File name:

Cyberlink.PowerDVD.Deluxe.v6.0.keymaker.by.CORE.exe

Full analysis: https://app.any.run/tasks/d2911b8c-419f-40e6-935d-49c571b7315a
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Analysis date: December 19, 2024, 03:13:24
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
azorult
fareit
pony
trojan
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 8 sections
MD5:

FECA4098DEFB52B3178D5100D33F4457

SHA1:

3C34C5B36D0984EA0476759CBAEF644EFD96D899

SHA256:

DD187FA74E842487BD819CDA676F2C69837DBFC015B13920CC5B1B991F67262B

SSDEEP:

98304:BPhE87IykSrEceaYDIjOJduw+4l4rAIhJ9NSpppgceYuHBsvS4Ca2HC6n1NAfkEv:nL1elSK+tnY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Pony/Fareit Trojan is detected

      • key.exe (PID: 3420)
    • Connects to the CnC server

      • keygen-step-1.exe (PID: 2212)
      • key.exe (PID: 3420)
      • keygen-step-1.exe (PID: 5872)
      • key.exe (PID: 3052)
      • keygen-step-1.exe (PID: 4020)
    • Actions looks like stealing of personal data

      • key.exe (PID: 3420)
    • Steals credentials from Web Browsers

      • key.exe (PID: 3420)
    • AZORULT has been detected (SURICATA)

      • keygen-step-1.exe (PID: 2212)
      • keygen-step-1.exe (PID: 5872)
      • keygen-step-1.exe (PID: 4020)
    • PONY has been detected (SURICATA)

      • key.exe (PID: 3420)
      • key.exe (PID: 3052)
    • Stealers network behavior

      • keygen-step-1.exe (PID: 4020)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Cyberlink.PowerDVD.Deluxe.v6.0.keymaker.by.CORE.exe (PID: 5964)
      • keygen-pj.exe (PID: 3808)
      • Cyberlink.PowerDVD.Deluxe.v6.0.keymaker.by.CORE.exe (PID: 5752)
      • keygen-pj.exe (PID: 1580)
    • Reads the date of Windows installation

      • Cyberlink.PowerDVD.Deluxe.v6.0.keymaker.by.CORE.exe (PID: 5964)
      • Cyberlink.PowerDVD.Deluxe.v6.0.keymaker.by.CORE.exe (PID: 5752)
    • Reads security settings of Internet Explorer

      • Cyberlink.PowerDVD.Deluxe.v6.0.keymaker.by.CORE.exe (PID: 5964)
      • keygen-step-1.exe (PID: 2212)
      • key.exe (PID: 3420)
      • keygen-pj.exe (PID: 3808)
      • keygen-step-1.exe (PID: 5872)
      • keygen-pj.exe (PID: 1580)
      • Cyberlink.PowerDVD.Deluxe.v6.0.keymaker.by.CORE.exe (PID: 5752)
      • key.exe (PID: 3052)
      • keygen-pj.exe (PID: 4336)
      • keygen-step-1.exe (PID: 4020)
    • The executable file from the user directory is run by the CMD process

      • keygen-pj.exe (PID: 3808)
      • keygen-step-1.exe (PID: 2212)
      • keygen-step-1.exe (PID: 5872)
      • keygen-pj.exe (PID: 1580)
    • Executing commands from a ".bat" file

      • Cyberlink.PowerDVD.Deluxe.v6.0.keymaker.by.CORE.exe (PID: 5964)
      • key.exe (PID: 3420)
      • Cyberlink.PowerDVD.Deluxe.v6.0.keymaker.by.CORE.exe (PID: 5752)
      • key.exe (PID: 3052)
    • Uses RUNDLL32.EXE to load library

      • control.exe (PID: 420)
      • control.exe (PID: 4320)
    • Starts CMD.EXE for commands execution

