Antivirus scan for df59ec3e9a4d9e0574b14b7b4010e597c12e5c677efdcd9dbb3e35c0eca188aa at 2019-01-09 11:34:58 UTC

Антивирусен софтуер	Резултат	Версия на обновление
Acronis		20181227
Ad-Aware		20190109
AegisLab		20190109
AhnLab-V3		20190108
Alibaba		20180921
ALYac		20190109
Antiy-AVL		20190109
Arcabit		20190109
Avast		20190109
Avast-Mobile		20190109
AVG		20190109
Babable		20180918
Baidu		20190109
BitDefender		20190109
Bkav		20190108
CAT-QuickHeal		20190108
ClamAV		20190109
CMC		20190108
Comodo		20190109
CrowdStrike Falcon (ML)		20181022
Cybereason		20190109
Cylance		20190109
Cyren		20190109
DrWeb		20190109
eGambit		20190109
Emsisoft		20190109
Endgame		20181108
ESET-NOD32		20190109
F-Prot		20190109
F-Secure		20190109
Fortinet		20190109
GData		20190109
Ikarus		20190108
Sophos ML		20181128
Jiangmin		20190109
K7AntiVirus		20190109
K7GW		20190109
Kaspersky		20190109
Kingsoft		20190109
Malwarebytes		20190109
MAX		20190109
McAfee		20190109
McAfee-GW-Edition		20190109
Microsoft		20190109
eScan		20190109
NANO-Antivirus		20190109
Palo Alto Networks (Known Signatures)		20190109
Panda		20190108
Qihoo-360		20190109
Rising		20190109
SentinelOne (Static ML)		20181223
Sophos AV		20190109
SUPERAntiSpyware		20190102
Symantec		20190109
TACHYON		20190109
Tencent		20190109
TheHacker		20190106
Trapmine		20190103
TrendMicro		20190109
TrendMicro-HouseCall		20190109
Trustlook		20190109
VBA32		20190108
ViRobot		20190109
Webroot		20190109
Yandex		20181229
Zillya		20190108
ZoneAlarm by Check Point		20190109
Zoner		20190109

The file being studied is a Portable Executable file! More specifically, it is a Win32 EXE file for the Windows GUI subsystem.

