URL:

https://keygenninja.com/serial/clip_studio_paint_ex.html

Full analysis: https://app.any.run/tasks/08b45b9c-a0aa-4fcb-8219-93c0800472a6
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Malware Trends Tracker     >>>
Analysis date: November 27, 2021, 07:45:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
trojan
rat
azorult
stealer
miner
raccoon
loader
fareit
pony
redline
Indicators:
MD5:

A0C08C50AE9D7B9F89883536FE9AE25F

SHA1:

56E3B12BB5FF84C968E08FEE50F4DC0577A970E0

SHA256:

D4853C54FA6144485B0C798E3C6B7F1A125AD486E7A52ADC89EA36C384DECACD

SSDEEP:

3:N8FVY3XmGJMQqYMwJ:24nmGC6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Minecraft_Premium_Account_keygen_by_KeyGenBat.exe (PID: 3736)
      • keygen-step-1.exe (PID: 700)
      • keygen-step-6.exe (PID: 2096)
      • keygen-pr.exe (PID: 3180)
      • keygen-step-5.exe (PID: 3664)
      • keygen-step-3.exe (PID: 2528)
      • keygen-step-4.exe (PID: 2620)
      • key.exe (PID: 648)
      • md1_1eaf.exe (PID: 3896)
      • KiffAppE2.exe (PID: 3716)
      • Crack.exe (PID: 3732)
      • key.exe (PID: 876)
      • Crack.exe (PID: 2860)
      • 1D56.tmp.exe (PID: 2476)
      • 17F6.tmp.exe (PID: 2912)
      • PBrowserSetp94213.exe (PID: 2664)
      • 6485583.exe (PID: 4064)
      • WinHoster.exe (PID: 1864)
      • 505498.exe (PID: 1240)
      • 1818664.exe (PID: 1236)
      • 2201543.exe (PID: 2940)
      • 5084066.exe (PID: 1632)
      • pub1.exe (PID: 3492)
      • 260775.exe (PID: 3176)
      • QbCcS2vT3RCF.eXe (PID: 4092)
      • 1339982.exe (PID: 1000)
      • 8691899.exe (PID: 3784)
      • Install.exe (PID: 2832)
      • low.exe (PID: 2532)
      • Install.exe (PID: 3848)

    • Stealing of credential data

      • keygen-step-3.exe (PID: 2528)
      • 17F6.tmp.exe (PID: 2912)
      • 1818664.exe (PID: 1236)
      • 260775.exe (PID: 3176)

    • Drops executable file immediately after starts

      • keygen-step-5.exe (PID: 3664)
      • keygen-pr.exe (PID: 3180)
      • keygen-step-4.exe (PID: 2620)
      • md1_1eaf.exe (PID: 3896)
      • 6485583.exe (PID: 4064)
      • cmd.exe (PID: 636)
      • cmd.exe (PID: 2888)

    • Registers / Runs the DLL via REGSVR32.EXE

      • keygen-step-5.exe (PID: 3664)

    • Runs PING.EXE for delay simulation

      • cmd.exe (PID: 4092)

    • AZORULT was detected

      • keygen-step-1.exe (PID: 700)

    • Connects to CnC server

      • keygen-step-1.exe (PID: 700)
      • keygen-step-3.exe (PID: 2528)
      • 17F6.tmp.exe (PID: 2912)
      • key.exe (PID: 648)
      • md1_1eaf.exe (PID: 3896)
      • 505498.exe (PID: 1240)
      • 2201543.exe (PID: 2940)

    • Runs injected code in another process

      • rundll32.exe (PID: 3572)

    • Application was injected by another process

      • svchost.exe (PID: 924)

    • Loads dropped or rewritten executable

      • rundll32.exe (PID: 3572)
      • 17F6.tmp.exe (PID: 2912)

    • Steals credentials from Web Browsers

      • key.exe (PID: 648)
      • 17F6.tmp.exe (PID: 2912)
      • md1_1eaf.exe (PID: 3896)
      • 1818664.exe (PID: 1236)
      • 505498.exe (PID: 1240)
      • 2201543.exe (PID: 2940)

    • RACCOON was detected

      • 17F6.tmp.exe (PID: 2912)

    • Actions looks like stealing of personal data

      • 17F6.tmp.exe (PID: 2912)
      • key.exe (PID: 648)
      • md1_1eaf.exe (PID: 3896)
      • 1818664.exe (PID: 1236)
      • 260775.exe (PID: 3176)
      • 2201543.exe (PID: 2940)
      • 505498.exe (PID: 1240)