      • Cyberlink.PowerDVD.Deluxe.v6.0.keymaker.by.CORE.exe (PID: 5964)
      • key.exe (PID: 3420)
      • Cyberlink.PowerDVD.Deluxe.v6.0.keymaker.by.CORE.exe (PID: 5752)
      • key.exe (PID: 3052)
    • Searches for installed software

      • key.exe (PID: 3420)
      • key.exe (PID: 3052)
    • Contacting a server suspected of hosting an CnC

      • keygen-step-1.exe (PID: 2212)
      • key.exe (PID: 3420)
      • keygen-step-1.exe (PID: 5872)
      • key.exe (PID: 3052)
      • keygen-step-1.exe (PID: 4020)
    • Reads Microsoft Outlook installation path

      • keygen-pj.exe (PID: 4336)
    • Reads Internet Explorer settings

      • keygen-pj.exe (PID: 4336)
  • INFO

    • Checks supported languages

      • Cyberlink.PowerDVD.Deluxe.v6.0.keymaker.by.CORE.exe (PID: 5964)
      • keygen-step-1.exe (PID: 2212)
      • keygen-pj.exe (PID: 3808)
      • key.exe (PID: 3420)
      • keygen-pj.exe (PID: 1580)
      • Cyberlink.PowerDVD.Deluxe.v6.0.keymaker.by.CORE.exe (PID: 5752)
      • keygen-step-1.exe (PID: 5872)
      • key.exe (PID: 3052)
      • keygen-pj.exe (PID: 4336)
      • keygen-step-1.exe (PID: 4020)
    • The process uses the downloaded file

      • Cyberlink.PowerDVD.Deluxe.v6.0.keymaker.by.CORE.exe (PID: 5964)
      • control.exe (PID: 420)
      • cmd.exe (PID: 2356)
      • keygen-pj.exe (PID: 3808)
    • Create files in a temporary directory

      • Cyberlink.PowerDVD.Deluxe.v6.0.keymaker.by.CORE.exe (PID: 5964)
      • keygen-pj.exe (PID: 3808)
      • key.exe (PID: 3420)
    • Process checks computer location settings

      • Cyberlink.PowerDVD.Deluxe.v6.0.keymaker.by.CORE.exe (PID: 5964)
      • keygen-pj.exe (PID: 3808)
      • key.exe (PID: 3420)
      • Cyberlink.PowerDVD.Deluxe.v6.0.keymaker.by.CORE.exe (PID: 5752)
      • key.exe (PID: 3052)
      • keygen-pj.exe (PID: 1580)
    • Reads the computer name

      • Cyberlink.PowerDVD.Deluxe.v6.0.keymaker.by.CORE.exe (PID: 5964)
      • keygen-step-1.exe (PID: 2212)
      • key.exe (PID: 3420)
      • keygen-pj.exe (PID: 3808)
      • keygen-step-1.exe (PID: 5872)
      • keygen-pj.exe (PID: 1580)
      • Cyberlink.PowerDVD.Deluxe.v6.0.keymaker.by.CORE.exe (PID: 5752)
      • key.exe (PID: 3052)
      • keygen-pj.exe (PID: 4336)
      • keygen-step-1.exe (PID: 4020)
    • Reads the machine GUID from the registry

      • keygen-step-1.exe (PID: 2212)
      • keygen-step-1.exe (PID: 5872)
      • keygen-step-1.exe (PID: 4020)
    • Checks proxy server information

      • keygen-step-1.exe (PID: 2212)
      • keygen-step-1.exe (PID: 5872)
      • keygen-pj.exe (PID: 4336)
      • keygen-step-1.exe (PID: 4020)
    • Reads security settings of Internet Explorer

      • control.exe (PID: 420)
      • control.exe (PID: 4320)
      • notepad.exe (PID: 2132)
    • Manual execution by a user

      • Cyberlink.PowerDVD.Deluxe.v6.0.keymaker.by.CORE.exe (PID: 5752)
      • WinRAR.exe (PID: 5212)
      • notepad.exe (PID: 2132)
      • cmd.exe (PID: 6004)
      • keygen-pj.exe (PID: 4336)
      • keygen-step-1.exe (PID: 4020)
      • rundll32.exe (PID: 3952)
      • WinRAR.exe (PID: 1076)
    • Sends debugging messages