Authenticode signature block and FileVersionInfo properties

Product Intel® PROSet/Wireless Software

Original name Setup.exe

Internal name setup

File version 16.5.2

Description Intel® PROSet/Wireless Software

Signature verification Signed file, verified signature

Signing date 1:53 AM 9/7/2013

Signers

[+] Intel Corporation

[+] VeriSign Class 3 Code Signing 2010 CA

[+] VeriSign

Counter signers

[+] Symantec Time Stamping Services Signer - G4

[+] Symantec Time Stamping Services CA - G2

[+] Thawte Timestamping CA

Packers identified

F-PROT CAB, UTF-8, Unicode

PE header basic information

Target machine Intel 386 or later processors and compatible processors

Compilation timestamp 2012-09-03 13:44:40

Entry Point 0x0000474B

Number of sections 6

PE sections

Name Virtual address Virtual size Raw size Entropy MD5

.text 4096 318578 318976 6.60 49f2772ca60f382d717a3fedc5b8ce4d

.data 323584 11900 4096 2.45 d1d9ee3da78001ce411af1feb6823ac2

.wixburn 335872 56 512 0.73 ffc49aebda20eba7726abca90522e5a5

.tls 339968 9 512 0.00 bf619eac0cdf3f68d496ea9344137e8b

.rsrc 344064 201656 201728 5.16 79c3a8aea8210491931c8bf97176273a

.reloc 548864 16684 16896 5.57 b896b969f8b2c073c6a1d6b20d3b8050

Overlays

MD5 9f4cdbe2c2cf26eedd25ff7aea0e11ea

File type data

Offset 543744

Size 1262184

Entropy 8.00

PE imports

GetVolumePathNameW

GetStdHandle

GetConsoleOutputCP

ReleaseMutex

WaitForSingleObject

ProcessIdToSessionId

GetFileAttributesW

GetLocalTime

GetProcessId

DeleteCriticalSection

GetCurrentProcess

GetConsoleMode

GetLocaleInfoA

VerifyVersionInfoW

FreeEnvironmentStringsW

SetStdHandle

GetCPInfo

GetStringTypeA

InterlockedExchange

WriteFile

GetSystemTimeAsFileTime

HeapReAlloc

GetStringTypeW

GetOEMCP

LocalFree

FormatMessageW

ConnectNamedPipe

GetExitCodeProcess

InitializeCriticalSection

FindClose

InterlockedDecrement

GetFullPathNameW

SetLastError

GetSystemTime

CopyFileW

GetUserDefaultLangID

GetModuleFileNameW

IsDebuggerPresent

ExitProcess

GetModuleFileNameA

VerSetConditionMask

HeapSetInformation

UnhandledExceptionFilter

TlsGetValue

MultiByteToWideChar

SystemTimeToTzSpecificLocalTime

SetFilePointerEx

GetModuleHandleA

SetFileAttributesW

CreateThread

MoveFileExW

GetSystemDirectoryW

GetExitCodeThread

SetNamedPipeHandleState

SetUnhandledExceptionFilter

CreateMutexW

TerminateProcess

WriteConsoleA

GlobalAlloc

LocalFileTimeToFileTime

CreateEventW

SetEndOfFile

GetCurrentThreadId

InterlockedIncrement

WriteConsoleW

GetSystemWow64DirectoryW

InitializeCriticalSectionAndSpinCount

HeapFree

EnterCriticalSection

SetHandleCount

LoadLibraryW

GetVersionExW

FreeLibrary

QueryPerformanceCounter

GetTickCount

TlsAlloc

FlushFileBuffers

LoadLibraryA

RtlUnwind

GetStartupInfoA

SystemTimeToFileTime

GetWindowsDirectoryW

LCMapStringW

OpenProcess

GetDateFormatW

GetStartupInfoW

CreateDirectoryW

DeleteFileW

GetProcAddress

GetProcessHeap

GetTempFileNameW

GetComputerNameW

CompareStringW

GetFileSizeEx

RemoveDirectoryW

ExpandEnvironmentStringsW

FindNextFileW

ResetEvent

FindFirstFileW

WaitForMultipleObjects

SetEvent

GetTimeZoneInformation

CreateFileW

GetFileType

TlsSetValue

CreateFileA

HeapAlloc

LeaveCriticalSection

GetLastError

DosDateTimeToFileTime

CreateFileMappingW

HeapCreate

CreateNamedPipeW

lstrlenA

GlobalFree

GetConsoleCP

LCMapStringA

GetThreadLocale

GetEnvironmentStringsW

lstrlenW

CreateProcessW

GetCurrentDirectoryW

GetCurrentProcessId

SetFileTime

GetCommandLineW

WideCharToMultiByte

HeapSize

CopyFileExW

InterlockedCompareExchange

GetSystemDefaultLangID

RaiseException

MapViewOfFile

TlsFree

SetFilePointer

ReadFile

CloseHandle

GetACP

GetModuleHandleW

SetThreadExecutionState

IsValidCodePage

UnmapViewOfFile

GetTempPathW

VirtualFree

Sleep

VirtualAlloc

Number of PE resources by type

RT_ICON 6

RT_MESSAGETABLE 1

RT_MANIFEST 1

RT_BITMAP 1

RT_VERSION 1

RT_GROUP_ICON 1

Number of PE resources by language

ENGLISH US 11

PE resources

25338716ae73cef39e0214d1ccad64c381ce0a072542ccf36daa126674ad6a7d data

46252c1d1b0ea91c86b44338b6324d776237c7dd802a56e9e850d07ec00838a2 data

79e37903d99ebf4bf9579673e60a1db93076efc81ea3a88eae7e31082c84bc42 ASCII text

859871e7bb12f40b4eab68d1afa54b8f168f707ca23f76f05053ba7183b744bf data

be9786868cc159b2102bf81ee851f2f7d57bdb94653ba2ad26b5f42f8ab1b1cb data

d337bf09f12c722ec48b2a39ca7725b5d61692a2eed515371a99963671f4e215 data

d7e13b8a62efb8be2ff96458a227a32c4d30a93ba42e899995979ed46b21d5c5 data

dc3a410ab55e21c6881451a2984e599f240249460e5b26328908aafd9f061bda data

f423f2f3ac103d2f3bcc8015b7b96a6e4bf84d92660807739af0ece338de34ea data

fb68c5c04a03633404d00c1e3e3132dcfb2f53a577649e17c28692deb11125ff data

Debug information

Type Timestamp Offset Size

IMAGE_DEBUG_TYPE_CODEVIEW (2) Mon Sep 3 13:44:40 2012 14360 81 Bytes

ExifTool file metadata

UninitializedDataSize

LinkerVersion

10.0

ImageVersion

0.0

FileSubtype

FileVersionNumber

16.5.2.0

LanguageCode

English (U.S.)

