URL:

https://mega.nz/file/6wlDRaTb#HpLeHwzlMc3dEUdDaP27FVzhSOX3fmJRtHd9OnC0ZHE

Full analysis: https://app.any.run/tasks/0ed00fc3-5d9e-43aa-8223-b448c78d74f4
Verdict: Malicious activity
Analysis date: August 26, 2020, 23:12:38
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

8B15D7214D97F75F2EA96AF0C425F795

SHA1:

8AB6174167C0E1C1D34D78ECB58F846E2840BEDB

SHA256:

C2E44032A2F1DBAC11B7FB0A795826B3ADFA661A1663D669CF51CBA0A40CA2BD

SSDEEP:

3:N8X/iSSv6+ughbG1Bhc4kBBwmA:2jSv9ugKGwR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • RED CRACKING - EL1T3 EDITION.exe (PID: 3504)
      • dataBaseCfg.exe (PID: 1920)
      • Windows Services.exe (PID: 2568)
      • dataBaseCfg.exe (PID: 3212)
      • Runtime Explorer.exe (PID: 3000)
      • Runtime Explorer.exe (PID: 3132)
      • Secure System Shell.exe (PID: 2956)
      • Runtime Explorer.exe (PID: 2496)
      • RED CRACKING - EL1T3 EDITION.exe (PID: 292)
      • Windows Services.exe (PID: 2216)

    • Loads dropped or rewritten executable

      • RED CRACKING - EL1T3 EDITION.exe (PID: 3504)
      • SearchProtocolHost.exe (PID: 3856)
      • explorer.exe (PID: 352)

    • Changes the autorun value in the registry

      • dataBaseCfg.exe (PID: 1920)
      • dataBaseCfg.exe (PID: 3212)

    • Writes to a start menu file

      • dataBaseCfg.exe (PID: 1920)
      • dataBaseCfg.exe (PID: 3212)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3076)
      • dataBaseCfg.exe (PID: 1920)
      • explorer.exe (PID: 352)

    • Creates files in the user directory

      • dataBaseCfg.exe (PID: 1920)
      • explorer.exe (PID: 352)

    • Creates files in the Windows directory

      • dataBaseCfg.exe (PID: 1920)

  • INFO

    • Reads the hosts file

      • chrome.exe (PID: 2808)
      • chrome.exe (PID: 2440)

    • Application launched itself

      • chrome.exe (PID: 2808)

    • Dropped object may contain Bitcoin addresses

      • chrome.exe (PID: 2808)
      • WinRAR.exe (PID: 3076)
      • dataBaseCfg.exe (PID: 1920)

    • Manual execution by user

      • RED CRACKING - EL1T3 EDITION.exe (PID: 3504)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
76
Monitored processes
26
Malicious processes
6
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winrar.exe searchprotocolhost.exe no specs chrome.exe no specs chrome.exe no specs explorer.exe red cracking - el1t3 edition.exe no specs databasecfg.exe windows services.exe no specs secure system shell.exe no specs runtime explorer.exe no specs runtime explorer.exe no specs runtime explorer.exe no specs red cracking - el1t3 edition.exe databasecfg.exe windows services.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
292"C:\Users\admin\Desktop\RED CRACKING - EL1T3 EDITION.exe" C:\Users\admin\Desktop\RED CRACKING - EL1T3 EDITION.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Ultimate Cracking Tools
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\red cracking - el1t3 edition.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
352C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
1448"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1008,7252084873325037090,15519864357574762725,131072 --enable-features=PasswordImport --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=17613425689707955604 --mojo-platform-channel-handle=3744 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1672"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1008,7252084873325037090,15519864357574762725,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=8179050031151624470 --mojo-platform-channel-handle=1024 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1920"C:\Users\admin\Desktop\RED CRACKING - EL1T3 EDITION\Dlls\dataBaseCfg.exe" C:\Users\admin\Desktop\RED CRACKING - EL1T3 EDITION\Dlls\dataBaseCfg.exe
RED CRACKING - EL1T3 EDITION.exe
User:
admin
Integrity Level:
HIGH
Description:
interface
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\red cracking - el1t3 edition\dlls\databasecfg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2184"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1008,7252084873325037090,15519864357574762725,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=17086458910437387521 --mojo-platform-channel-handle=3692 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2216"C:\Windows\diagnostic\Windows Services.exe" {Arguments If Needed}C:\Windows\diagnostic\Windows Services.exe—dataBaseCfg.exe
User:
admin
Integrity Level:
HIGH
Description:
Windows Services
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\windows\diagnostic\windows services.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2232"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1008,7252084873325037090,15519864357574762725,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=6642313453787699600 --mojo-platform-channel-handle=3500 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2440"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1008,7252084873325037090,15519864357574762725,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=2612143008479941346 --mojo-platform-channel-handle=1580 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2496"C:\Windows\diagnostic\Runtime Explorer.exe" C:\Windows\diagnostic\Runtime Explorer.exe—Windows Services.exe
User:
admin
Company:
Control Service
Integrity Level:
HIGH
Exit code:
0
Version:
1.00
Modules
Images
c:\windows\diagnostic\runtime explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
6 095
Read events
5 834
Write events
255
Delete events
6

