwwyy.exe (PID: 20136)
      • ifhwwyy.exe (PID: 14616)
      • jfiag3g_gg.exe (PID: 6728)
      • jfiag3g_gg.exe (PID: 10236)
      • jfiag3g_gg.exe (PID: 14548)
      • Setup3310.exe (PID: 6376)
      • Setup3310.exe (PID: 5000)
      • Setup3310.exe (PID: 14180)
      • google-game.exe (PID: 5940)
      • google-game.exe (PID: 4868)
      • google-game.exe (PID: 11148)
      • jfiag3g_gg.exe (PID: 12716)
      • jfiag3g_gg.exe (PID: 10300)
      • jfiag3g_gg.exe (PID: 15836)
      • SunLabsPlayer.exe (PID: 10752)
      • SunLabsPlayer.exe (PID: 7516)
      • SunLabsPlayer.exe (PID: 8580)
      • nsEE11.tmp (PID: 9580)
      • nsEE21.tmp (PID: 10568)
      • nsF5B2.tmp (PID: 2768)
      • ns40A7.tmp (PID: 16276)
      • ns40A7.tmp (PID: 17524)
      • lighteningplayer-cache-gen.exe (PID: 11324)
      • lighteningplayer-cache-gen.exe (PID: 2968)
      • ns42BA.tmp (PID: 944)
      • lighteningplayer-cache-gen.exe (PID: 3720)
      • hjjgaa.exe (PID: 13388)
      • RunWW.exe (PID: 5488)
      • NMemo3Setp.exe (PID: 17372)
      • MediaBurner.exe (PID: 10756)
      • lylal220.exe (PID: 12416)
      • LabPicV3.exe (PID: 17736)
      • guihuali-game.exe (PID: 12960)
      • jfiag3g_gg.exe (PID: 18260)
      • hjjgaa.exe (PID: 2608)
      • RunWW.exe (PID: 3416)
      • NMemo3Setp.exe (PID: 6680)
      • MediaBurner.exe (PID: 5496)
      • lylal220.exe (PID: 8152)
      • LabPicV3.exe (PID: 4916)
      • jfiag3g_gg.exe (PID: 13500)
      • guihuali-game.exe (PID: 18532)
      • hjjgaa.exe (PID: 16176)
      • RunWW.exe (PID: 9916)
      • NMemo3Setp.exe (PID: 7132)
      • MediaBurner.exe (PID: 16980)
      • lylal220.exe (PID: 8956)
      • LabPicV3.exe (PID: 5132)
      • jfiag3g_gg.exe (PID: 8600)
      • guihuali-game.exe (PID: 9552)
      • 7032118.exe (PID: 6808)
      • jfiag3g_gg.exe (PID: 11416)
      • 8936632.exe (PID: 18884)
      • 4565871.exe (PID: 5976)
      • jfiag3g_gg.exe (PID: 9148)
      • prolab.exe (PID: 9644)
    • Drops executable file immediately after starts

      • keygen-pr.exe (PID: 3996)
      • cmd.exe (PID: 2864)
      • Crack.exe (PID: 2688)
      • cmd.exe (PID: 2920)
      • IDWCH1.exe (PID: 2040)
      • IDWCH1.exe (PID: 4072)
      • IDownload.exe (PID: 3484)
      • IDownload.tmp (PID: 2676)
      • ifhwwyy.exe (PID: 13988)
      • hbggg.exe (PID: 12256)
      • Setup3310.exe (PID: 12972)
      • Setup3310.tmp (PID: 4912)
      • google-game.exe (PID: 12044)
      • ultramediaburner.exe (PID: 10248)
      • ultramediaburner.tmp (PID: 8752)
      • prolab.exe (PID: 6384)
      • prolab.tmp (PID: 5336)
      • irecord.exe (PID: 12104)
      • Setup3310.exe (PID: 5000)
      • google-game.exe (PID: 5940)
      • google-game.exe (PID: 4868)
      • google-game.exe (PID: 11148)
      • MediaBurner.exe (PID: 10756)
      • MediaBurner.exe (PID: 5496)
      • lylal220.exe (PID: 8152)
    • Runs PING.EXE for delay simulation

      • cmd.exe (PID: 996)
    • Connects to CnC server

      • keygen-step-1.exe (PID: 2416)
      • keygen-step-3.exe (PID: 2756)
      • 43A1.tmp.exe (PID: 2172)
      • key.exe (PID: 4056)
      • ifhwwyy.exe (PID: 13988)
      • hbggg.exe (PID: 12256)
      • hjjgaa.exe (PID: 10188)
      • ifhwwyy.exe (PID: 20136)
      • ifhwwyy.exe (PID: 19700)
      • ifhwwyy.exe (PID: 14616)
      • hjjgaa.exe (PID: 13388)
      • hjjgaa.exe (PID: 2608)
    • AZORULT was detected

      • keygen-step-1.exe (PID: 2416)
    • Registers / Runs the DLL via REGSVR32.EXE

      • cmd.exe (PID: 2920)
    • Loads dropped or rewritten executable

      • rUNdlL32.eXe (PID: 2432)
      • 43A1.tmp.exe (PID: 2172)
      • 1710767.exe (PID: 3404)
      • IDownload.App.exe (PID: 2476)
      • rUNdlL32.eXe (PID: 5100)
      • SunLabsPlayer.exe (PID: 10548)
      • lighteningplayer-cache-gen.exe (PID: 11192)
      • rUNdlL32.eXe (PID: 3888)
      • RunWW.exe (PID: 11172)
      • I-Record.exe (PID: 4804)
      • 7451165.exe (PID: 9444)
      • rUNdlL32.eXe (PID: 17684)
      • rUNdlL32.eXe (PID: 19604)
      • rUNdlL32.eXe (PID: 9424)
      • SunLabsPlayer.exe (PID: 10752)
      • SunLabsPlayer.exe (PID: 7516)
      • SunLabsPlayer.exe (PID: 8580)
      • lighteningplayer-cache-gen.exe (PID: 11324)
      • lighteningplayer-cache-gen.exe (PID: 2968)
      • lighteningplayer-cache-gen.exe (PID: 3720)
      • rUNdlL32.eXe (PID: 8260)
    • Changes settings of System certificates