    • Writes to a start menu file

      • 1D56.tmp.exe (PID: 2476)

    • Detected Pony/Fareit Trojan

      • key.exe (PID: 648)

    • PONY was detected

      • key.exe (PID: 648)

    • Changes the autorun value in the registry

      • 6485583.exe (PID: 4064)

    • REDLINE was detected

      • 505498.exe (PID: 1240)
      • 2201543.exe (PID: 2940)

    • Known privilege escalation attack

      • DllHost.exe (PID: 2596)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2708)
      • iexplore.exe (PID: 2500)
      • mshta.exe (PID: 3120)
      • mshta.exe (PID: 3956)
      • mshta.exe (PID: 2588)

    • Checks supported languages

      • WinRAR.exe (PID: 2680)
      • WinRAR.exe (PID: 2472)
      • Minecraft_Premium_Account_keygen_by_KeyGenBat.exe (PID: 3736)
      • cmd.exe (PID: 2252)
      • keygen-step-1.exe (PID: 700)
      • keygen-pr.exe (PID: 3180)
      • keygen-step-6.exe (PID: 2096)
      • keygen-step-5.exe (PID: 3664)
      • keygen-step-4.exe (PID: 2620)
      • keygen-step-3.exe (PID: 2528)
      • key.exe (PID: 648)
      • Crack.exe (PID: 2860)
      • cmd.exe (PID: 4092)
      • key.exe (PID: 876)
      • Crack.exe (PID: 3732)
      • KiffAppE2.exe (PID: 3716)
      • 17F6.tmp.exe (PID: 2912)
      • md1_1eaf.exe (PID: 3896)
      • 1D56.tmp.exe (PID: 2476)
      • cmd.exe (PID: 3164)
      • cmd.exe (PID: 2676)
      • 1818664.exe (PID: 1236)
      • IELowutil.exe (PID: 1244)
      • PBrowserSetp94213.exe (PID: 2664)
      • 6485583.exe (PID: 4064)
      • WinHoster.exe (PID: 1864)
      • 505498.exe (PID: 1240)
      • 2201543.exe (PID: 2940)
      • 260775.exe (PID: 3176)
      • 5084066.exe (PID: 1632)
      • 8691899.exe (PID: 3784)
      • mshta.exe (PID: 3120)
      • pub1.exe (PID: 3492)
      • QbCcS2vT3RCF.eXe (PID: 4092)
      • mshta.exe (PID: 3956)
      • cmd.exe (PID: 636)
      • mshta.exe (PID: 2588)
      • cmd.exe (PID: 1808)
      • cmd.exe (PID: 2888)
      • cmd.exe (PID: 3056)
      • cmd.exe (PID: 976)
      • 1339982.exe (PID: 1000)
      • low.exe (PID: 2532)
      • Install.exe (PID: 2832)
      • cmd.exe (PID: 2164)
      • Install.exe (PID: 3848)

    • Application launched itself

      • WinRAR.exe (PID: 2472)
      • key.exe (PID: 648)
      • Crack.exe (PID: 2860)
      • cmd.exe (PID: 2888)

