File name:

All-in-One Checker v4.9.8.3.zip

Full analysis: https://app.any.run/tasks/8d66b0b6-29ba-4d7e-a1c7-88dfe5dcd7f5
Verdict: Malicious activity
Analysis date: March 25, 2020, 15:13:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

48DD6F73FD9791A4648E3F591906FC99

SHA1:

335EDA97F0E8B319C68629741726F4823B9EEACF

SHA256:

F9D5CDBC7855EAFD6D7318E43F0068431B937C2B0B7DEA29F236DEEC5B5210C2

SSDEEP:

49152:2aEPSFk4kevf1JnhbleMWmvvpCMMRICwhMKYbNQYdKCVbu:r5lJeAvh8wh9YbeYUCVbu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • svchost.exe (PID: 3120)
      • explorer.exe (PID: 2836)
      • explorer.exe (PID: 3492)
      • TempSetup.exe (PID: 3164)
      • svchost.exe (PID: 3956)
      • ~All_in_One_Checker_cracked.exe (PID: 2012)

    • Changes the autorun value in the registry

      • svchost.exe (PID: 3120)
      • TempSetup.exe (PID: 3164)
      • explorer.exe (PID: 3492)

    • Changes settings of System certificates

      • ~All_in_One_Checker_cracked.exe (PID: 2012)

  • SUSPICIOUS

    • Creates files in the user directory

      • TempSetup.exe (PID: 3164)
      • explorer.exe (PID: 2836)
      • svchost.exe (PID: 3120)
      • svchost.exe (PID: 3956)

    • Executable content was dropped or overwritten

      • All-in-One Checker_cracked.exe (PID: 3792)
      • TempSetup.exe (PID: 3164)
      • svchost.exe (PID: 3120)
      • explorer.exe (PID: 2836)
      • svchost.exe (PID: 3956)

    • Creates executable files which already exist in Windows

      • svchost.exe (PID: 3120)
      • explorer.exe (PID: 2836)
      • TempSetup.exe (PID: 3164)
      • svchost.exe (PID: 3956)

    • Starts itself from another location

      • explorer.exe (PID: 2836)

    • Reads Environment values

      • ~All_in_One_Checker_cracked.exe (PID: 2012)

    • Uses NETSH.EXE for network configuration

      • explorer.exe (PID: 3492)

    • Connects to unusual port

      • explorer.exe (PID: 3492)

    • Adds / modifies Windows certificates

      • ~All_in_One_Checker_cracked.exe (PID: 2012)

  • INFO

    • Manual execution by user

      • All-in-One Checker_cracked.exe (PID: 3792)
      • NOTEPAD.EXE (PID: 780)

    • Reads settings of System Certificates

      • ~All_in_One_Checker_cracked.exe (PID: 2012)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2019:06:29 15:05:26
ZipCRC: 0xc031e2c7
ZipCompressedSize: 1780000
ZipUncompressedSize: 2998272
ZipFileName: All-in-One Checker v4.9.8.3/All-in-One Checker_cracked.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
10
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe no specs all-in-one checker_cracked.exe tempsetup.exe ~all_in_one_checker_cracked.exe svchost.exe svchost.exe explorer.exe explorer.exe netsh.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
780"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\All-in-One Checker v4.9.8.3\xxx.txtC:\Windows\system32\NOTEPAD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2012"C:\Users\admin\Desktop\All-in-One Checker v4.9.8.3\~All_in_One_Checker_cracked.exe" C:\Users\admin\Desktop\All-in-One Checker v4.9.8.3\~All_in_One_Checker_cracked.exe
All-in-One Checker_cracked.exe
User:
admin
Integrity Level:
MEDIUM
Description:
All-in-One Checker
Exit code:
0
Version:
4.9.8.3
Modules
Images
c:\users\admin\desktop\all-in-one checker v4.9.8.3\~all_in_one_checker_cracked.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2220netsh firewall add allowedprogram "C:\Users\admin\AppData\Roaming\Microsoft\Windows\explorer.exe" "explorer.exe" ENABLEC:\Windows\system32\netsh.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2836"C:\Users\admin\AppData\Roaming\Intel Corporation\Intel(R) Common User Interface\8.1.1.7900\explorer.exe" C:\Users\admin\AppData\Roaming\Intel Corporation\Intel(R) Common User Interface\8.1.1.7900\explorer.exe
svchost.exe
User:
admin
Company:
Intel Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7800.8900
Modules
Images
c:\users\admin\appdata\roaming\intel corporation\intel(r) common user interface\8.1.1.7900\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2952"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\All-in-One Checker v4.9.8.3.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3120"C:\Users\admin\AppData\Roaming\Microsoft\Windows\8.1.7601.17587\svchost.exe" C:\Users\admin\AppData\Roaming\Microsoft\Windows\8.1.7601.17587\svchost.exe
svchost.exe
User:
admin
Company:
Intel Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
0
Version:
8.1.1.7900
Modules
Images
c:\users\admin\appdata\roaming\microsoft\windows\8.1.7601.17587\svchost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3164"C:\Users\admin\AppData\Local\TempSetup.exe" C:\Users\admin\AppData\Local\TempSetup.exe
All-in-One Checker_cracked.exe
User:
admin
Company:
Intel Corporation
Integrity Level:
MEDIUM
Description:
hkcmd Module
Exit code:
0
Version:
8.1.1.7800
Modules
Images
c:\users\admin\appdata\local\tempsetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3492"C:\Users\admin\AppData\Roaming\Microsoft\Windows\explorer.exe" C:\Users\admin\AppData\Roaming\Microsoft\Windows\explorer.exe
explorer.exe
User:
admin
Company:
Intel Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7800.8900
Modules
Images
c:\users\admin\appdata\roaming\microsoft\windows\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3792"C:\Users\admin\Desktop\All-in-One Checker v4.9.8.3\All-in-One Checker_cracked.exe" C:\Users\admin\Desktop\All-in-One Checker v4.9.8.3\All-in-One Checker_cracked.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
All-in-One Checker
Exit code:
0
Version:
4.9.8.3
Modules
Images
c:\users\admin\desktop\all-in-one checker v4.9.8.3\all-in-one checker_cracked.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3956"C:\Users\admin\AppData\Roaming\Intel Corporation\Intel(R) Common User Interface\8.1.1.7800\svchost.exe" C:\Users\admin\AppData\Roaming\Intel Corporation\Intel(R) Common User Interface\8.1.1.7800\svchost.exe
TempSetup.exe
User:
admin
Company:
Intel Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\appdata\roaming\intel corporation\intel(r) common user interface\8.1.1.7800\svchost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
7 125
Read events
3 047
Write events
2 889
Delete events
1 189