FileFlagsMask

0x003f

FileDescription

Intel PROSet/Wireless Software

ImageFileCharacteristics

Executable, 32-bit, Removable run from swap, Net run from swap

CharacterSet

Windows, Latin1

InitializedDataSize

223744

EntryPoint

0x474b

OriginalFileName

Setup.exe

MIMEType

application/octet-stream

LegalCopyright

FileVersion

16.5.2

TimeStamp

2012:09:03 14:44:40+01:00

FileType

Win32 EXE

PEType

PE32

InternalName

setup

ProductVersion

16.5.2

SubsystemVersion

5.1

OSVersion

5.1

FileOS

Win32

Subsystem

Windows GUI

MachineType

Intel 386 or later, and compatibles

CompanyName

Intel Corporation

CodeSize

318976

ProductName

Intel PROSet/Wireless Software

ProductVersionNumber

16.5.2.0

FileTypeExtension

exe

ObjectFileType

Executable application

File identification

MD5 72698b9cb49ccb4b3204bd9c800469cd

SHA1 41cd5c6ce6d2103a984f44292f8cf54c31fbd247

SHA256 df59ec3e9a4d9e0574b14b7b4010e597c12e5c677efdcd9dbb3e35c0eca188aa

ssdeep

49152:2FmoJsL6pluqrkaWQ3Mps/mQKuGbO1QtBwaaLeNDG3m:poJPvrTW/pKKuRCtBLrNa3m

authentihash f4a7dd91915b670309de5e83c3451c0c2a732f28a1f5c3e264c2b90b38a338db

imphash ad15d5e5fe89d411563fbec9c13a01b8

File size 1.7 MB ( 1805928 bytes )

File type Win32 EXE

Magic literal

PE32 executable for MS Windows (GUI) Intel 80386 32-bit

TrID	Win64 Executable (generic) (72.3%) Win32 Executable (generic) (11.8%) OS/2 Executable (generic) (5.3%) Generic Win/DOS Executable (5.2%) DOS Executable Generic (5.2%)

VirusTotal metadata

First submission 2016-08-10 22:21:11 UTC (преди 2 години, 6 месеци)

Last submission 2019-02-10 02:41:42 UTC (преди 1 седмица, 6 дни)

Имена на файла

FIFA 18 CD Key Generator.exe
Driver Booster 5 Pro Serial Key Generator.exe
FL Studio 20.1.69 Keygen Generator.exe
FL Studio 20.1.69 Keygen Generator.exe
Spyhunter 5.0.30.51 Key Generator.exe
Microsoft Office 2019 Product Key Generator.exe
Setup.exe
Office Mac 2011 Product Key Generator.exe
Office Mac 2016 Product Key Generator.exe
Tally ERP 9 4.93 Serial Key Generator.exe
Spyhunter 4.5.7.3531 Serial Key Generator.exe
Microsoft Office 2016 Product Key Generator.exe
Avast Cleanup 2018 License Key Generator.exe
Reason 10.0.9 Serial Key Generator.exe
QuickBooks Pro Premier 2019 Key Generator.exe
Adobe Photoshop CC 2019 19.0.1 Key Generator.exe
Windows 10 Product Key Generator.exe
Adobe Illustrator Cs6 v16 0 1 Serial Key Generator.exe
Adobe Acrobat Pro DC Serial Key Generator.exe
Sony Vegas Pro 16.0.248 Keygen Generator.exe
Anytrans 7.0.4 Key Code Generator.exe
Cleanmymac 3.8.6 Serial Key Generator.exe
Pinnacle Studio 20.1.0 Ultimate Serial Key Generator.exe
Anytrans 6.3.6 License Key Generator.exe
Cubase Pro 10 Key Generator.exe

Не сте влезли в акаунта си. Само регистрирани потребители могат да коментират. Влезте и оставете своя коментар!

Вход Присъединете се към общността

Condensed report! The following is a condensed report of the behaviour of the file when executed in a controlled environment. The actions and events described were either performed by the file itself or by any other process launched by the executed file or subjected to code injection by the executed file.

Opened files

C:\WINDOWS\Registration\R000000000007.clb (successful)

C:\df59ec3e9a4d9e0574b14b7b4010e597c12e5c677efdcd9dbb3e35c0eca188aa (successful)

C:\WINDOWS\system32\msxml3r.dll (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\ (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\ (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\ (successful)

C:\DOCUME~1\<USER>~1\ (successful)

C:\DOCUME~1\ (successful)

\\.\MountPointManager (successful)

\\.\PIPE\lsarpc (successful)

Read files

C:\WINDOWS\Registration\R000000000007.clb (successful)

C:\df59ec3e9a4d9e0574b14b7b4010e597c12e5c677efdcd9dbb3e35c0eca188aa (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\BootstrapperCore.config (successful)

C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\config\machine.config (successful)

C:\WINDOWS\system32\rsaenh.dll (successful)

c:\autoexec.bat (successful)

C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Config\machine.config (successful)

C:\Documents and Settings\<USER>\Local Settings\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\BootstrapperCore.config (successful)

C:\Documents and Settings\<USER>\Local Settings\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\BundleDefinition.xml (successful)

C:\Documents and Settings\<USER>\Local Settings\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\l10n\MWGBootstrapper_en-us.wxl (successful)