      • Cyberlink.PowerDVD.Deluxe.v6.0.keymaker.by.CORE.exe (PID: 5752)
      • keygen-step-1.exe (PID: 5872)
      • keygen-pj.exe (PID: 1580)
      • cmd.exe (PID: 5720)
      • key.exe (PID: 3052)
      • cmd.exe (PID: 3984)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5212)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2023:10:03 07:51:22+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.33
CodeSize: 238080
InitializedDataSize: 294400
UninitializedDataSize: -
EntryPoint: 0x27180
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
158
Monitored processes
33
Malicious processes
11
Suspicious processes
1

Behavior graph

Click at the process to see the details
start cyberlink.powerdvd.deluxe.v6.0.keymaker.by.core.exe cmd.exe no specs conhost.exe no specs keygen-pj.exe #AZORULT keygen-step-1.exe control.exe no specs rundll32.exe no specs rundll32.exe no specs #PONY key.exe cmd.exe no specs conhost.exe no specs cyberlink.powerdvd.deluxe.v6.0.keymaker.by.core.exe cmd.exe conhost.exe no specs keygen-pj.exe #AZORULT keygen-step-1.exe control.exe no specs rundll32.exe no specs rundll32.exe no specs #PONY key.exe winrar.exe cmd.exe conhost.exe no specs rundll32.exe no specs notepad.exe no specs cmd.exe conhost.exe no specs keygen-pj.exe #AZORULT keygen-step-1.exe rundll32.exe rundll32.exe no specs winrar.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
236\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
420"C:\WINDOWS\System32\control.exe" "C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-2.cpl", C:\Windows\System32\control.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Control Panel
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\control.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
520C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\1301156.bat" "C:\Users\admin\AppData\Local\Temp\RarSFX1\key.exe" "C:\Windows\SysWOW64\cmd.exekey.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
848"C:\WINDOWS\SysWOW64\rundll32.exe" "C:\WINDOWS\SysWOW64\shell32.dll",#44 "C:\Users\admin\Desktop\rdyhikjldrfjk\keygen-step-2.cpl",C:\Windows\SysWOW64\rundll32.exerundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1076"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\rdyhikjldrfjk\keygen-pj.exe" C:\Users\admin\Desktop\rdyhikjldrfjk\keygen-pj\C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1580keygen-pj.exe -pAevKviq48cC:\Users\admin\AppData\Local\Temp\RarSFX1\keygen-pj.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx1\keygen-pj.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1612"C:\WINDOWS\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\admin\AppData\Local\Temp\RarSFX1\keygen-step-2.cpl",C:\Windows\System32\rundll32.execontrol.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1752\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1888"C:\WINDOWS\SysWOW64\rundll32.exe" "C:\WINDOWS\SysWOW64\shell32.dll",#44 "C:\Users\admin\AppData\Local\Temp\RarSFX1\keygen-step-2.cpl",C:\Windows\SysWOW64\rundll32.exerundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2132"C:\WINDOWS\System32\NOTEPAD.EXE" C:\Users\admin\Desktop\rdyhikjldrfjk\keygen.batC:\Windows\System32\notepad.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
Total events
8 355
Read events
8 326
Write events
27
Delete events
2