    • Reads the computer name

      • WinRAR.exe (PID: 2680)
      • WinRAR.exe (PID: 2472)
      • Minecraft_Premium_Account_keygen_by_KeyGenBat.exe (PID: 3736)
      • keygen-pr.exe (PID: 3180)
      • keygen-step-1.exe (PID: 700)
      • keygen-step-6.exe (PID: 2096)
      • keygen-step-5.exe (PID: 3664)
      • keygen-step-3.exe (PID: 2528)
      • keygen-step-4.exe (PID: 2620)
      • Crack.exe (PID: 2860)
      • KiffAppE2.exe (PID: 3716)
      • Crack.exe (PID: 3732)
      • key.exe (PID: 876)
      • md1_1eaf.exe (PID: 3896)
      • key.exe (PID: 648)
      • 17F6.tmp.exe (PID: 2912)
      • IELowutil.exe (PID: 1244)
      • PBrowserSetp94213.exe (PID: 2664)
      • 1818664.exe (PID: 1236)
      • WinHoster.exe (PID: 1864)
      • 6485583.exe (PID: 4064)
      • 505498.exe (PID: 1240)
      • 2201543.exe (PID: 2940)
      • 260775.exe (PID: 3176)
      • 5084066.exe (PID: 1632)
      • mshta.exe (PID: 3120)
      • 8691899.exe (PID: 3784)
      • mshta.exe (PID: 3956)
      • QbCcS2vT3RCF.eXe (PID: 4092)
      • mshta.exe (PID: 2588)
      • 1339982.exe (PID: 1000)
      • low.exe (PID: 2532)
      • Install.exe (PID: 2832)
      • Install.exe (PID: 3848)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 2680)
      • Minecraft_Premium_Account_keygen_by_KeyGenBat.exe (PID: 3736)
      • keygen-step-4.exe (PID: 2620)
      • 17F6.tmp.exe (PID: 2912)
      • 1D56.tmp.exe (PID: 2476)
      • keygen-step-6.exe (PID: 2096)
      • 5084066.exe (PID: 1632)
      • cmd.exe (PID: 636)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2680)
      • Minecraft_Premium_Account_keygen_by_KeyGenBat.exe (PID: 3736)
      • keygen-step-4.exe (PID: 2620)
      • keygen-step-5.exe (PID: 3664)
      • keygen-pr.exe (PID: 3180)
      • Crack.exe (PID: 3732)
      • keygen-step-6.exe (PID: 2096)
      • md1_1eaf.exe (PID: 3896)
      • 17F6.tmp.exe (PID: 2912)
      • 1D56.tmp.exe (PID: 2476)
      • PBrowserSetp94213.exe (PID: 2664)
      • 6485583.exe (PID: 4064)
      • 5084066.exe (PID: 1632)
      • cmd.exe (PID: 636)
      • cmd.exe (PID: 2888)

    • Drops a file with too old compile date

      • Minecraft_Premium_Account_keygen_by_KeyGenBat.exe (PID: 3736)
      • keygen-step-5.exe (PID: 3664)
      • 17F6.tmp.exe (PID: 2912)
      • cmd.exe (PID: 2888)

    • Starts CMD.EXE for commands execution

      • Minecraft_Premium_Account_keygen_by_KeyGenBat.exe (PID: 3736)
      • keygen-step-3.exe (PID: 2528)
      • keygen-step-6.exe (PID: 2096)
      • 17F6.tmp.exe (PID: 2912)
      • mshta.exe (PID: 3956)
      • mshta.exe (PID: 3120)
      • mshta.exe (PID: 2588)
      • cmd.exe (PID: 2888)
      • low.exe (PID: 2532)

    • Drops a file with a compile date too recent

      • Minecraft_Premium_Account_keygen_by_KeyGenBat.exe (PID: 3736)
      • keygen-step-4.exe (PID: 2620)
      • md1_1eaf.exe (PID: 3896)
      • Crack.exe (PID: 3732)
      • keygen-step-6.exe (PID: 2096)
      • 17F6.tmp.exe (PID: 2912)
      • 6485583.exe (PID: 4064)
      • PBrowserSetp94213.exe (PID: 2664)

    • Reads Environment values

      • keygen-step-1.exe (PID: 700)
      • key.exe (PID: 876)
      • KiffAppE2.exe (PID: 3716)
      • 17F6.tmp.exe (PID: 2912)
      • PBrowserSetp94213.exe (PID: 2664)
      • 1818664.exe (PID: 1236)
      • 5084066.exe (PID: 1632)
      • 260775.exe (PID: 3176)
      • 505498.exe (PID: 1240)
      • 2201543.exe (PID: 2940)

    • Reads the cookies of Google Chrome

      • keygen-step-3.exe (PID: 2528)
      • md1_1eaf.exe (PID: 3896)
      • 2201543.exe (PID: 2940)
      • 505498.exe (PID: 1240)

    • Starts CMD.EXE for self-deleting

      • keygen-step-3.exe (PID: 2528)
      • keygen-step-6.exe (PID: 2096)
      • 17F6.tmp.exe (PID: 2912)

    • Creates files in the user directory

      • keygen-step-6.exe (PID: 2096)
      • key.exe (PID: 648)
      • 1D56.tmp.exe (PID: 2476)
      • PBrowserSetp94213.exe (PID: 2664)
      • 6485583.exe (PID: 4064)
      • 5084066.exe (PID: 1632)

    • Reads Windows Product ID

      • key.exe (PID: 876)

    • Reads Windows owner or organization settings

      • key.exe (PID: 876)

    • Reads the Windows organization settings

      • key.exe (PID: 876)

    • Executed via WMI

      • rundll32.exe (PID: 3572)

