URL: | https://bestbdjob.com/snapdownloader-crack/#Cracked_SnapDownloader_1131_with_License_Key_Free_2023 |
Full analysis: | https://app.any.run/tasks/08a38d1a-fb0f-4be7-a699-c7ae3b6026ed |
Verdict: | Malicious activity |
Analysis date: | October 05, 2023, 11:43:48 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
SHA1: | BF175545B9B2BD92FC018583CB2555D40720D753 |
SHA256: | CCA2A6499B107C2FCD3ED36A997B239AF6FE3041CA010CCBF2AD2A876027887A |
SSDEEP: | 3:N8vHUSBLMuXIGHXL/42X6UU2Z0lvlEXWn:2BLMzGHz4gktEG |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
568 | "C:\Program Files\SnapDownloader\SnapDownloader.exe" | C:\Program Files\SnapDownloader\SnapDownloader.exe | — | explorer.exe | |||||||||||
User: admin Company: SnapDownloader Integrity Level: MEDIUM Description: SnapDownloader Exit code: 0 Version: 1.13.1 Modules
| |||||||||||||||
1560 | C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\REG.exe QUERY HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid" | C:\Windows\System32\cmd.exe | — | SnapDownloader.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
1592 | C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get UUID" | C:\Windows\System32\cmd.exe | — | SnapDownloader.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
1772 | "C:\Program Files\SnapDownloader\SnapDownloader.exe" --type=renderer --field-trial-handle=964,10400497791332964313,12654977059544934403,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --app-user-model-id=SnapDownloader --app-path="C:\Program Files\SnapDownloader\resources\app.asar" --no-sandbox --no-zygote --enable-remote-module --context-isolation --background-color=#fff --guest-instance-id=4 --enable-blink-features --disable-blink-features --enable-websql --disable-electron-site-instance-overrides --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2124 /prefetch:1 | C:\Program Files\SnapDownloader\SnapDownloader.exe | — | SnapDownloader.exe | |||||||||||
User: admin Company: SnapDownloader Integrity Level: MEDIUM Description: SnapDownloader Exit code: 0 Version: 1.13.1 Modules
| |||||||||||||||
2196 | wmic csproduct get UUID | C:\Windows\System32\wbem\WMIC.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: WMI Commandline Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2264 | "C:\Program Files\SnapDownloader\SnapDownloader.exe" --type=renderer --field-trial-handle=964,10400497791332964313,12654977059544934403,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-compositing --lang=en-US --app-user-model-id=SnapDownloader --app-path="C:\Program Files\SnapDownloader\resources\app.asar" --webview-tag --no-sandbox --no-zygote --preload="C:\Program Files\SnapDownloader\resources\app.asar\preload.js" --enable-remote-module --context-isolation --background-color=#1C2B3E --enable-websql --disable-electron-site-instance-overrides --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1868 /prefetch:1 | C:\Program Files\SnapDownloader\SnapDownloader.exe | — | SnapDownloader.exe | |||||||||||
User: admin Company: SnapDownloader Integrity Level: MEDIUM Description: SnapDownloader Exit code: 0 Version: 1.13.1 Modules
| |||||||||||||||
2308 | "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\SnapDownloader-Setup-1.13.1-win32.exe" | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\SnapDownloader-Setup-1.13.1-win32.exe | — | iexplore.exe | |||||||||||
User: admin Company: SnapDownloader Integrity Level: MEDIUM Exit code: 3221226540 Version: 1.13.1 Modules
| |||||||||||||||
2420 | "C:\Program Files\SnapDownloader\SnapDownloader.exe" --type=gpu-process --field-trial-handle=964,10400497791332964313,12654977059544934403,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1204 --ignored=" --type=renderer " /prefetch:2 | C:\Program Files\SnapDownloader\SnapDownloader.exe | — | SnapDownloader.exe | |||||||||||
User: admin Company: SnapDownloader Integrity Level: LOW Description: SnapDownloader Exit code: 0 Version: 1.13.1 Modules
| |||||||||||||||
3036 | C:\Windows\system32\cmd.exe /d /s /c "wmic csproduct get IdentifyingNumber" | C:\Windows\System32\cmd.exe | — | SnapDownloader.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
3128 | wmic csproduct get IdentifyingNumber | C:\Windows\System32\wbem\WMIC.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: WMI Commandline Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
|
(PID) Process: | (3636) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPDaysSinceLastAutoMigration |
Value: 0 | |||
(PID) Process: | (3636) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
Operation: | write | Name: | NTPLastLaunchHighDateTime |
Value: 30847387 | |||
(PID) Process: | (3636) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
Operation: | write | Name: | NextCheckForUpdateHighDateTime |
Value: 30847437 | |||
(PID) Process: | (3636) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
(PID) Process: | (3636) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