Modification events

(PID) Process:(2356) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cpl\OpenWithProgids
Operation:writeName:cplfile
Value:
(PID) Process:(2212) keygen-step-1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2212) keygen-step-1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2212) keygen-step-1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3420) key.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR
Operation:writeName:HWID
Value:
7B44343735413545452D353433422D343842352D384430392D3137343844423342383246467D
(PID) Process:(3420) key.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3420) key.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3420) key.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5872) keygen-step-1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5872) keygen-step-1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
11
Suspicious files
0
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
5964Cyberlink.PowerDVD.Deluxe.v6.0.keymaker.by.CORE.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-pj.exeexecutable
MD5:C0F34F38475AA244C9C8696AEED709A5
SHA256:831C985A5C9CC76C7C3DE456F2EAFEEBA65A8930EF5E2AECC69FC7BD739F1046
5752Cyberlink.PowerDVD.Deluxe.v6.0.keymaker.by.CORE.exeC:\Users\admin\AppData\Local\Temp\RarSFX1\keygen-pj.exeexecutable
MD5:C0F34F38475AA244C9C8696AEED709A5
SHA256:831C985A5C9CC76C7C3DE456F2EAFEEBA65A8930EF5E2AECC69FC7BD739F1046
5964Cyberlink.PowerDVD.Deluxe.v6.0.keymaker.by.CORE.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen.battext
MD5:B7DA5B5251BFD8F57CBAC943155601A9
SHA256:023D11AA3CBC04BC1591C0BB608F35DA7C124F8A30C57ACCAF6BE067B889C2EE
5752Cyberlink.PowerDVD.Deluxe.v6.0.keymaker.by.CORE.exeC:\Users\admin\AppData\Local\Temp\RarSFX1\keygen-step-2.cplexecutable
MD5:F1AB97E270B0830D151649F75E8505ED
SHA256:8B245D39A5564B071673CC60F694A2CAB41F73C4D7DCE0AA33796059692C2D9E
3420key.exeC:\Users\admin\AppData\Local\Temp\1301156.battext
MD5:3880EEB1C736D853EB13B44898B718AB
SHA256:936D9411D5226B7C5A150ECAF422987590A8870C8E095E1CAA072273041A86E7
5964Cyberlink.PowerDVD.Deluxe.v6.0.keymaker.by.CORE.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-2.cplexecutable
MD5:F1AB97E270B0830D151649F75E8505ED
SHA256:8B245D39A5564B071673CC60F694A2CAB41F73C4D7DCE0AA33796059692C2D9E
5964Cyberlink.PowerDVD.Deluxe.v6.0.keymaker.by.CORE.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exeexecutable
MD5:43EB47B71C9F1003ADC2D0F108D2679C
SHA256:913EE402508D3B9E7E55E1051F16A358CE78C19B4E07C6F234F4B73602802FA1
3808keygen-pj.exeC:\Users\admin\AppData\Local\Temp\RarSFX1\key.exeexecutable
MD5:2FBF80A7BA32F036BB97A2D0D909283C
SHA256:AAA583789B2A7D918AB2654F48B2F401588F43F8B835EA176EA4276C59BED4EE
5752Cyberlink.PowerDVD.Deluxe.v6.0.keymaker.by.CORE.exeC:\Users\admin\AppData\Local\Temp\RarSFX1\keygen.battext
MD5:B7DA5B5251BFD8F57CBAC943155601A9
SHA256:023D11AA3CBC04BC1591C0BB608F35DA7C124F8A30C57ACCAF6BE067B889C2EE
1580keygen-pj.exeC:\Users\admin\AppData\Local\Temp\RarSFX2\key.exeexecutable
MD5:2FBF80A7BA32F036BB97A2D0D909283C
SHA256:AAA583789B2A7D918AB2654F48B2F401588F43F8B835EA176EA4276C59BED4EE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
62
DNS requests
19
Threats
53