Written files

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\mbahost.dll (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\BootstrapperCore.dll (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\BootstrapperCore.config (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\mbapreq.wxl (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\Microsoft.Deployment.Compression.Cab.dll (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\Microsoft.Deployment.Compression.dll (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\Microsoft.Deployment.Resources.dll (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\Microsoft.Deployment.WindowsInstaller.dll (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\Microsoft.Deployment.WindowsInstaller.Linq.dll (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\Microsoft.Deployment.WindowsInstaller.Package.dll (successful)

Copied files

SRC: C:\Documents and Settings\<USER>\Local Settings\Temp\Intel\xae_PROSet_Wireless_Software_20160810154655.log
DST: C:\Documents and Settings\<USER>\Local Settings\Temp\iProInstLogs\Intel\xae_PROSet_Wireless_Software_20160810154655.log (successful)

Moved files

SRC: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\BootstrapperCore.dll
DST: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\DEL1.tmp (successful)

SRC: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\DEL1.tmp
DST: (null) (successful)

SRC: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\EULA\ar-sa\
DST: (null) (successful)

SRC: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\EULA\cs-cz\
DST: (null) (successful)

SRC: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\EULA\da-dk\
DST: (null) (successful)

SRC: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\EULA\de-de\
DST: (null) (successful)

SRC: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\EULA\el-gr\
DST: (null) (successful)

SRC: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\EULA\en-us\
DST: (null) (successful)

SRC: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\EULA\es-es\
DST: (null) (successful)

SRC: C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\EULA\fi-fi\
DST: (null) (successful)

Deleted files

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\BootstrapperApplicationData.xml (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\BootstrapperCore.config (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\BootstrapperCore.dll (failed)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\BundleDefinition.xml (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\EULA\ar-sa\License.rtf (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\EULA\cs-cz\License.rtf (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\EULA\da-dk\License.rtf (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\EULA\de-de\License.rtf (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\EULA\el-gr\License.rtf (successful)

C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\EULA\en-us\License.rtf (successful)

Created mutexes

RasPbFile (failed)

Opened mutexes

ShimCacheMutex (successful)

Global\CLR_CASOFF_MUTEX (failed)

RasPbFile (successful)

Opened service managers

MACHINE: localhost
DATABASE: SERVICES_ACTIVE_DATABASE (successful)

Opened services

RASMAN (successful)

Runtime DLLs

c:\windows\system32\advapi32.dll (successful)

c:\windows\system32\msi.dll (successful)

clbcatq.dll (successful)

oleaut32.dll (successful)

feclient.dll (successful)

rpcrt4.dll (successful)

c:\docume~1\<USER>~1\locals~1\temp\{b0ed3585-1686-47d9-8ca3-1b755a8a8ce9}\.ba1\mbahost.dll (successful)

c:\windows\system32\mscoree.dll (successful)

advapi32.dll (successful)

shlwapi.dll (successful)

Additional details

The file uses the IsDebuggerPresent Windows API function in order to see whether it is being debugged.

HTTP requests

URL: http://crl.geotrust.com/crls/secureca.crl
TYPE: GET
USER AGENT: Microsoft-CryptoAPI/5.131.2600.5512

URL: http://www.intel.com/repository/CRL/Intel%20External%20Basic%20Policy%20CA.crl
TYPE: GET
USER AGENT: Microsoft-CryptoAPI/5.131.2600.5512

URL: http://www.intel.com/repository/CRL/Intel%20External%20Basic%20Issuing%20CA%203B(1).crl
TYPE: GET
USER AGENT: Microsoft-CryptoAPI/5.131.2600.5512

DNS requests

crl.geotrust.com (23.55.149.163)

www.intel.com (88.221.14.251)

TCP connections

23.55.149.163:80

88.221.14.251:80

UDP communications

<MACHINE_DNS_SERVER>:53

SHA256:	df59ec3e9a4d9e0574b14b7b4010e597c12e5c677efdcd9dbb3e35c0eca188aa
Име на файла:	Windows 10 Product Key Generator.exe
Съотношение на разпознаване:	0 / 68
Дата на анализиране:	2019-01-09 11:34:58 UTC (преди 1 месец, 2 седмици) Преглед на последния

Ciphered bundle

Authenticode signature block and FileVersionInfo properties

Packers identified

PE header basic information

PE sections

Overlays

PE imports

Number of PE resources by type

Number of PE resources by language

PE resources

Debug information

ExifTool file metadata

File identification

VirusTotal metadata

Оставете своя коментар…

Opened files

Read files

Written files

Copied files

Moved files

Deleted files

Created mutexes

Opened mutexes

Opened service managers

Opened services

Runtime DLLs

Additional details

HTTP requests

DNS requests

TCP connections

UDP communications

Възстановяване на парола

Присъединяване към общността на VirusTotal

Вход