URL:

https://ijicrack.com/soundpad-crack-license-key-download/

Full analysis: https://app.any.run/tasks/d5f35a1c-7244-430a-8873-db8bab1174d4
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: July 25, 2021, 21:00:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
trojan
stealer
vidar
loader
rat
redline
phishing
raccoon
Indicators:
MD5:

2B02C1E7DBC22A19C49DABE96A0EAAEB

SHA1:

A90E63446F94A790B5B0E19B9CCB752B5633436A

SHA256:

0747F6215A2AF14F2A1B7ECB430C34035606263E1CD97CB860074C5CDC967073

SSDEEP:

3:N8tbyTYe/G6Lazkn:2d2p/G6La4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • x86_x64_setup.exe (PID: 3908)
      • x86_x64_setup.exe (PID: 2584)
      • setup_installer.exe (PID: 2844)
      • sahiba_1.exe (PID: 3584)
      • sahiba_1.exe (PID: 1312)
      • sahiba_5.exe (PID: 2276)
      • sahiba_4.exe (PID: 3864)
      • sahiba_2.exe (PID: 404)
      • sahiba_3.exe (PID: 1448)
      • sahiba_6.exe (PID: 2800)
      • setup_install.exe (PID: 2968)
      • sahiba_7.exe (PID: 1064)
      • 2416004.exe (PID: 4072)
      • WinHoster.exe (PID: 1436)
      • 8130469.exe (PID: 188)
      • 6377007.exe (PID: 2380)
      • 8243832.exe (PID: 2680)
      • _sNwWDJR9sS9_pX8VHztgvt6.exe (PID: 2100)
      • SnIpBO8HBGFNxjQhKW8pV4MG.exe (PID: 2484)
      • SnIpBO8HBGFNxjQhKW8pV4MG.exe (PID: 336)
      • WxTB3fv25NdlgnLk5gVHsR8y.exe (PID: 2324)
      • WxTB3fv25NdlgnLk5gVHsR8y.exe (PID: 2508)
      • LzmwAqmV.exe (PID: 3216)
      • _sNwWDJR9sS9_pX8VHztgvt6.exe (PID: 3636)
      • FN8FMEspSmoY2d4lklDeZv5n.exe (PID: 3640)
      • M2_wZY8WkpsSMB0Bg1eA_jQW.exe (PID: 3084)
      • M2_wZY8WkpsSMB0Bg1eA_jQW.exe (PID: 3960)
      • GmaLoPpQEd9dkNrcPZWJ5AxG.exe (PID: 1508)
      • 3002.exe (PID: 3912)
      • 3002.exe (PID: 2480)
      • BearVpn 1.exe (PID: 1300)
      • askinstall54.exe (PID: 3468)
      • hUL7c7x6L5YFH_L5TX5qGIvx.exe (PID: 3292)
      • Hfm8BG7hEWPEVElvpE51qvs3.exe (PID: 3788)
      • mQApjZxL8pXUWyKYJj3pPhb8.exe (PID: 908)
      • VKTmZxOOGPlYhFLnoRyw9GBS.exe (PID: 3416)
      • G18_0B9N84pcw438IFPF1E8a.exe (PID: 2848)
      • 0s61FfRN3S_z1DUPFATSXV1b.exe (PID: 768)

    • Drops executable file immediately after starts

      • x86_x64_setup.exe (PID: 2584)
      • setup_installer.exe (PID: 2844)
      • setup_install.exe (PID: 2968)
      • 8130469.exe (PID: 188)
      • LzmwAqmV.exe (PID: 3216)

    • Changes settings of System certificates

      • sahiba_6.exe (PID: 2800)
      • sahiba_3.exe (PID: 1448)

    • Runs PING.EXE for delay simulation

      • cmd.exe (PID: 3920)

    • Runs app for hidden code execution

      • cmd.exe (PID: 4008)