    • Dropped object may contain URLs of mainers pools

      • keygen-step-6.exe (PID: 2096)

    • Loads DLL from Mozilla Firefox

      • key.exe (PID: 648)

    • Reads the cookies of Mozilla Firefox

      • 17F6.tmp.exe (PID: 2912)
      • md1_1eaf.exe (PID: 3896)
      • 505498.exe (PID: 1240)
      • 2201543.exe (PID: 2940)

    • Searches for installed software

      • 17F6.tmp.exe (PID: 2912)
      • 1818664.exe (PID: 1236)
      • key.exe (PID: 876)
      • 260775.exe (PID: 3176)
      • 505498.exe (PID: 1240)
      • 2201543.exe (PID: 2940)
      • key.exe (PID: 648)

    • Starts itself from another location

      • 6485583.exe (PID: 4064)

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • 8691899.exe (PID: 3784)
      • QbCcS2vT3RCF.eXe (PID: 4092)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 636)
      • cmd.exe (PID: 2164)

    • Executed via COM

      • DllHost.exe (PID: 2596)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 1112)
      • iexplore.exe (PID: 2708)
      • iexplore.exe (PID: 2500)
      • regsvr32.exe (PID: 1596)
      • PING.EXE (PID: 2800)
      • svchost.exe (PID: 924)
      • rundll32.exe (PID: 3572)
      • PING.EXE (PID: 1300)
      • timeout.exe (PID: 1704)
      • taskkill.exe (PID: 2736)
      • odbcconf.exe (PID: 2112)
      • taskkill.exe (PID: 3444)
      • DllHost.exe (PID: 2596)

    • Application launched itself

      • iexplore.exe (PID: 1112)

    • Reads the computer name

      • iexplore.exe (PID: 1112)
      • iexplore.exe (PID: 2708)
      • iexplore.exe (PID: 2500)
      • PING.EXE (PID: 2800)
      • rundll32.exe (PID: 3572)
      • PING.EXE (PID: 1300)
      • taskkill.exe (PID: 2736)
      • taskkill.exe (PID: 3444)
      • DllHost.exe (PID: 2596)

    • Changes internet zones settings

      • iexplore.exe (PID: 1112)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2708)
      • iexplore.exe (PID: 1112)
      • iexplore.exe (PID: 2500)
      • keygen-step-6.exe (PID: 2096)
      • Install.exe (PID: 3848)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2708)
      • iexplore.exe (PID: 1112)
      • iexplore.exe (PID: 2500)
      • keygen-step-6.exe (PID: 2096)
      • Crack.exe (PID: 3732)
      • PBrowserSetp94213.exe (PID: 2664)
      • KiffAppE2.exe (PID: 3716)
      • 1818664.exe (PID: 1236)
      • 5084066.exe (PID: 1632)
      • 260775.exe (PID: 3176)
      • 505498.exe (PID: 1240)
      • Install.exe (PID: 3848)

    • Creates files in the user directory

      • iexplore.exe (PID: 2708)
      • iexplore.exe (PID: 2500)
      • iexplore.exe (PID: 1112)

    • Changes settings of System certificates

      • iexplore.exe (PID: 1112)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2708)
      • iexplore.exe (PID: 2500)
      • mshta.exe (PID: 3120)
      • mshta.exe (PID: 3956)
      • mshta.exe (PID: 2588)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 1112)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 1112)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 1112)

    • Reads Microsoft Office registry keys

      • key.exe (PID: 876)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
121
Monitored processes
59
Malicious processes
25
Suspicious processes
7

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start inject drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe iexplore.exe winrar.exe no specs winrar.exe minecraft_premium_account_keygen_by_keygenbat.exe cmd.exe no specs keygen-pr.exe #AZORULT keygen-step-1.exe keygen-step-5.exe keygen-step-6.exe keygen-step-3.exe keygen-step-4.exe regsvr32.exe no specs #PONY key.exe crack.exe no specs cmd.exe no specs ping.exe no specs key.exe no specs crack.exe kiffappe2.exe md1_1eaf.exe #RACCOON 17f6.tmp.exe rundll32.exe no specs svchost.exe 1d56.tmp.exe cmd.exe no specs ping.exe no specs cmd.exe no specs timeout.exe no specs ielowutil.exe no specs pbrowsersetp94213.exe 1818664.exe 6485583.exe winhoster.exe no specs #REDLINE 505498.exe #REDLINE 2201543.exe 5084066.exe 260775.exe pub1.exe 8691899.exe no specs mshta.exe no specs cmd.exe qbccs2vt3rcf.exe no specs taskkill.exe no specs mshta.exe no specs cmd.exe no specs mshta.exe no specs cmd.exe cmd.exe no specs cmd.exe no specs odbcconf.exe no specs 1339982.exe no specs low.exe cmd.exe no specs install.exe no specs taskkill.exe no specs CMSTPLUA no specs install.exe