      • 43A1.tmp.exe (PID: 2172)
      • 1710767.exe (PID: 3404)
      • Piiiiiiiipç87.exe (PID: 2964)
      • SHigetinushae.exe (PID: 2960)
      • ifhwwyy.exe (PID: 13988)
      • Setup3310.tmp (PID: 4912)
    • Application was injected by another process

      • svchost.exe (PID: 876)
      • svchost.exe (PID: 904)
      • svchost.exe (PID: 2252)
    • Runs injected code in another process

      • svchost.exe (PID: 876)
      • rUNdlL32.eXe (PID: 2432)
    • Writes to a start menu file

      • 5C0D.tmp.exe (PID: 4088)
    • RACCOON was detected

      • 43A1.tmp.exe (PID: 2172)
    • Actions looks like stealing of personal data

      • 43A1.tmp.exe (PID: 2172)
      • key.exe (PID: 4056)
      • svchost.exe (PID: 2252)
      • 1710767.exe (PID: 3404)
      • 6937479.exe (PID: 3548)
      • Setup3310.tmp (PID: 4912)
      • RunWW.exe (PID: 11172)
      • 7451165.exe (PID: 9444)
      • 7625686.exe (PID: 4504)
      • Setup3310.tmp (PID: 17540)
      • Setup3310.tmp (PID: 18992)
      • Setup3310.tmp (PID: 7572)
    • Changes the autorun value in the registry

      • 8602741.exe (PID: 2468)
      • Piiiiiiiipç87.exe (PID: 2964)
      • ifhwwyy.exe (PID: 13988)
      • JFHGSFGSIUGFSUIG.exe (PID: 10016)
      • 758____Dawn.exe (PID: 4188)
      • ElZané_çé_.exe (PID: 13276)
    • Steals credentials from Web Browsers

      • key.exe (PID: 4056)
      • 43A1.tmp.exe (PID: 2172)
      • svchost.exe (PID: 2252)
      • 6937479.exe (PID: 3548)
      • 1710767.exe (PID: 3404)
      • RunWW.exe (PID: 11172)
      • 7451165.exe (PID: 9444)
      • 7625686.exe (PID: 4504)
    • Detected Pony/Fareit Trojan

      • key.exe (PID: 4056)
    • AGENTTESLA was detected

      • svchost.exe (PID: 2252)
    • PONY was detected

      • key.exe (PID: 4056)
    • REDLINE was detected

      • 6937479.exe (PID: 3548)
      • 7625686.exe (PID: 4504)
    • Starts Visual C# compiler

      • IDownload.App.exe (PID: 2476)
    • VIDAR was detected

      • RunWW.exe (PID: 11172)
  • SUSPICIOUS

    • Drops a file that was compiled in debug mode

      • Xforce_keygen_by_KeygenSumo.exe (PID: 2928)
      • keygen-step-4.exe (PID: 3580)
      • cmd.exe (PID: 2864)
      • WinRAR.exe (PID: 2192)
      • Crack.exe (PID: 2688)
      • keygen-step-6.exe (PID: 2152)
      • 43A1.tmp.exe (PID: 2172)
      • 1710767.exe (PID: 3404)
      • IDWCH1.tmp (PID: 2932)
      • IDownload.tmp (PID: 2676)
      • SHigetinushae.exe (PID: 2960)
      • ifhwwyy.exe (PID: 13988)
      • Setup3310.tmp (PID: 4912)
      • SunLabsPlayer.exe (PID: 10548)
      • Setup.exe (PID: 6040)
      • guihuali-game.exe (PID: 13856)
      • MediaBurner.tmp (PID: 4160)
      • LabPicV3.tmp (PID: 4108)
      • lylal220.tmp (PID: 6256)
      • RunWW.exe (PID: 11172)
      • ultramediaburner.tmp (PID: 8752)
      • 7451165.exe (PID: 9444)
      • prolab.tmp (PID: 5336)
      • irecord.tmp (PID: 5460)
      • Cubaezhesihae.exe (PID: 13880)
      • ZHuxeshaewequ.exe (PID: 9728)
      • Pytikaedaepo.exe (PID: 7964)
      • Setup3310.tmp (PID: 18992)
      • Setup3310.tmp (PID: 7572)
      • Setup3310.tmp (PID: 17540)
      • SunLabsPlayer.exe (PID: 7516)
      • SunLabsPlayer.exe (PID: 8580)
      • SunLabsPlayer.exe (PID: 10752)
      • Setup.exe (PID: 18792)
      • MediaBurner.tmp (PID: 19992)
      • guihuali-game.exe (PID: 12960)
      • lylal220.tmp (PID: 7012)
      • LabPicV3.tmp (PID: 10080)
      • MediaBurner.tmp (PID: 19644)
      • guihuali-game.exe (PID: 18532)
      • LabPicV3.tmp (PID: 16688)
      • lylal220.tmp (PID: 5592)
      • MediaBurner.tmp (PID: 12516)
      • lylal220.tmp (PID: 2628)
      • LabPicV3.tmp (PID: 12652)
      • guihuali-game.exe (PID: 9552)
      • prolab.tmp (PID: 4844)
    • Executable content was dropped or overwritten