    • Loads dropped or rewritten executable

      • setup_install.exe (PID: 2968)
      • chrome.exe (PID: 2184)
      • sahiba_1.exe (PID: 1312)
      • cmd.exe (PID: 2468)
      • DllHost.exe (PID: 412)
      • cmd.exe (PID: 2044)
      • chrome.exe (PID: 748)
      • chrome.exe (PID: 2660)
      • chrome.exe (PID: 1408)
      • sahiba_4.exe (PID: 3864)
      • DllHost.exe (PID: 2240)
      • DllHost.exe (PID: 3724)
      • chrome.exe (PID: 568)
      • chrome.exe (PID: 3600)
      • chrome.exe (PID: 2548)
      • chrome.exe (PID: 188)
      • cmd.exe (PID: 3576)
      • svchost.exe (PID: 2072)
      • WinRAR.exe (PID: 2300)
      • sahiba_1.exe (PID: 3584)
      • chrome.exe (PID: 3980)
      • conhost.exe (PID: 3340)
      • cmd.exe (PID: 2372)
      • x86_x64_setup.exe (PID: 3908)
      • DllHost.exe (PID: 3972)
      • iexplore.exe (PID: 2768)
      • sahiba_7.exe (PID: 1064)
      • chrome.exe (PID: 3024)
      • cmd.exe (PID: 1284)
      • DllHost.exe (PID: 2864)
      • chrome.exe (PID: 4028)
      • chrome.exe (PID: 3288)
      • NOTEPAD.EXE (PID: 2924)
      • DllHost.exe (PID: 3060)
      • x86_x64_setup.exe (PID: 2584)
      • conhost.exe (PID: 3960)
      • chrome.exe (PID: 3776)
      • chrome.exe (PID: 4008)
      • DllHost.exe (PID: 3308)
      • chrome.exe (PID: 2308)
      • sahiba_2.exe (PID: 404)
      • chrome.exe (PID: 748)
      • chrome.exe (PID: 3852)
      • conhost.exe (PID: 1372)
      • chrome.exe (PID: 724)
      • chrome.exe (PID: 3544)
      • cmd.exe (PID: 3920)
      • Triste.exe.com (PID: 2480)
      • sahiba_6.exe (PID: 2800)
      • chrome.exe (PID: 3828)
      • Triste.exe.com (PID: 3684)
      • chrome.exe (PID: 3560)
      • chrome.exe (PID: 2852)
      • cmd.exe (PID: 4008)
      • chrome.exe (PID: 2376)
      • chrome.exe (PID: 3784)
      • findstr.exe (PID: 1708)
      • chrome.exe (PID: 2152)
      • cmd.exe (PID: 2324)
      • wmiprvse.exe (PID: 3500)
      • PING.EXE (PID: 3320)
      • setup_installer.exe (PID: 2844)
      • sahiba_3.exe (PID: 1448)
      • chrome.exe (PID: 3936)
      • WinRAR.exe (PID: 3776)
      • chrome.exe (PID: 4016)
      • consent.exe (PID: 668)
      • chrome.exe (PID: 3472)
      • chrome.exe (PID: 1580)
      • iexplore.exe (PID: 4056)
      • sahiba_5.exe (PID: 2276)
      • 2416004.exe (PID: 4072)
      • 8130469.exe (PID: 188)
      • svchost.exe (PID: 2384)
      • WerFault.exe (PID: 3316)
      • conhost.exe (PID: 668)
      • WinHoster.exe (PID: 1436)
      • DllHost.exe (PID: 2660)
      • 8243832.exe (PID: 2680)
      • chrome.exe (PID: 2636)
      • cmd.exe (PID: 952)
      • chrome.exe (PID: 128)
      • chrome.exe (PID: 1616)
      • 6377007.exe (PID: 2380)
      • svchost.exe (PID: 3520)
      • LzmwAqmV.exe (PID: 3216)
      • conhost.exe (PID: 3960)
      • 3002.exe (PID: 3912)
      • askinstall54.exe (PID: 3468)
      • BearVpn 1.exe (PID: 1300)
      • WerFault.exe (PID: 3644)
      • conhost.exe (PID: 788)
      • 3002.exe (PID: 2480)
      • WerFault.exe (PID: 3888)
      • cmd.exe (PID: 3416)
      • _sNwWDJR9sS9_pX8VHztgvt6.exe (PID: 2100)
      • WerFault.exe (PID: 2392)
      • SnIpBO8HBGFNxjQhKW8pV4MG.exe (PID: 2484)
      • conhost.exe (PID: 3864)
      • WxTB3fv25NdlgnLk5gVHsR8y.exe (PID: 2508)
      • conhost.exe (PID: 3348)
      • M2_wZY8WkpsSMB0Bg1eA_jQW.exe (PID: 3084)
      • conhost.exe (PID: 3152)
      • conhost.exe (PID: 3260)
      • M2_wZY8WkpsSMB0Bg1eA_jQW.exe (PID: 3960)
      • _sNwWDJR9sS9_pX8VHztgvt6.exe (PID: 3636)
      • GmaLoPpQEd9dkNrcPZWJ5AxG.exe (PID: 1508)
      • rundll32.exe (PID: 2148)
      • SnIpBO8HBGFNxjQhKW8pV4MG.exe (PID: 336)
      • WxTB3fv25NdlgnLk5gVHsR8y.exe (PID: 2324)
      • rundll32.exe (PID: 2212)
      • FN8FMEspSmoY2d4lklDeZv5n.exe (PID: 3640)
      • DllHost.exe (PID: 3844)
      • chrome.exe (PID: 968)
      • cmd.exe (PID: 2756)
      • conhost.exe (PID: 2652)
      • WerFault.exe (PID: 3360)
      • taskkill.exe (PID: 3148)
      • timeout.exe (PID: 2584)
      • 0s61FfRN3S_z1DUPFATSXV1b.exe (PID: 768)
      • rundll32.exe (PID: 908)
      • md8_8eus.exe (PID: 1524)
      • jfiag3g_gg.exe (PID: 2100)
      • DllHost.exe (PID: 316)
      • WerFault.exe (PID: 3856)
      • conhost.exe (PID: 2396)
      • hUL7c7x6L5YFH_L5TX5qGIvx.exe (PID: 3292)
      • jooyu.exe (PID: 1348)
      • Hfm8BG7hEWPEVElvpE51qvs3.exe (PID: 3788)
      • conhost.exe (PID: 968)
      • mQApjZxL8pXUWyKYJj3pPhb8.exe (PID: 908)
      • conhost.exe (PID: 668)
      • G18_0B9N84pcw438IFPF1E8a.exe (PID: 2848)
      • VKTmZxOOGPlYhFLnoRyw9GBS.exe (PID: 3416)