Modification events

(PID) Process:(2952) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2952) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2952) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2952) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\All-in-One Checker v4.9.8.3.zip
(PID) Process:(2952) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2952) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2952) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2952) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2952) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(2952) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\AppData\Local\Temp
Executable files
6
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2952WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2952.4098\All-in-One Checker v4.9.8.3\All-in-One Checker_cracked.exe —
MD5:—
SHA256:—
2952WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2952.4098\All-in-One Checker v4.9.8.3\Config\All-in-One Checker.conf —
MD5:—
SHA256:—
2952WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2952.4098\All-in-One Checker v4.9.8.3\Config\Servers.json —
MD5:—
SHA256:—
2952WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2952.4098\All-in-One Checker v4.9.8.3\DefaultServers.json —
MD5:—
SHA256:—
2952WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2952.4098\All-in-One Checker v4.9.8.3\xxx.txt —
MD5:—
SHA256:—
3164TempSetup.exeC:\Users\admin\AppData\Roaming\Intel Corporation\Intel(R) Common User Interface\8.1.1.7800\server.zip —
MD5:—
SHA256:—
3956svchost.exeC:\Users\admin\AppData\Local\Temp\$inst\temp_0.tmp —
MD5:—
SHA256:—
3120svchost.exeC:\Users\admin\AppData\Roaming\Intel Corporation\Intel(R) Common User Interface\8.1.1.7900\explorer.zip —
MD5:—
SHA256:—
3120svchost.exeC:\Users\admin\AppData\Roaming\Intel Corporation\Intel(R) Common User Interface\8.1.1.7900\explorer.exeexecutable
MD5:—
SHA256:—
2836explorer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\explorer.exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
48
DNS requests
5
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3120
svchost.exe
GET
200
108.170.25.58:80
http://capeturk.com/1/explorer.txt
US
text
84 b
whitelisted
3120
svchost.exe
GET
200
163.44.198.42:80
http://sanukconnect.com/resources/views/images/1/explorer.zip
TH
compressed
35.4 Kb
malicious
2012
~All_in_One_Checker_cracked.exe
GET
200
185.53.178.9:80
http://socks24.ru/proxy/httpProxies.txt
DE
html
4.33 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3120
svchost.exe
108.170.25.58:80
capeturk.com
SECURED SERVERS LLC
US
malicious
3120
svchost.exe
163.44.198.42:80
sanukconnect.com
GMO-Z com NetDesign Holdings Co., Ltd.
TH
malicious
3492
explorer.exe
216.176.190.198:8899
blog.capeturk.com
Wowrack.com
US
malicious
2012
~All_in_One_Checker_cracked.exe
151.101.12.193:443
api.imgur.com
Fastly
US
malicious
2012
~All_in_One_Checker_cracked.exe
185.53.178.9:80
socks24.ru
Team Internet AG
DE
malicious

DNS requests

Domain
IP
Reputation
capeturk.com
  • 108.170.25.58
whitelisted
sanukconnect.com
  • 163.44.198.42
malicious
blog.capeturk.com
  • 216.176.190.198
malicious
api.imgur.com
  • 151.101.12.193
shared
socks24.ru
  • 185.53.178.9
malicious

Threats

PID
Process
Class
Message
3120
svchost.exe
A Network Trojan was detected
MALWARE [PTsecurity] Trojan.DownLoader22.55152 (BackDoor.RevetRat)
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
All-in-One Checker v4.9.8.3.zip