      • Xforce_keygen_by_KeygenSumo.exe (PID: 2928)
      • keygen-pr.exe (PID: 3996)
      • keygen-step-4.exe (PID: 3580)
      • cmd.exe (PID: 2864)
      • WinRAR.exe (PID: 2192)
      • Crack.exe (PID: 2688)
      • keygen-step-6.exe (PID: 2152)
      • cmd.exe (PID: 2920)
      • 5C0D.tmp.exe (PID: 4088)
      • GloryWSetp.exe (PID: 3552)
      • 43A1.tmp.exe (PID: 2172)
      • 8602741.exe (PID: 2468)
      • IDWCH1.exe (PID: 2040)
      • 1710767.exe (PID: 3404)
      • IDWCH1.exe (PID: 4072)
      • IDWCH1.tmp (PID: 2932)
      • Piiiiiiiipç87.exe (PID: 2964)
      • IDownload.exe (PID: 3484)
      • IDownload.tmp (PID: 2676)
      • SHigetinushae.exe (PID: 2960)
      • ifhwwyy.exe (PID: 13988)
      • hbggg.exe (PID: 12256)
      • Setup3310.exe (PID: 12972)
      • Setup3310.tmp (PID: 4912)
      • google-game.exe (PID: 12044)
      • Setup.exe (PID: 6040)
      • SunLabsPlayer.exe (PID: 10548)
      • MediaBurner.exe (PID: 8940)
      • lylal220.exe (PID: 2096)
      • hjjgaa.exe (PID: 10188)
      • LabPicV3.exe (PID: 13008)
      • guihuali-game.exe (PID: 13856)
      • MediaBurner.tmp (PID: 4160)
      • LabPicV3.tmp (PID: 4108)
      • lylal220.tmp (PID: 6256)
      • NMemo3Setp.exe (PID: 9928)
      • JFHGSFGSIUGFSUIG.exe (PID: 10016)
      • ultramediaburner.exe (PID: 10248)
      • RunWW.exe (PID: 11172)
      • ultramediaburner.tmp (PID: 8752)
      • 758____Dawn.exe (PID: 4188)
      • 7451165.exe (PID: 9444)
      • prolab.exe (PID: 6384)
      • prolab.tmp (PID: 5336)
      • ElZané_çé_.exe (PID: 13276)
      • irecord.exe (PID: 12104)
      • irecord.tmp (PID: 5460)
      • Cubaezhesihae.exe (PID: 13880)
      • ZHuxeshaewequ.exe (PID: 9728)
      • Pytikaedaepo.exe (PID: 7964)
      • ifhwwyy.exe (PID: 19700)
      • Setup3310.exe (PID: 6376)
      • Setup3310.exe (PID: 14180)
      • Setup3310.exe (PID: 5000)
      • Setup3310.tmp (PID: 18992)
      • Setup3310.tmp (PID: 7572)
      • Setup3310.tmp (PID: 17540)
      • google-game.exe (PID: 5940)
      • google-game.exe (PID: 4868)
      • google-game.exe (PID: 11148)
      • ifhwwyy.exe (PID: 20136)
      • SunLabsPlayer.exe (PID: 10752)
      • SunLabsPlayer.exe (PID: 7516)
      • SunLabsPlayer.exe (PID: 8580)
      • Setup.exe (PID: 18792)
      • MediaBurner.exe (PID: 10756)
      • lylal220.exe (PID: 12416)
      • LabPicV3.exe (PID: 17736)
      • hjjgaa.exe (PID: 13388)
      • MediaBurner.tmp (PID: 19992)
      • guihuali-game.exe (PID: 12960)
      • LabPicV3.tmp (PID: 10080)
      • NMemo3Setp.exe (PID: 17372)
      • lylal220.tmp (PID: 7012)
      • MediaBurner.exe (PID: 5496)
      • lylal220.exe (PID: 8152)
      • Setup.exe (PID: 7248)
      • LabPicV3.exe (PID: 4916)
      • Setup.exe (PID: 7332)
      • hjjgaa.exe (PID: 2608)
      • MediaBurner.tmp (PID: 19644)
      • guihuali-game.exe (PID: 18532)
      • lylal220.tmp (PID: 5592)
      • LabPicV3.tmp (PID: 16688)
      • MediaBurner.exe (PID: 16980)
      • LabPicV3.exe (PID: 5132)
      • MediaBurner.tmp (PID: 12516)
      • lylal220.exe (PID: 8956)
      • lylal220.tmp (PID: 2628)
      • guihuali-game.exe (PID: 9552)
      • LabPicV3.tmp (PID: 12652)
      • NMemo3Setp.exe (PID: 6680)
      • ElZané_çé_.exe (PID: 16672)
      • JFHGSFGSIUGFSUIG.exe (PID: 15760)
      • prolab.exe (PID: 9644)
      • 758____Dawn.exe (PID: 5920)
      • prolab.tmp (PID: 4844)
    • Drops a file with too old compile date

      • Xforce_keygen_by_KeygenSumo.exe (PID: 2928)
      • keygen-step-4.exe (PID: 3580)
      • Crack.exe (PID: 2688)
      • cmd.exe (PID: 2920)
      • IDWCH1.exe (PID: 2040)
      • 43A1.tmp.exe (PID: 2172)
      • IDWCH1.exe (PID: 4072)
      • IDWCH1.tmp (PID: 2932)
      • Piiiiiiiipç87.exe (PID: 2964)
      • IDownload.exe (PID: 3484)
      • IDownload.tmp (PID: 2676)
      • SHigetinushae.exe (PID: 2960)
      • Setup3310.exe (PID: 12972)
      • Setup3310.tmp (PID: 4912)
      • Setup.exe (PID: 6040)
      • MediaBurner.exe (PID: 8940)
      • lylal220.exe (PID: 2096)
      • LabPicV3.exe (PID: 13008)
      • guihuali-game.exe (PID: 13856)
      • MediaBurner.tmp (PID: 4160)
      • SunLabsPlayer.exe (PID: 10548)
      • lylal220.tmp (PID: 6256)
      • LabPicV3.tmp (PID: 4108)
      • JFHGSFGSIUGFSUIG.exe (PID: 10016)
      • ultramediaburner.exe (PID: 10248)
      • ultramediaburner.tmp (PID: 8752)
      • 758____Dawn.exe (PID: 4188)
      • prolab.exe (PID: 6384)
      • prolab.tmp (PID: 5336)
      • ElZané_çé_.exe (PID: 13276)
      • irecord.exe (PID: 12104)
      • irecord.tmp (PID: 5460)
      • ZHuxeshaewequ.exe (PID: 9728)
      • Cubaezhesihae.exe (PID: 13880)
      • Pytikaedaepo.exe (PID: 7964)
      • Setup3310.exe (PID: 6376)
      • Setup3310.exe (PID: 14180)
      • Setup3310.exe (PID: 5000)
      • Setup3310.tmp (PID: 18992)
      • Setup3310.tmp (PID: 7572)
      • Setup3310.tmp (PID: 17540)
      • SunLabsPlayer.exe (PID: 10752)
      • SunLabsPlayer.exe (PID: 8580)
      • Setup.exe (PID: 18792)
      • MediaBurner.exe (PID: 10756)
      • SunLabsPlayer.exe (PID: 7516)
      • lylal220.exe (PID: 12416)
      • LabPicV3.exe (PID: 17736)
      • MediaBurner.tmp (PID: 19992)
      • guihuali-game.exe (PID: 12960)
      • lylal220.tmp (PID: 7012)
      • LabPicV3.tmp (PID: 10080)
      • MediaBurner.exe (PID: 5496)
      • lylal220.exe (PID: 8152)
      • Setup.exe (PID: 7248)
      • LabPicV3.exe (PID: 4916)
      • Setup.exe (PID: 7332)
      • MediaBurner.tmp (PID: 19644)
      • guihuali-game.exe (PID: 18532)
      • LabPicV3.tmp (PID: 16688)
      • MediaBurner.exe (PID: 16980)
      • lylal220.tmp (PID: 5592)
      • LabPicV3.exe (PID: 5132)
      • MediaBurner.tmp (PID: 12516)
      • lylal220.exe (PID: 8956)
      • lylal220.tmp (PID: 2628)
      • LabPicV3.tmp (PID: 12652)
      • guihuali-game.exe (PID: 9552)
      • 758____Dawn.exe (PID: 5920)
      • prolab.exe (PID: 9644)
      • prolab.tmp (PID: 4844)
    • Drops a file with a compile date too recent