    • Connects to CnC server

      • setup_install.exe (PID: 2968)
      • 6377007.exe (PID: 2380)

    • Changes the autorun value in the registry

      • 8130469.exe (PID: 188)

    • Steals credentials from Web Browsers

      • 2416004.exe (PID: 4072)
      • sahiba_3.exe (PID: 1448)
      • GmaLoPpQEd9dkNrcPZWJ5AxG.exe (PID: 1508)
      • svchost.exe (PID: 3520)
      • 6377007.exe (PID: 2380)

    • Stealing of credential data

      • 2416004.exe (PID: 4072)
      • sahiba_3.exe (PID: 1448)
      • 8243832.exe (PID: 2680)
      • 6377007.exe (PID: 2380)
      • GmaLoPpQEd9dkNrcPZWJ5AxG.exe (PID: 1508)
      • svchost.exe (PID: 3520)
      • WxTB3fv25NdlgnLk5gVHsR8y.exe (PID: 2324)
      • SnIpBO8HBGFNxjQhKW8pV4MG.exe (PID: 336)

    • Actions looks like stealing of personal data

      • 2416004.exe (PID: 4072)
      • sahiba_3.exe (PID: 1448)
      • 8243832.exe (PID: 2680)
      • 6377007.exe (PID: 2380)
      • GmaLoPpQEd9dkNrcPZWJ5AxG.exe (PID: 1508)
      • svchost.exe (PID: 3520)

    • Disables Windows Defender

      • sahiba_6.exe (PID: 2800)

    • Runs injected code in another process

      • rundll32.exe (PID: 2148)
      • rundll32.exe (PID: 2212)
      • rundll32.exe (PID: 908)

    • Application was injected by another process

      • svchost.exe (PID: 896)