Process information

PID
CMD
Path
Indicators
Parent process
636"C:\Windows\System32\cmd.exe" /q /R cOPY /Y "C:\Users\admin\AppData\Roaming\8691899.exe" ..\QbCcS2vT3RCF.eXe &&sTaRT ..\QBCCS2VT3RCF.EXe -PBGCzmo7oGd9HGeZ5 & iF "" =="" for %g IN ("C:\Users\admin\AppData\Roaming\8691899.exe" ) do taskkill -F -IM "%~nXg" C:\Windows\System32\cmd.exe
mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
648"C:\Users\admin\AppData\Local\Temp\RarSFX2\key.exe" C:\Users\admin\AppData\Local\Temp\RarSFX2\key.exe
keygen-pr.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\rarsfx2\key.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
700keygen-step-1.exe C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\users\admin\appdata\local\temp\rarsfx0\keygen-step-1.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
c:\windows\system32\rpcrt4.dll
876C:\Users\admin\AppData\Local\Temp\RarSFX2\key.exe -txt -scanlocal -file:potato.datC:\Users\admin\AppData\Local\Temp\RarSFX2\key.exe—key.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx2\key.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
924C:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
976"C:\Windows\System32\cmd.exe" /q /R cOPY /Y "C:\Users\admin\AppData\Local\Temp\QbCcS2vT3RCF.eXe" ..\QbCcS2vT3RCF.eXe &&sTaRT ..\QBCCS2VT3RCF.EXe -PBGCzmo7oGd9HGeZ5 & iF "-PBGCzmo7oGd9HGeZ5 " =="" for %g IN ("C:\Users\admin\AppData\Local\Temp\QbCcS2vT3RCF.eXe" ) do taskkill -F -IM "%~nXg" C:\Windows\System32\cmd.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1000"C:\Users\admin\AppData\Roaming\1339982.exe" C:\Users\admin\AppData\Roaming\1339982.exe—5084066.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\roaming\1339982.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
1112"C:\Program Files\Internet Explorer\iexplore.exe" "https://keygenninja.com/serial/clip_studio_paint_ex.html"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
1236"C:\Users\admin\AppData\Roaming\1818664.exe" C:\Users\admin\AppData\Roaming\1818664.exe
PBrowserSetp94213.exe
User:
admin
Company:
jsdifaiofdd
Integrity Level:
MEDIUM
Description:
jsdifaiofdd
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\1818664.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1240"C:\Users\admin\AppData\Roaming\505498.exe" C:\Users\admin\AppData\Roaming\505498.exe
PBrowserSetp94213.exe
User:
admin
Company:
CRYPTOCOMPANY OU
Integrity Level:
MEDIUM
Description:
CryptoTab Update Setup
Exit code:
0
Version:
1.3.99.31
Modules
Images
c:\users\admin\appdata\roaming\505498.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
84 711
Read events
83 753
Write events
943
Delete events
15

Modification events

(PID) Process:(1112) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(1112) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(1112) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30925666
(PID) Process:(1112) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(1112) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30925666
(PID) Process:(1112) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1112) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1112) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1112) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1112) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
96
Suspicious files
46
Text files
102
Unknown types
65

Dropped files

PID
Process
Filename
Type
2708iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:—
SHA256:—
2708iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:—
SHA256:—
2708iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAder
MD5:—
SHA256:—
2708iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\clip_studio_paint_ex[1].htmhtml
MD5:—
SHA256:—
2708iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\19FB0810D6D811525C3D80FC1099D26Bder
MD5:—
SHA256:—
2708iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\19FB0810D6D811525C3D80FC1099D26Bbinary
MD5:—
SHA256:—
2708iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAder
MD5:—
SHA256:—
2708iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:—
SHA256:—
2708iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:—
SHA256:—
2708iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\js[1].jstext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
45
TCP/UDP connections
105
DNS requests
53
Threats
88

