File name:

HTTP.Debugger.Pro.8.9.KaranPC.zip

Full analysis: https://app.any.run/tasks/bbaeaa0b-373f-466a-b6cf-26a5610daf78
Verdict: Malicious activity
Analysis date: January 06, 2019, 17:24:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

437CE264355534FE4491E9FF943825CC

SHA1:

6A4F9B667D017603C0AAF8EFBF3B54A90260AE4A

SHA256:

DA99B64BE4E172E66F2CB40BF1404C1C495EB6C919CB691B4E9F326E12ED26EE

SSDEEP:

196608:zQ9Rf/vxVOqNdOr4EKmi92XJuVZ3yYENID6l8yZ1PnVCwvQPzsZfGodQC7Yi:zQ9RpVlNgr4RQJOZ3BEewshzsZBJz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • generic.keygen.exe (PID: 2236)
      • HTTPDebuggerSvc.exe (PID: 3832)
      • HTTPDebuggerUI.exe (PID: 2384)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 4000)
      • HTTPDebuggerUI.exe (PID: 2384)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3088)
      • msiexec.exe (PID: 3280)
      • HTTPDebuggerSvc.exe (PID: 3832)
      • msiexec.exe (PID: 3852)

    • Creates files in the Windows directory

      • HTTPDebuggerSvc.exe (PID: 3832)

    • Creates files in the driver directory

      • HTTPDebuggerSvc.exe (PID: 3832)

    • Creates files in the program directory

      • HTTPDebuggerSvc.exe (PID: 3832)

    • Reads Internet Cache Settings

      • HTTPDebuggerUI.exe (PID: 2384)

    • Creates COM task schedule object

      • MsiExec.exe (PID: 4000)

    • Starts Microsoft Installer

      • WinRAR.exe (PID: 3088)

  • INFO

    • Application launched itself

      • msiexec.exe (PID: 3280)

    • Searches for installed software

      • msiexec.exe (PID: 3280)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 3124)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3280)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 2984)
      • MsiExec.exe (PID: 1516)

    • Creates files in the program directory

      • msiexec.exe (PID: 3280)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2018:11:11 15:58:07
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: HTTP.Debugger.Pro.8.9.KaranPC/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
12
Malicious processes
2
Suspicious processes
3

Behavior graph

Click at the process to see the details
drop and start start winrar.exe notepad.exe no specs generic.keygen.exe no specs msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs drvinst.exe no specs msiexec.exe no specs msiexec.exe no specs httpdebuggersvc.exe httpdebuggerui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1516C:\Windows\system32\MsiExec.exe -Embedding F5CE0F24BA542EDE999F8E368EA113D0C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2236"C:\Users\admin\AppData\Local\Temp\Rar$EXa3088.1287\HTTP.Debugger.Pro.8.9.KaranPC\generic.keygen.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3088.1287\HTTP.Debugger.Pro.8.9.KaranPC\generic.keygen.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3088.1287\http.debugger.pro.8.9.karanpc\generic.keygen.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2384"C:\Program Files\HTTPDebuggerPro\HTTPDebuggerUI.exe" C:\Program Files\HTTPDebuggerPro\HTTPDebuggerUI.exe
MsiExec.exe
User:
admin
Company:
HttpDebugger.com
Integrity Level:
MEDIUM
Description:
HTTP Debugger
Exit code:
0
Version:
8.0.0.9
Modules
Images
c:\program files\httpdebuggerpro\httpdebuggerui.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\program files\httpdebuggerpro\chartdir50.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2872"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\Rar$DIa3088.460\readme.txtC:\Windows\system32\NOTEPAD.EXE—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2984C:\Windows\system32\MsiExec.exe -Embedding 437DB20EF381AD96F4B66E395FA486D2 CC:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3000DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot18" "" "" "6792c44eb" "00000000" "000002D0" "00000574"C:\Windows\system32\DrvInst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
3088"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\HTTP.Debugger.Pro.8.9.KaranPC.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3124C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3280C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3832"C:\Program Files\HTTPDebuggerPro\HTTPDebuggerSvc.exe"C:\Program Files\HTTPDebuggerPro\HTTPDebuggerSvc.exe
services.exe
User:
SYSTEM
Company:
HttpDebugger.com
Integrity Level:
SYSTEM
Description:
HTTP Debugger Windows Service
Exit code:
0
Version:
8.0.0.9
Modules
Images
c:\program files\httpdebuggerpro\httpdebuggersvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\nsi.dll
c:\windows\system32\psapi.dll
c:\windows\system32\user32.dll
Total events
1 405
Read events
998
Write events
395
Delete events
12

Modification events

(PID) Process:(3088) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3088) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3088) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3088) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\HTTP.Debugger.Pro.8.9.KaranPC.zip
(PID) Process:(3088) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3088) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3088) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3088) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3088) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:@C:\Windows\System32\msimsg.dll,-34
Value:
Windows Installer Package
(PID) Process:(2872) NOTEPAD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Notepad
Operation:writeName:iWindowPosX
Value:
110
Executable files
23
Suspicious files
8
Text files
60
Unknown types
3

Dropped files

PID
Process
Filename
Type
3088WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3088.1287\HTTP.Debugger.Pro.8.9.KaranPC\HTTPDebuggerPro.msi —
MD5:—
SHA256:—
3088WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3088.2909\HTTP.Debugger.Pro.8.9.KaranPC\HTTPDebuggerPro.msi —
MD5:—
SHA256:—
3852msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI3411.tmp —
MD5:—
SHA256:—
3852msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI34BE.tmp —
MD5:—
SHA256:—
3852msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI350D.tmp —
MD5:—
SHA256:—
3280msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
3280msiexec.exeC:\Windows\Installer\1a8ef3.msi —
MD5:—
SHA256:—
3280msiexec.exeC:\Users\admin\AppData\Local\Temp\~DFB5D784CAADB15C32.TMP —
MD5:—
SHA256:—
3124vssvc.exeC: —
MD5:—
SHA256:—
3000DrvInst.exeC:\Windows\INF\setupapi.dev.logini
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2384
HTTPDebuggerUI.exe
GET
200
104.31.64.244:80
http://www.httpdebugger.com/tools/checkupdate2.ashx?hash=90059c37132041a4b58d2b75a9850d2f&ver=8.0.0.9&sn=
US
text
15 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2384
HTTPDebuggerUI.exe
104.31.64.244:80
www.httpdebugger.com
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
www.httpdebugger.com
  • 104.31.64.244
  • 104.31.65.244
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HTTP.Debugger.Pro.8.9.KaranPC.zip