      • Xforce_keygen_by_KeygenSumo.exe (PID: 2928)
      • keygen-step-4.exe (PID: 3580)
      • GloryWSetp.exe (PID: 3552)
      • 8602741.exe (PID: 2468)
      • 43A1.tmp.exe (PID: 2172)
      • Piiiiiiiipç87.exe (PID: 2964)
      • SHigetinushae.exe (PID: 2960)
      • google-game.exe (PID: 12044)
      • Setup.exe (PID: 6040)
      • NMemo3Setp.exe (PID: 9928)
      • JFHGSFGSIUGFSUIG.exe (PID: 10016)
      • 758____Dawn.exe (PID: 4188)
      • ElZané_çé_.exe (PID: 13276)
      • irecord.tmp (PID: 5460)
      • Pytikaedaepo.exe (PID: 7964)
      • ZHuxeshaewequ.exe (PID: 9728)
      • Cubaezhesihae.exe (PID: 13880)
      • google-game.exe (PID: 5940)
      • google-game.exe (PID: 4868)
      • google-game.exe (PID: 11148)
      • Setup.exe (PID: 18792)
      • NMemo3Setp.exe (PID: 17372)
      • Setup.exe (PID: 7248)
      • Setup.exe (PID: 7332)
      • NMemo3Setp.exe (PID: 6680)
      • ElZané_çé_.exe (PID: 16672)
      • JFHGSFGSIUGFSUIG.exe (PID: 15760)
      • 758____Dawn.exe (PID: 5920)
    • Starts CMD.EXE for commands execution

      • Xforce_keygen_by_KeygenSumo.exe (PID: 2928)
      • keygen-step-5.exe (PID: 1940)
      • keygen-step-3.exe (PID: 2756)
      • JNCo2Vf2MC.EXE (PID: 2724)
      • cmd.exe (PID: 2920)
      • keygen-step-6.exe (PID: 2152)
      • 43A1.tmp.exe (PID: 2172)
      • SHigetinushae.exe (PID: 2960)
      • RunWW.exe (PID: 11172)
      • ZHuxeshaewequ.exe (PID: 9728)
      • Cubaezhesihae.exe (PID: 13880)
      • Pytikaedaepo.exe (PID: 7964)
    • Reads the cookies of Google Chrome

      • keygen-step-3.exe (PID: 2756)
      • 43A1.tmp.exe (PID: 2172)
      • svchost.exe (PID: 2252)
      • 1710767.exe (PID: 3404)
      • 6937479.exe (PID: 3548)
      • jfiag3g_gg.exe (PID: 6504)
      • jfiag3g_gg.exe (PID: 4548)
      • jfiag3g_gg.exe (PID: 6592)
      • RunWW.exe (PID: 11172)
      • 7451165.exe (PID: 9444)
      • 7625686.exe (PID: 4504)
      • jfiag3g_gg.exe (PID: 6728)
      • jfiag3g_gg.exe (PID: 10236)
      • jfiag3g_gg.exe (PID: 14548)
      • jfiag3g_gg.exe (PID: 18260)
      • jfiag3g_gg.exe (PID: 13500)
    • Starts CMD.EXE for self-deleting

      • keygen-step-3.exe (PID: 2756)
      • keygen-step-6.exe (PID: 2152)
      • 43A1.tmp.exe (PID: 2172)
      • RunWW.exe (PID: 11172)
    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2864)
      • cmd.exe (PID: 12412)
    • Creates files in the user directory

      • keygen-step-6.exe (PID: 2152)
      • 5C0D.tmp.exe (PID: 4088)
      • GloryWSetp.exe (PID: 3552)
      • 8602741.exe (PID: 2468)
      • key.exe (PID: 4056)
      • svchost.exe (PID: 2252)
      • SunLabsPlayer.exe (PID: 10548)
      • powershell.exe (PID: 4492)
      • NMemo3Setp.exe (PID: 9928)
      • powershell.exe (PID: 5504)
      • powershell.exe (PID: 6960)
      • powershell.exe (PID: 14508)
      • NMemo3Setp.exe (PID: 17372)
      • NMemo3Setp.exe (PID: 6680)
    • Application launched itself

      • key.exe (PID: 4056)
      • cmd.exe (PID: 2920)
      • hbggg.exe (PID: 5260)
    • Reads Environment values

      • key.exe (PID: 2808)
      • 6937479.exe (PID: 3548)
      • 7625686.exe (PID: 4504)
    • Reads Windows Product ID

      • key.exe (PID: 2808)
    • Reads the Windows organization settings

      • key.exe (PID: 2808)
    • Reads Windows owner or organization settings

      • key.exe (PID: 2808)
    • Uses RUNDLL32.EXE to load library

      • Crack.exe (PID: 2688)
      • google-game.exe (PID: 12044)
      • guihuali-game.exe (PID: 13856)
      • google-game.exe (PID: 4868)
      • google-game.exe (PID: 5940)
      • google-game.exe (PID: 11148)
      • guihuali-game.exe (PID: 12960)
    • Adds / modifies Windows certificates