    • VIDAR was detected

      • sahiba_3.exe (PID: 1448)
      • GmaLoPpQEd9dkNrcPZWJ5AxG.exe (PID: 1508)

    • REDLINE was detected

      • 8243832.exe (PID: 2680)
      • SnIpBO8HBGFNxjQhKW8pV4MG.exe (PID: 336)
      • WxTB3fv25NdlgnLk5gVHsR8y.exe (PID: 2324)
      • mQApjZxL8pXUWyKYJj3pPhb8.exe (PID: 908)
      • hUL7c7x6L5YFH_L5TX5qGIvx.exe (PID: 3292)
      • Hfm8BG7hEWPEVElvpE51qvs3.exe (PID: 3788)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2768)

    • Reads the computer name

      • wmiprvse.exe (PID: 3500)
      • WinRAR.exe (PID: 2300)
      • WinRAR.exe (PID: 3776)
      • x86_x64_setup.exe (PID: 2584)
      • setup_installer.exe (PID: 2844)
      • setup_install.exe (PID: 2968)
      • sahiba_1.exe (PID: 3584)
      • sahiba_6.exe (PID: 2800)
      • sahiba_1.exe (PID: 1312)
      • sahiba_7.exe (PID: 1064)
      • sahiba_5.exe (PID: 2276)
      • sahiba_4.exe (PID: 3864)
      • Triste.exe.com (PID: 3684)
      • 2416004.exe (PID: 4072)
      • 8130469.exe (PID: 188)
      • WinHoster.exe (PID: 1436)
      • sahiba_3.exe (PID: 1448)
      • 8243832.exe (PID: 2680)
      • 6377007.exe (PID: 2380)
      • LzmwAqmV.exe (PID: 3216)
      • BearVpn 1.exe (PID: 1300)
      • askinstall54.exe (PID: 3468)
      • 3002.exe (PID: 3912)
      • 3002.exe (PID: 2480)
      • SnIpBO8HBGFNxjQhKW8pV4MG.exe (PID: 2484)
      • WxTB3fv25NdlgnLk5gVHsR8y.exe (PID: 2508)
      • M2_wZY8WkpsSMB0Bg1eA_jQW.exe (PID: 3084)
      • M2_wZY8WkpsSMB0Bg1eA_jQW.exe (PID: 3960)
      • SnIpBO8HBGFNxjQhKW8pV4MG.exe (PID: 336)
      • WxTB3fv25NdlgnLk5gVHsR8y.exe (PID: 2324)
      • FN8FMEspSmoY2d4lklDeZv5n.exe (PID: 3640)
      • GmaLoPpQEd9dkNrcPZWJ5AxG.exe (PID: 1508)
      • 0s61FfRN3S_z1DUPFATSXV1b.exe (PID: 768)
      • jfiag3g_gg.exe (PID: 2100)
      • jooyu.exe (PID: 1348)
      • hUL7c7x6L5YFH_L5TX5qGIvx.exe (PID: 3292)
      • G18_0B9N84pcw438IFPF1E8a.exe (PID: 2848)
      • mQApjZxL8pXUWyKYJj3pPhb8.exe (PID: 908)
      • Hfm8BG7hEWPEVElvpE51qvs3.exe (PID: 3788)
      • VKTmZxOOGPlYhFLnoRyw9GBS.exe (PID: 3416)

    • Reads Windows owner or organization settings

      • wmiprvse.exe (PID: 3500)