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2708
iexplore.exe
GET
200
142.250.185.99:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBgKnak5G4mPCgAAAAEZUYA%3D
US
der
471 b
whitelisted
2708
iexplore.exe
GET
200
142.250.185.99:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDWzDW6BBNoBwoAAAABGVi%2B
US
der
472 b
whitelisted
2708
iexplore.exe
GET
200
142.250.185.99:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
2708
iexplore.exe
GET
200
84.53.161.98:80
http://subca.ocsp-certum.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBR5iK7tYk9tqQEoeQhZNkKcAol9bgQUjEPEy22YwaechGnr30oNYJY6w%2FsCEQCTkoVAAWVxX5R%2FKI%2FvyZso
unknown
der
1.50 Kb
whitelisted
2708
iexplore.exe
GET
200
5.45.205.242:80
http://yandex.ocsp-responder.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBStniMGfahyWUWDEeSLUFbNR9JLAgQUN1zjGeCyjqGoTtLPq9Dc4wtcNU0CECosiqdXosrVzE6LrmbYt3c%3D
RU
der
1.48 Kb
whitelisted
2708
iexplore.exe
GET
200
142.250.185.99:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
1112
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2708
iexplore.exe
GET
200
84.53.161.98:80
http://subca.ocsp-certum.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTYOkzrrCGQj08njZXbUQQpkoUmuQQUCHbNywf%2FJPbFze27kLzihDdGdfcCEQDkBUeDDgxkUpdvejVJwN1I
unknown
der
1.54 Kb
whitelisted
1112
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
2708
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2708
iexplore.exe
37.1.219.39:443
keygenninja.com
Leaseweb Deutschland GmbH
DE
suspicious
2708
iexplore.exe
95.100.146.41:80
r3.o.lencr.org
Akamai Technologies, Inc.
—
suspicious
2708
iexplore.exe
142.250.184.200:443
www.googletagmanager.com
Google Inc.
US
suspicious
2708
iexplore.exe
142.250.185.99:80
ocsp.pki.goog
Google Inc.
US
whitelisted
2708
iexplore.exe
142.250.185.78:443
www.google-analytics.com
Google Inc.
US
whitelisted
1112
iexplore.exe
37.1.219.39:443
keygenninja.com
Leaseweb Deutschland GmbH
DE
suspicious
2708
iexplore.exe
142.251.5.155:443
stats.g.doubleclick.net
Google Inc.
US
unknown
2708
iexplore.exe
142.250.185.163:443
www.google.fr
Google Inc.
US
whitelisted
2708
iexplore.exe
142.250.185.228:443
www.google.com
Google Inc.
US
whitelisted
2708
iexplore.exe
172.67.136.55:443
keygenbat.com
—
US
suspicious

DNS requests

Domain
IP
Reputation
keygenninja.com
  • 37.1.219.39
whitelisted
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
x1.c.lencr.org
  • 104.96.143.115
whitelisted
r3.o.lencr.org
  • 95.100.146.41
  • 95.100.146.66
shared
www.googletagmanager.com
  • 142.250.184.200
whitelisted
ocsp.pki.goog
  • 142.250.185.99
whitelisted
www.google-analytics.com
  • 142.250.185.78
whitelisted
stats.g.doubleclick.net
  • 142.251.5.155
  • 142.251.5.156
  • 142.251.5.157
  • 142.251.5.154
whitelisted
www.google.com
  • 142.250.185.228
malicious
www.google.fr
  • 142.250.185.163
whitelisted

Threats

PID
Process
Class
Message
2500
iexplore.exe
Potentially Bad Traffic
ET INFO Observed Let's Encrypt Certificate for Suspicious TLD (.xyz)
2500
iexplore.exe
Potentially Bad Traffic
ET INFO Observed Let's Encrypt Certificate for Suspicious TLD (.xyz)
700
keygen-step-1.exe
A Network Trojan was detected
ET TROJAN Win32/AZORult V3.3 Client Checkin M2
700
keygen-step-1.exe
A Network Trojan was detected
AV TROJAN Azorult CnC Beacon
3716
KiffAppE2.exe
Potentially Bad Traffic
ET INFO Observed Let's Encrypt Certificate for Suspicious TLD (.xyz)
2912
17F6.tmp.exe
A Network Trojan was detected
ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download)
2912
17F6.tmp.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2912
17F6.tmp.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2912
17F6.tmp.exe
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
2912
17F6.tmp.exe
A Network Trojan was detected
ET TROJAN Win32.Raccoon Stealer CnC Activity (dependency download)
56 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://keygenninja.com/serial/clip_studio_paint_ex.html