      • 43A1.tmp.exe (PID: 2172)
      • 1710767.exe (PID: 3404)
      • SHigetinushae.exe (PID: 2960)
      • ifhwwyy.exe (PID: 13988)
      • Setup3310.tmp (PID: 4912)
    • Dropped object may contain URLs of mainers pools

      • keygen-step-6.exe (PID: 2152)
    • Low-level read access rights to disk partition

      • svchost.exe (PID: 904)
      • svchost.exe (PID: 2252)
    • Loads DLL from Mozilla Firefox

      • key.exe (PID: 4056)
    • Searches for installed software

      • key.exe (PID: 2808)
      • 43A1.tmp.exe (PID: 2172)
      • key.exe (PID: 4056)
      • 6937479.exe (PID: 3548)
      • 1710767.exe (PID: 3404)
      • RunWW.exe (PID: 11172)
      • 7625686.exe (PID: 4504)
      • 7451165.exe (PID: 9444)
    • Starts itself from another location

      • 8602741.exe (PID: 2468)
    • Creates files in the program directory

      • 1710767.exe (PID: 3404)
      • SunLabsPlayer.exe (PID: 10548)
      • lighteningplayer-cache-gen.exe (PID: 11192)
      • RunWW.exe (PID: 11172)
      • 7451165.exe (PID: 9444)
      • lighteningplayer-cache-gen.exe (PID: 11324)
      • lighteningplayer-cache-gen.exe (PID: 2968)
      • lighteningplayer-cache-gen.exe (PID: 3720)
    • Reads the cookies of Mozilla Firefox

      • 43A1.tmp.exe (PID: 2172)
      • svchost.exe (PID: 2252)
      • 1710767.exe (PID: 3404)
      • 6937479.exe (PID: 3548)
      • RunWW.exe (PID: 11172)
      • 7451165.exe (PID: 9444)
      • 7625686.exe (PID: 4504)
    • Checks for external IP

      • svchost.exe (PID: 2252)
      • ifhwwyy.exe (PID: 13988)
      • hbggg.exe (PID: 12256)
      • Setup3310.tmp (PID: 4912)
      • hjjgaa.exe (PID: 10188)
      • ifhwwyy.exe (PID: 20136)
      • ifhwwyy.exe (PID: 19700)
      • ifhwwyy.exe (PID: 14616)
      • Setup3310.tmp (PID: 18992)
      • Setup3310.tmp (PID: 7572)
      • Setup3310.tmp (PID: 17540)
      • hjjgaa.exe (PID: 13388)
      • hjjgaa.exe (PID: 2608)
      • hjjgaa.exe (PID: 16176)
    • Creates a directory in Program Files

      • Piiiiiiiipç87.exe (PID: 2964)
      • IDownload.tmp (PID: 2676)
      • SunLabsPlayer.exe (PID: 10548)
      • Setup.exe (PID: 6040)
      • JFHGSFGSIUGFSUIG.exe (PID: 10016)
      • 758____Dawn.exe (PID: 4188)
      • ElZané_çé_.exe (PID: 13276)
      • ultramediaburner.tmp (PID: 8752)
      • prolab.tmp (PID: 5336)
      • irecord.tmp (PID: 5460)
      • 758____Dawn.exe (PID: 5920)
    • Executed via COM

      • iexplore.exe (PID: 2412)
    • Starts Internet Explorer

      • Wudalakawi.exe (PID: 2540)
      • Sezhaetyhaezhae.exe (PID: 924)
      • Qizhozhegaezha.exe (PID: 11624)
      • Fabikelaemu.exe (PID: 13604)
    • Creates a software uninstall entry

      • SunLabsPlayer.exe (PID: 10548)
      • SunLabsPlayer.exe (PID: 10752)
      • SunLabsPlayer.exe (PID: 7516)
      • SunLabsPlayer.exe (PID: 8580)
    • Executes application which crashes

      • cmd.exe (PID: 4288)
      • cmd.exe (PID: 2284)
      • cmd.exe (PID: 17508)
      • cmd.exe (PID: 10092)
    • Starts application with an unusual extension

      • SunLabsPlayer.exe (PID: 10548)
      • SunLabsPlayer.exe (PID: 7516)
      • SunLabsPlayer.exe (PID: 10752)
      • SunLabsPlayer.exe (PID: 8580)
    • Executes PowerShell scripts

      • ns39F8.tmp (PID: 8572)
      • nsEE11.tmp (PID: 9580)
      • nsEE21.tmp (PID: 10568)
      • nsF5B2.tmp (PID: 2768)
  • INFO

    • Manual execution by user

      • WinRAR.exe (PID: 2192)
      • Xforce_keygen_by_KeygenSumo.exe (PID: 2928)
    • Reads Microsoft Office registry keys

      • key.exe (PID: 2808)
    • Application was dropped or rewritten from another process

      • IDWCH1.tmp (PID: 2908)
      • IDWCH1.tmp (PID: 2932)
      • Piiiiiiiipç87.exe (PID: 2964)
      • IDownload.tmp (PID: 2676)
      • Setup3310.tmp (PID: 4912)
      • Setup.exe (PID: 6040)
      • lylal220.tmp (PID: 6256)
      • LabPicV3.tmp (PID: 4108)
      • MediaBurner.tmp (PID: 4160)
      • JFHGSFGSIUGFSUIG.exe (PID: 10016)
      • 758____Dawn.exe (PID: 4188)
      • ElZané_çé_.exe (PID: 13276)
      • ultramediaburner.tmp (PID: 8752)
      • prolab.tmp (PID: 5336)
      • irecord.tmp (PID: 5460)
      • Setup3310.tmp (PID: 18992)
      • Setup3310.tmp (PID: 7572)
      • Setup3310.tmp (PID: 17540)
      • Setup.exe (PID: 18792)
      • Setup.exe (PID: 7332)
      • Setup.exe (PID: 7248)
      • lylal220.tmp (PID: 7012)
      • LabPicV3.tmp (PID: 10080)
      • MediaBurner.tmp (PID: 19992)
      • JFHGSFGSIUGFSUIG.exe (PID: 15760)
      • 758____Dawn.exe (PID: 5920)
      • ElZané_çé_.exe (PID: 16672)
      • MediaBurner.tmp (PID: 19644)
      • lylal220.tmp (PID: 5592)
      • LabPicV3.tmp (PID: 16688)
      • MediaBurner.tmp (PID: 12516)
      • LabPicV3.tmp (PID: 12652)
      • JFHGSFGSIUGFSUIG.exe (PID: 14928)
      • lylal220.tmp (PID: 2628)
      • ElZané_çé_.exe (PID: 17484)
      • 758____Dawn.exe (PID: 10268)
      • prolab.tmp (PID: 4844)
      • JFHGSFGSIUGFSUIG.exe (PID: 16560)
      • ElZané_çé_.exe (PID: 15944)
      • 758____Dawn.exe (PID: 17144)
    • Loads dropped or rewritten executable