Modification events

(PID) Process:(2808) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2808) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2808) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(2808) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(2928) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:2808-13242957173042000
Value:
259
(PID) Process:(2808) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2808) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(2808) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(2808) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:2832-13239195546717773
Value:
0
(PID) Process:(2808) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
15
Suspicious files
94
Text files
104
Unknown types
20

Dropped files

PID
Process
Filename
Type
2808chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\b89f975c-572e-48f8-a479-f676216a4148.tmp —
MD5:—
SHA256:—
2808chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000032.dbtmp —
MD5:—
SHA256:—
2808chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:988975E56D776333B46F1BCAE6967C0E
SHA256:22186F0422A02BE70860975EF688A895EEA653C3A7259FFBA9114138A544E05A
2808chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.oldtext
MD5:142AFC7F980CB38310D0680F2E8907CF
SHA256:3D5E5DF95E28CF65C77882748077EC52706AF02F8D869E188B6D16F782F82F44
2808chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RF19115b.TMPtext
MD5:D11C35B3D5258F594933332C11C6F0F2
SHA256:DC2EB16E16FA3FB258AC31A481F817208CF0C917AF4224F2832588D3A64ADD05
2808chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG.old —
MD5:—
SHA256:—
2808chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF19112c.TMPtext
MD5:988975E56D776333B46F1BCAE6967C0E
SHA256:22186F0422A02BE70860975EF688A895EEA653C3A7259FFBA9114138A544E05A
2808chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
2808chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old~RF191320.TMP —
MD5:—
SHA256:—
2808chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.oldtext
MD5:D11C35B3D5258F594933332C11C6F0F2
SHA256:DC2EB16E16FA3FB258AC31A481F817208CF0C917AF4224F2832588D3A64ADD05
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
36
DNS requests
21
Threats
4

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2440
chrome.exe
216.58.212.163:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
2440
chrome.exe
31.216.148.10:443
mega.nz
Datacenter Luxembourg S.A.
LU
unknown
2440
chrome.exe
216.58.208.45:443
accounts.google.com
Google Inc.
US
whitelisted
2440
chrome.exe
172.217.22.106:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
2440
chrome.exe
172.217.18.110:443
clients1.google.com
Google Inc.
US
whitelisted
2440
chrome.exe
89.44.169.134:443
eu.static.mega.co.nz
Datacenter Luxembourg S.A.
LU
suspicious
2440
chrome.exe
216.58.206.4:443
www.google.com
Google Inc.
US
whitelisted
2440
chrome.exe
31.216.147.134:443
g.api.mega.co.nz
Datacenter Luxembourg S.A.
LU
unknown
2440
chrome.exe
185.206.25.25:443
gfs302n115.userstorage.mega.co.nz
—
FR
unknown
2440
chrome.exe
185.206.26.25:443
gfs208n115.userstorage.mega.co.nz
—
DE
unknown

DNS requests

Domain
IP
Reputation
clientservices.googleapis.com
  • 216.58.212.163
whitelisted
mega.nz
  • 31.216.148.10
whitelisted
accounts.google.com
  • 216.58.208.45
shared
safebrowsing.googleapis.com
  • 172.217.22.106
whitelisted
clients1.google.com
  • 172.217.18.110
  • 216.58.212.174
whitelisted
eu.static.mega.co.nz
  • 89.44.169.134
  • 31.216.148.13
  • 31.216.148.11
  • 66.203.127.11
  • 66.203.127.13
  • 89.44.169.132
shared
g.api.mega.co.nz
  • 31.216.147.134
  • 31.216.147.136
  • 31.216.147.132
  • 31.216.147.135
  • 31.216.147.133
shared
www.google.com
  • 216.58.206.4
malicious
gfs302n115.userstorage.mega.co.nz
  • 185.206.25.25
unknown
gfs208n115.userstorage.mega.co.nz
  • 185.206.26.25
unknown

Threats

PID
Process
Class
Message
292
RED CRACKING - EL1T3 EDITION.exe
Potential Corporate Privacy Violation
REMOTE [PTsecurity] Remote MySQL Administration
292
RED CRACKING - EL1T3 EDITION.exe
Potential Corporate Privacy Violation
REMOTE [PTsecurity] Remote MySQL Administration
292
RED CRACKING - EL1T3 EDITION.exe
Potential Corporate Privacy Violation
REMOTE [PTsecurity] Remote MySQL Administration
292
RED CRACKING - EL1T3 EDITION.exe
Potential Corporate Privacy Violation
REMOTE [PTsecurity] Remote MySQL Administration
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://mega.nz/file/6wlDRaTb#HpLeHwzlMc3dEUdDaP27FVzhSOX3fmJRtHd9OnC0ZHE