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3420
key.exe
POST
404
172.67.161.156:80
http://top.regdnl.ru/bussin/gate.php
unknown
malicious
2212
keygen-step-1.exe
POST
404
185.180.231.18:80
http://upqx.ru/1210776429.php
unknown
malicious
3420
key.exe
POST
404
172.67.161.156:80
http://top.regdnl.ru/bussin/gate.php
unknown
malicious
3420
key.exe
POST
404
172.67.161.156:80
http://top.regdnl.ru/bussin/gate.php
unknown
malicious
3420
key.exe
POST
404
172.67.161.156:80
http://top.regdnl.ru/bussin/gate.php
unknown
malicious
3420
key.exe
POST
404
172.67.161.156:80
http://top.regdnl.ru/bussin/gate.php
unknown
malicious
5872
keygen-step-1.exe
POST
404
185.180.231.18:80
http://upqx.ru/1210776429.php
unknown
malicious
3052
key.exe
POST
404
172.67.161.156:80
http://top.regdnl.ru/bussin/gate.php
unknown
malicious
3420
key.exe
POST
404
172.67.161.156:80
http://top.regdnl.ru/bussin/gate.php
unknown
malicious
3052
key.exe
POST
404
172.67.161.156:80
http://top.regdnl.ru/bussin/gate.php
unknown
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
51.104.136.2:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4536
svchost.exe
51.104.136.2:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
whitelisted
3976
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2212
keygen-step-1.exe
185.180.231.18:80
upqx.ru
Network Management Ltd
RU
malicious
4536
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3420
key.exe
172.67.161.156:80
top.regdnl.ru
CLOUDFLARENET
US
malicious
5064
SearchApp.exe
104.126.37.123:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1176
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.46
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
upqx.ru
  • 185.180.231.18
malicious
top.regdnl.ru
  • 172.67.161.156
  • 104.21.49.99
malicious
www.bing.com
  • 104.126.37.123
  • 104.126.37.131
  • 104.126.37.176
  • 104.126.37.130
  • 104.126.37.145
unknown
login.live.com
  • 20.190.159.0
  • 40.126.31.67
  • 20.190.159.73
  • 20.190.159.64
  • 20.190.159.71
  • 40.126.31.69
  • 20.190.159.2
  • 20.190.159.75
whitelisted
go.microsoft.com
  • 23.218.210.69
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
  • 2603:1030:c02:2::284
whitelisted
18.31.95.13.in-addr.arpa
unknown

Threats

PID
Process
Class
Message
2212
keygen-step-1.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/AZORult V3.3 Client Checkin M15
3420
key.exe
Malware Command and Control Activity Detected
ET MALWARE Fareit/Pony Downloader Checkin 2
3420
key.exe
Potentially Bad Traffic
ET MALWARE Generic -POST To gate.php w/Extended ASCII Characters (Likely Zeus Derivative)
3420
key.exe
A Network Trojan was detected
ET MALWARE Trojan Generic - POST To gate.php with no referer
3420
key.exe
Malware Command and Control Activity Detected
ET MALWARE Fareit/Pony Downloader Checkin 2
3420
key.exe
Potentially Bad Traffic
ET MALWARE Generic -POST To gate.php w/Extended ASCII Characters (Likely Zeus Derivative)
3420
key.exe
A Network Trojan was detected
ET MALWARE Trojan Generic - POST To gate.php with no referer
3420
key.exe
Malware Command and Control Activity Detected
ET MALWARE Fareit/Pony Downloader Checkin 2
3420
key.exe
Potentially Bad Traffic
ET MALWARE Generic -POST To gate.php w/Extended ASCII Characters (Likely Zeus Derivative)
3420
key.exe
A Network Trojan was detected
ET MALWARE Trojan Generic - POST To gate.php with no referer
14 ETPRO signatures available at the full report
Process
Message
Cyberlink.PowerDVD.Deluxe.v6.0.keymaker.by.CORE.exe
FTH: (5752): *** Fault tolerant heap shim applied to current process. This is usually due to previous crashes. ***
cmd.exe
FTH: (5720): *** Fault tolerant heap shim applied to current process. This is usually due to previous crashes. ***
keygen-step-1.exe
FTH: (5872): *** Fault tolerant heap shim applied to current process. This is usually due to previous crashes. ***
keygen-pj.exe
FTH: (1580): *** Fault tolerant heap shim applied to current process. This is usually due to previous crashes. ***
key.exe
FTH: (3052): *** Fault tolerant heap shim applied to current process. This is usually due to previous crashes. ***
cmd.exe
FTH: (3984): *** Fault tolerant heap shim applied to current process. This is usually due to previous crashes. ***