      • IDWCH1.tmp (PID: 2932)
      • IDownload.tmp (PID: 2676)
      • Setup3310.tmp (PID: 4912)
      • MediaBurner.tmp (PID: 4160)
      • lylal220.tmp (PID: 6256)
      • LabPicV3.tmp (PID: 4108)
      • ultramediaburner.tmp (PID: 8752)
      • prolab.tmp (PID: 5336)
      • irecord.tmp (PID: 5460)
      • Setup3310.tmp (PID: 7572)
      • Setup3310.tmp (PID: 18992)
      • Setup3310.tmp (PID: 17540)
      • MediaBurner.tmp (PID: 19992)
      • LabPicV3.tmp (PID: 10080)
      • lylal220.tmp (PID: 7012)
      • MediaBurner.tmp (PID: 19644)
      • lylal220.tmp (PID: 5592)
      • LabPicV3.tmp (PID: 16688)
      • MediaBurner.tmp (PID: 12516)
      • lylal220.tmp (PID: 2628)
      • LabPicV3.tmp (PID: 12652)
    • Creates files in the program directory

      • Piiiiiiiipç87.exe (PID: 2964)
      • IDownload.tmp (PID: 2676)
      • Setup.exe (PID: 6040)
      • JFHGSFGSIUGFSUIG.exe (PID: 10016)
      • 758____Dawn.exe (PID: 4188)
      • ultramediaburner.tmp (PID: 8752)
      • prolab.tmp (PID: 5336)
      • ElZané_çé_.exe (PID: 13276)
      • irecord.tmp (PID: 5460)
      • Setup.exe (PID: 18792)
      • Setup.exe (PID: 7248)
      • Setup.exe (PID: 7332)
      • 758____Dawn.exe (PID: 5920)
    • Creates a software uninstall entry

      • IDownload.tmp (PID: 2676)
      • Setup.exe (PID: 6040)
      • ultramediaburner.tmp (PID: 8752)
      • prolab.tmp (PID: 5336)
      • irecord.tmp (PID: 5460)
      • Setup.exe (PID: 18792)
      • Setup.exe (PID: 7248)
      • Setup.exe (PID: 7332)
    • Reads settings of System Certificates

      • Wudalakawi.exe (PID: 2540)
      • SHigetinushae.exe (PID: 2960)
      • iexplore.exe (PID: 2760)
      • iexplore.exe (PID: 308)
      • iexplore.exe (PID: 2412)
      • iexplore.exe (PID: 2580)
      • Sezhaetyhaezhae.exe (PID: 924)
      • Cubaezhesihae.exe (PID: 13880)
      • Pytikaedaepo.exe (PID: 7964)
      • ZHuxeshaewequ.exe (PID: 9728)
      • Fabikelaemu.exe (PID: 13604)
      • 758____Dawn.exe (PID: 5920)
    • Application launched itself

      • iexplore.exe (PID: 2412)
      • iexplore.exe (PID: 2580)
      • iexplore.exe (PID: 11448)
      • iexplore.exe (PID: 12944)
      • iexplore.exe (PID: 4544)
    • Changes internet zones settings

      • iexplore.exe (PID: 2412)
      • iexplore.exe (PID: 2580)
      • iexplore.exe (PID: 11448)
      • iexplore.exe (PID: 12944)
      • iexplore.exe (PID: 4544)
    • Changes settings of System certificates

      • iexplore.exe (PID: 308)
      • iexplore.exe (PID: 2580)
    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 308)
      • iexplore.exe (PID: 2580)
    • Creates files in the user directory

      • iexplore.exe (PID: 2760)
      • iexplore.exe (PID: 308)
    • Reads internet explorer settings

      • iexplore.exe (PID: 308)
      • iexplore.exe (PID: 2760)
      • iexplore.exe (PID: 6456)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: Xforce_keygen_by_KeygenSumo.zip
ZipUncompressedSize: 6506518
ZipCompressedSize: 6506518
ZipCRC: 0xfad1872d
ZipModifyDate: 2021:07:02 07:18:08
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 10
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
337
Monitored processes
230
Malicious processes
56
Suspicious processes
57