    • Checks supported languages

      • wmiprvse.exe (PID: 3500)
      • WinRAR.exe (PID: 2300)
      • WinRAR.exe (PID: 3776)
      • setup_installer.exe (PID: 2844)
      • x86_x64_setup.exe (PID: 2584)
      • setup_install.exe (PID: 2968)
      • cmd.exe (PID: 952)
      • cmd.exe (PID: 2468)
      • sahiba_1.exe (PID: 3584)
      • conhost.exe (PID: 1372)
      • cmd.exe (PID: 2324)
      • sahiba_2.exe (PID: 404)
      • cmd.exe (PID: 3416)
      • sahiba_5.exe (PID: 2276)
      • cmd.exe (PID: 1284)
      • cmd.exe (PID: 3576)
      • cmd.exe (PID: 2372)
      • sahiba_6.exe (PID: 2800)
      • sahiba_1.exe (PID: 1312)
      • sahiba_7.exe (PID: 1064)
      • conhost.exe (PID: 3960)
      • sahiba_3.exe (PID: 1448)
      • sahiba_4.exe (PID: 3864)
      • conhost.exe (PID: 3340)
      • cmd.exe (PID: 3920)
      • cmd.exe (PID: 4008)
      • Triste.exe.com (PID: 2480)
      • Triste.exe.com (PID: 3684)
      • 2416004.exe (PID: 4072)
      • cmd.exe (PID: 2044)
      • 8130469.exe (PID: 188)
      • WinHoster.exe (PID: 1436)
      • conhost.exe (PID: 668)
      • 8243832.exe (PID: 2680)
      • 6377007.exe (PID: 2380)
      • LzmwAqmV.exe (PID: 3216)
      • conhost.exe (PID: 3960)
      • 3002.exe (PID: 3912)
      • askinstall54.exe (PID: 3468)
      • BearVpn 1.exe (PID: 1300)
      • conhost.exe (PID: 788)
      • svchost.exe (PID: 896)
      • 3002.exe (PID: 2480)
      • _sNwWDJR9sS9_pX8VHztgvt6.exe (PID: 2100)
      • conhost.exe (PID: 3864)
      • SnIpBO8HBGFNxjQhKW8pV4MG.exe (PID: 2484)
      • conhost.exe (PID: 3348)
      • WxTB3fv25NdlgnLk5gVHsR8y.exe (PID: 2508)
      • conhost.exe (PID: 3152)
      • M2_wZY8WkpsSMB0Bg1eA_jQW.exe (PID: 3084)
      • conhost.exe (PID: 3260)
      • M2_wZY8WkpsSMB0Bg1eA_jQW.exe (PID: 3960)
      • _sNwWDJR9sS9_pX8VHztgvt6.exe (PID: 3636)
      • GmaLoPpQEd9dkNrcPZWJ5AxG.exe (PID: 1508)
      • SnIpBO8HBGFNxjQhKW8pV4MG.exe (PID: 336)
      • WxTB3fv25NdlgnLk5gVHsR8y.exe (PID: 2324)
      • FN8FMEspSmoY2d4lklDeZv5n.exe (PID: 3640)
      • conhost.exe (PID: 2652)
      • cmd.exe (PID: 2756)
      • 0s61FfRN3S_z1DUPFATSXV1b.exe (PID: 768)
      • md8_8eus.exe (PID: 1524)
      • jfiag3g_gg.exe (PID: 2100)
      • hUL7c7x6L5YFH_L5TX5qGIvx.exe (PID: 3292)
      • conhost.exe (PID: 2396)
      • jooyu.exe (PID: 1348)
      • conhost.exe (PID: 968)
      • Hfm8BG7hEWPEVElvpE51qvs3.exe (PID: 3788)
      • conhost.exe (PID: 668)
      • mQApjZxL8pXUWyKYJj3pPhb8.exe (PID: 908)
      • VKTmZxOOGPlYhFLnoRyw9GBS.exe (PID: 3416)
      • G18_0B9N84pcw438IFPF1E8a.exe (PID: 2848)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 3828)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3776)
      • setup_installer.exe (PID: 2844)
      • x86_x64_setup.exe (PID: 2584)
      • sahiba_2.exe (PID: 404)
      • sahiba_5.exe (PID: 2276)
      • setup_install.exe (PID: 2968)
      • 8130469.exe (PID: 188)
      • sahiba_1.exe (PID: 1312)
      • sahiba_4.exe (PID: 3864)
      • sahiba_3.exe (PID: 1448)
      • LzmwAqmV.exe (PID: 3216)
      • 6377007.exe (PID: 2380)
      • sahiba_6.exe (PID: 2800)
      • Triste.exe.com (PID: 3684)

    • Drops a file with a compile date too recent

      • setup_installer.exe (PID: 2844)
      • setup_install.exe (PID: 2968)
      • 8130469.exe (PID: 188)
      • sahiba_5.exe (PID: 2276)
      • sahiba_1.exe (PID: 1312)
      • sahiba_4.exe (PID: 3864)
      • LzmwAqmV.exe (PID: 3216)
      • sahiba_6.exe (PID: 2800)