(PID) Process: | (3636) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
(PID) Process: | (3636) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (3636) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (3636) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (3636) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3452 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | compressed | |
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89 | SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8 | |||
3452 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Cab171D.tmp | compressed | |
MD5:F3441B8572AAE8801C04F3060B550443 | SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF | |||
3452 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:8B3F5B8F2A0F7E5947DF780AC8B6A5D6 | SHA256:B010287C39C7BC50851448001AF90C733D36C6D792A8042299B3AED6539B1786 | |||
3452 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Tar170D.tmp | cat | |
MD5:9441737383D21192400ECA82FDA910EC | SHA256:BC3A6E84E41FAEB57E7C21AA3B60C2A64777107009727C5B7C0ED8FE658909E5 | |||
3452 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 | compressed | |
MD5:F3441B8572AAE8801C04F3060B550443 | SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF | |||
3452 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Tar171E.tmp | binary | |
MD5:9441737383D21192400ECA82FDA910EC | SHA256:BC3A6E84E41FAEB57E7C21AA3B60C2A64777107009727C5B7C0ED8FE658909E5 | |||
3452 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 | binary | |
MD5:29E9C4276704AF9CB64FD10B03ECE8DB | SHA256:4B8E58A55BCB8D4EEA1751B5EE269A810723BE4248330BDB72368CA9AFE8510A | |||
3452 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61 | binary | |
MD5:DEC6BBE308EB44937F77160A25EE32DB | SHA256:68A71DE28F488586C2B169F4652347E0A1FD632D48A6D6725393607BFA18BC7E | |||
3452 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\front.min[1].css | text | |
MD5:AEC05DAB70F39E40E6664BC3CC256CBA | SHA256:BC3FA17B0C4F879F13A223996F66EB9FAD7C84385B2967E3781A3680A6E6A811 | |||
3452 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\snapdownloader-crack[1].htm | html | |
MD5:EE4A6913B959A720DBB285280CC9C55D | SHA256:2277866C1F1F716EB581456794431B4045BEDC8FDB946D8D99B94BD6E00EFB4C |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3452 | iexplore.exe | GET | 200 | 8.241.121.254:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?57908076d027786a | unknown | compressed | 4.66 Kb | — |
3452 | iexplore.exe | GET | 200 | 8.241.121.254:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b525ef6f8ae37373 | unknown | compressed | 4.66 Kb | — |
3452 | iexplore.exe | GET | 200 | 8.241.121.254:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?2870ea6c56951d7c | unknown | compressed | 61.6 Kb | — |
— | — | GET | 200 | 23.212.210.158:80 | http://x1.c.lencr.org/ | unknown | binary | 717 b | — |
— | — | GET | 200 | 23.212.210.158:80 | http://x2.c.lencr.org/ | unknown | binary | 300 b | — |
3452 | iexplore.exe | GET | 200 | 8.241.121.254:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?15d92e7f8a6b8fe1 | unknown | compressed | 61.6 Kb | — |
3452 | iexplore.exe | GET | 200 | 216.58.206.35:80 | http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D | unknown | binary | 1.41 Kb | — |
3452 | iexplore.exe | GET | 200 | 104.18.14.101:80 | http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ%3D | unknown | binary | 1.42 Kb | — |
3452 | iexplore.exe | GET | 200 | 216.58.206.35:80 | http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC%2BlTfrY55xlBDlOr6I73sS | unknown | binary | 472 b | — |
3452 | iexplore.exe | GET | 200 | 104.18.14.101:80 | http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd | unknown | binary | 979 b | — |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3452 | iexplore.exe | 188.114.97.3:443 | — | CLOUDFLARENET | NL | unknown |
3452 | iexplore.exe | 8.241.121.254:80 | ctldl.windowsupdate.com | LEVEL3 | US | unknown |
— | — | 23.212.210.158:80 | x1.c.lencr.org | AKAMAI-AS | AU | unknown |
3452 | iexplore.exe | 192.0.77.37:443 | c0.wp.com | AUTOMATTIC | US | unknown |
3452 | iexplore.exe | 142.250.184.200:443 | www.googletagmanager.com | GOOGLE | US | unknown |
3452 | iexplore.exe | 142.250.185.226:443 | pagead2.googlesyndication.com | GOOGLE | US | unknown |
3452 | iexplore.exe | 192.0.77.2:443 | i0.wp.com | AUTOMATTIC | US | unknown |
3452 | iexplore.exe | 192.0.76.3:443 | stats.wp.com | AUTOMATTIC | US | unknown |
3452 | iexplore.exe | 216.58.206.35:80 | ocsp.pki.goog | GOOGLE | US | unknown |
3452 | iexplore.exe | 104.18.14.101:80 | ocsp.comodoca.com | CLOUDFLARENET | — | unknown |
Domain | IP | Reputation |
---|---|---|
ctldl.windowsupdate.com |
| unknown |
x1.c.lencr.org |
| unknown |
x2.c.lencr.org |
| unknown |
c0.wp.com |
| unknown |
pagead2.googlesyndication.com |
| unknown |
www.googletagmanager.com |
| unknown |
i0.wp.com |
| unknown |
stats.wp.com |
| unknown |
ocsp.pki.goog |
| unknown |
ocsp.comodoca.com |
| unknown |