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start inject inject inject drop and start drop and start drop and start drop and start drop and start drop and start drop and start download and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe no specs winrar.exe xforce_keygen_by_keygensumo.exe cmd.exe no specs keygen-pr.exe #AZORULT keygen-step-1.exe keygen-step-5.exe no specs keygen-step-6.exe keygen-step-3.exe keygen-step-4.exe cmd.exe cmd.exe no specs jnco2vf2mc.exe no specs taskkill.exe no specs ping.exe no specs #PONY key.exe crack.exe cmd.exe no specs key.exe no specs cmd.exe cmd.exe no specs cmd.exe no specs regsvr32.exe no specs #RACCOON 43a1.tmp.exe rundll32.exe note866.exe svchost.exe svchost.exe glorywsetp.exe 5c0d.tmp.exe cmd.exe no specs ping.exe no specs #AGENTTESLA svchost.exe 1710767.exe 8602741.exe #REDLINE 6937479.exe idwch1.exe idwch1.tmp no specs winhoster.exe no specs consent.exe no specs idwch1.exe idwch1.tmp cmd.exe no specs timeout.exe no specs piiiiiiiipç87.exe idownload.exe idownload.tmp idownload.app.exe no specs wudalakawi.exe csc.exe no specs shigetinushae.exe cvtres.exe no specs iexplore.exe iexplore.exe iexplore.exe iexplore.exe hbggg.exe no specs cmd.exe no specs consent.exe no specs ifhwwyy.exe jfiag3g_gg.exe no specs hbggg.exe jfiag3g_gg.exe no specs cmd.exe no specs setup3310.exe setup3310.tmp jfiag3g_gg.exe no specs jfiag3g_gg.exe no specs cmd.exe no specs google-game.exe rundll32.exe no specs cmd.exe no specs sunlabsplayer.exe cmd.exe no specs ntvdm.exe ns39f8.tmp no specs powershell.exe no specs setup.exe hjjgaa.exe #VIDAR runww.exe nmemo3setp.exe mediaburner.exe lylal220.exe labpicv3.exe mediaburner.tmp guihuali-game.exe lylal220.tmp jfiag3g_gg.exe no specs labpicv3.tmp ns5a53.tmp no specs lighteningplayer-cache-gen.exe no specs jfhgsfgsiugfsuig.exe jfiag3g_gg.exe no specs 758____dawn.exe elzané_çé_.exe 7451165.exe 7233392.exe no specs #REDLINE 7625686.exe rundll32.exe no specs ultramediaburner.exe ultramediaburner.tmp prolab.exe prolab.tmp ultramediaburner.exe no specs irecord.exe sezhaetyhaezhae.exe irecord.tmp cubaezhesihae.exe cmd.exe no specs qizhozhegaezha.exe taskkill.exe no specs zhuxeshaewequ.exe timeout.exe no specs i-record.exe no specs fabikelaemu.exe pytikaedaepo.exe iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs iexplore.exe iexplore.exe iexplore.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs ifhwwyy.exe ifhwwyy.exe ifhwwyy.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs jfiag3g_gg.exe no specs jfiag3g_gg.exe no specs jfiag3g_gg.exe no specs setup3310.exe setup3310.exe setup3310.exe setup3310.tmp setup3310.tmp setup3310.tmp cmd.exe no specs cmd.exe no specs cmd.exe no specs google-game.exe google-game.exe google-game.exe jfiag3g_gg.exe no specs jfiag3g_gg.exe no specs jfiag3g_gg.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs cmd.exe no specs cmd.exe no specs sunlabsplayer.exe sunlabsplayer.exe cmd.exe no specs cmd.exe no specs sunlabsplayer.exe cmd.exe no specs ntvdm.exe no specs ntvdm.exe no specs cmd.exe no specs ntvdm.exe no specs nsee11.tmp no specs nsee21.tmp no specs powershell.exe no specs powershell.exe no specs nsf5b2.tmp no specs powershell.exe no specs ns40a7.tmp no specs ns40a7.tmp no specs lighteningplayer-cache-gen.exe no specs lighteningplayer-cache-gen.exe no specs ns42ba.tmp no specs lighteningplayer-cache-gen.exe no specs setup.exe setup.exe setup.exe hjjgaa.exe runww.exe nmemo3setp.exe mediaburner.exe lylal220.exe labpicv3.exe mediaburner.tmp guihuali-game.exe lylal220.tmp labpicv3.tmp jfiag3g_gg.exe no specs jfhgsfgsiugfsuig.exe 758____dawn.exe elzané_çé_.exe hjjgaa.exe runww.exe nmemo3setp.exe mediaburner.exe mediaburner.tmp lylal220.exe labpicv3.exe lylal220.tmp guihuali-game.exe labpicv3.tmp jfiag3g_gg.exe no specs hjjgaa.exe runww.exe nmemo3setp.exe mediaburner.exe mediaburner.tmp lylal220.exe lylal220.tmp labpicv3.exe jfiag3g_gg.exe no specs labpicv3.tmp guihuali-game.exe 7032118.exe jfiag3g_gg.exe no specs jfhgsfgsiugfsuig.exe no specs rundll32.exe no specs 8936632.exe no specs elzané_çé_.exe no specs 4565871.exe no specs 758____dawn.exe no specs jfiag3g_gg.exe no specs prolab.exe iexplore.exe no specs prolab.tmp jfhgsfgsiugfsuig.exe no specs elzané_çé_.exe no specs 758____dawn.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
272ping 1.1.1.1 -n 1 -w 3000 C:\Windows\system32\PING.EXEcmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
308"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2580 CREDAT:275457 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
348"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-6.exe" >> NULC:\Windows\system32\cmd.exekeygen-step-6.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
876C:\Windows\system32\svchost.exe -k netsvcsC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
904C:\Windows\system32\svchost.exe -k SystemNetworkServiceC:\Windows\system32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
924"C:\Users\admin\AppData\Local\Temp\79-2c5b7-6a9-7569d-5204d928ba9d4\Sezhaetyhaezhae.exe" C:\Users\admin\AppData\Local\Temp\79-2c5b7-6a9-7569d-5204d928ba9d4\Sezhaetyhaezhae.exe
JFHGSFGSIUGFSUIG.exe
User:
admin
Company:
Soft_Cpm_ID__wcz9g62k6fav6864eh3z
Integrity Level:
HIGH
Description:
Soft_Cpm_ID__wcz9g62k6fav6864eh3z
Exit code:
0
Version:
3.3.3.3
Modules
Images
c:\users\admin\appdata\local\temp\79-2c5b7-6a9-7569d-5204d928ba9d4\sezhaetyhaezhae.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
944"C:\Users\admin\AppData\Local\Temp\nscE16E.tmp\ns42BA.tmp" "C:\Program Files\lighteningplayer\lighteningplayer-cache-gen.exe" C:\Program Files\lighteningplayer\plugins\ /SILENTC:\Users\admin\AppData\Local\Temp\nscE16E.tmp\ns42BA.tmpSunLabsPlayer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsce16e.tmp\ns42ba.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
996cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"C:\Windows\system32\cmd.exekeygen-step-3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1320"C:\Users\admin\AppData\Roaming\WinHost\WinHoster.exe" C:\Users\admin\AppData\Roaming\WinHost\WinHoster.exe8602741.exe
User:
admin
Company:
WinHost
Integrity Level:
MEDIUM
Description:
WinHost
Exit code:
0
Version:
1.0.0.12
Modules
Images
c:\users\admin\appdata\roaming\winhost\winhoster.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1460"C:\Windows\System32\cmd.exe" /q /C TypE "C:\Users\admin\AppData\Local\Temp\JNCo2Vf2MC.EXE" > JNCo2Vf2MC.EXE &&stArt JNCo2VF2MC.eXe -PaZ3cHdzoOBUwugzFH & iF "-PaZ3cHdzoOBUwugzFH " == "" for %h In ( "C:\Users\admin\AppData\Local\Temp\JNCo2Vf2MC.EXE" ) do taskkill /f /iM "%~NXh" > NuL C:\Windows\System32\cmd.exeJNCo2Vf2MC.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
25 420
Read events
22 151
Write events
3 208
Delete events
61

Modification events

(PID) Process:(2136) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2136) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2136) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2136) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E
Operation:writeName:@C:\Windows\system32\NetworkExplorer.dll,-1
Value:
Network
(PID) Process:(2136) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Downloads\Xforce_keygen_by_KeygenSumo.zip
(PID) Process:(2136) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2136) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2136) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2136) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2136) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
Executable files
836
Suspicious files
111
Text files
340
Unknown types
218

Dropped files

PID
Process
Filename
Type
2136WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2136.38554\Xforce_keygen_by_KeygenSumo.zip
MD5:
SHA256:
2192WinRAR.exeC:\Users\admin\Desktop\FILE_ID.DIZtext
MD5:
SHA256:
2192WinRAR.exeC:\Users\admin\Desktop\Xforce_keygen_by_KeygenSumo.exeexecutable
MD5:
SHA256:
2928Xforce_keygen_by_KeygenSumo.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-6.exeexecutable
MD5:
SHA256:
2928Xforce_keygen_by_KeygenSumo.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exeexecutable
MD5:
SHA256:
2928Xforce_keygen_by_KeygenSumo.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exeexecutable
MD5:
SHA256:
2756keygen-step-3.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Login Data1sqlite
MD5:
SHA256:
2928Xforce_keygen_by_KeygenSumo.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exeexecutable
MD5:
SHA256:
3580keygen-step-4.exeC:\Users\admin\AppData\Local\Temp\RarSFX2\GloryWSetp.exeexecutable
MD5:
SHA256:
3580keygen-step-4.exeC:\Users\admin\AppData\Local\Temp\RarSFX2\John.urltext
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
85
TCP/UDP connections
108
DNS requests
83
Threats
312

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2756
keygen-step-3.exe
POST
200
107.191.60.39:80
http://www.w7dslkipoja.com/index.php/api/fb
JP
text
24 b
suspicious
2152
keygen-step-6.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
2152
keygen-step-6.exe
GET
200
151.139.128.14:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEGmjTouN%2FW5s3CDseaiw7qE%3D
US
der
471 b
whitelisted
2152
keygen-step-6.exe
GET
301
85.214.154.106:80
http://www.almanhost.com/components/fw2.php
DE
executable
515 Kb
suspicious
2152
keygen-step-6.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
2152
keygen-step-6.exe
GET
200
23.45.105.185:80
http://x1.c.lencr.org/
NL
der
717 b
whitelisted
2152
keygen-step-6.exe
GET
301
85.214.154.106:80
http://www.almanhost.com/components/fw3.php
DE
executable
515 Kb
suspicious
2152
keygen-step-6.exe
GET
200
85.214.154.106:80
http://www.almanhost.com/components/fw4.exe
DE
executable
101 Kb
suspicious
2152
keygen-step-6.exe
GET
200
85.214.154.106:80
http://www.almanhost.com/components/fw3.exe
DE
executable
118 Kb
suspicious
2152
keygen-step-6.exe
GET
200
85.214.154.106:80
http://www.almanhost.com/components/fw1.php
DE
executable
515 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2756
keygen-step-3.exe
107.191.60.39:80
www.w7dslkipoja.com
Choopa, LLC
JP
malicious
2416
keygen-step-1.exe
185.173.37.179:80
kvaka.li
M-Telecom, LLC
RU
malicious
2152
keygen-step-6.exe
88.99.66.31:443
iplogger.org
Hetzner Online GmbH
DE
malicious
2152
keygen-step-6.exe
151.139.128.14:80
ocsp.comodoca.com
Highwinds Network Group, Inc.
US
suspicious
2152
keygen-step-6.exe
85.214.154.106:80
www.almanhost.com
Strato AG
DE
suspicious
2152
keygen-step-6.exe
23.45.105.185:80
x1.c.lencr.org
Akamai International B.V.
NL
unknown
2152
keygen-step-6.exe
195.138.255.18:80
r3.o.lencr.org
AS33891 Netzbetrieb GmbH
DE
unknown
2172
43A1.tmp.exe
95.216.186.40:443
tttttt.me
Hetzner Online GmbH
DE
suspicious
3552
GloryWSetp.exe
104.21.42.63:443
videoconvert-download38.xyz
Cloudflare Inc
US
suspicious
2172
43A1.tmp.exe
35.205.249.65:80
Google Inc.
US
malicious

DNS requests

Domain
IP
Reputation
www.w7dslkipoja.com
  • 107.191.60.39
suspicious
kvaka.li
  • 185.173.37.179
malicious
iplogger.org
  • 88.99.66.31
shared
ocsp.comodoca.com
  • 151.139.128.14
whitelisted
ocsp.usertrust.com
  • 151.139.128.14
whitelisted
ocsp.sectigo.com
  • 151.139.128.14
whitelisted
www.almanhost.com
  • 85.214.154.106
suspicious
crl.identrust.com
  • 195.138.255.11
  • 195.138.255.17
whitelisted
x1.c.lencr.org
  • 23.45.105.185
whitelisted
r3.o.lencr.org
  • 195.138.255.18
  • 195.138.255.16
  • 23.55.163.58
  • 23.55.163.48
shared

Threats

PID
Process
Class
Message
2416
keygen-step-1.exe
A Network Trojan was detected
ET TROJAN Win32/AZORult V3.3 Client Checkin M2
2416
keygen-step-1.exe
A Network Trojan was detected
AV TROJAN Azorult CnC Beacon
2152
keygen-step-6.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2152
keygen-step-6.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2152
keygen-step-6.exe
Misc activity
ET INFO EXE - Served Attached HTTP
2152
keygen-step-6.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
2152
keygen-step-6.exe
Potentially Bad Traffic
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
2152
keygen-step-6.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2152
keygen-step-6.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
2152
keygen-step-6.exe
Potentially Bad Traffic
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
103 ETPRO signatures available at the full report
No debug info