    • Drops a file with too old compile date

      • setup_installer.exe (PID: 2844)
      • LzmwAqmV.exe (PID: 3216)
      • sahiba_6.exe (PID: 2800)

    • Drops a file that was compiled in debug mode

      • setup_install.exe (PID: 2968)
      • setup_installer.exe (PID: 2844)
      • sahiba_2.exe (PID: 404)
      • sahiba_3.exe (PID: 1448)
      • LzmwAqmV.exe (PID: 3216)
      • sahiba_6.exe (PID: 2800)
      • 6377007.exe (PID: 2380)
      • Triste.exe.com (PID: 3684)

    • Starts CMD.EXE for commands execution

      • setup_install.exe (PID: 2968)
      • sahiba_7.exe (PID: 1064)
      • cmd.exe (PID: 4008)
      • sahiba_3.exe (PID: 1448)

    • Application launched itself

      • sahiba_1.exe (PID: 3584)
      • cmd.exe (PID: 4008)
      • Triste.exe.com (PID: 2480)
      • 3002.exe (PID: 3912)
      • WxTB3fv25NdlgnLk5gVHsR8y.exe (PID: 2508)
      • M2_wZY8WkpsSMB0Bg1eA_jQW.exe (PID: 3084)
      • SnIpBO8HBGFNxjQhKW8pV4MG.exe (PID: 2484)
      • _sNwWDJR9sS9_pX8VHztgvt6.exe (PID: 2100)

    • Starts application with an unusual extension

      • cmd.exe (PID: 3920)
      • Triste.exe.com (PID: 2480)

    • Reads mouse settings

      • Triste.exe.com (PID: 2480)
      • Triste.exe.com (PID: 3684)

    • Adds / modifies Windows certificates

      • sahiba_6.exe (PID: 2800)
      • sahiba_3.exe (PID: 1448)

    • Reads Environment values

      • sahiba_4.exe (PID: 3864)
      • sahiba_5.exe (PID: 2276)
      • 2416004.exe (PID: 4072)
      • 8243832.exe (PID: 2680)
      • 6377007.exe (PID: 2380)
      • BearVpn 1.exe (PID: 1300)
      • sahiba_3.exe (PID: 1448)
      • WxTB3fv25NdlgnLk5gVHsR8y.exe (PID: 2324)
      • SnIpBO8HBGFNxjQhKW8pV4MG.exe (PID: 336)
      • GmaLoPpQEd9dkNrcPZWJ5AxG.exe (PID: 1508)
      • hUL7c7x6L5YFH_L5TX5qGIvx.exe (PID: 3292)
      • mQApjZxL8pXUWyKYJj3pPhb8.exe (PID: 908)
      • Hfm8BG7hEWPEVElvpE51qvs3.exe (PID: 3788)
      • G18_0B9N84pcw438IFPF1E8a.exe (PID: 2848)

    • Creates files in the user directory

      • sahiba_5.exe (PID: 2276)
      • 8130469.exe (PID: 188)
      • svchost.exe (PID: 3520)

    • Checks for external IP

      • sahiba_6.exe (PID: 2800)
      • svchost.exe (PID: 3520)
      • jooyu.exe (PID: 1348)

    • Reads the cookies of Mozilla Firefox

      • 2416004.exe (PID: 4072)

    • Starts itself from another location

      • 8130469.exe (PID: 188)

    • Reads Windows Product ID

      • wmiprvse.exe (PID: 3500)

    • Reads the Windows organization settings

      • wmiprvse.exe (PID: 3500)

    • Reads the date of Windows installation

      • wmiprvse.exe (PID: 3500)

    • Reads CPU info

      • wmiprvse.exe (PID: 3500)
      • sahiba_3.exe (PID: 1448)
      • GmaLoPpQEd9dkNrcPZWJ5AxG.exe (PID: 1508)

    • Creates files in the program directory

      • sahiba_3.exe (PID: 1448)
      • 6377007.exe (PID: 2380)
      • WerFault.exe (PID: 2392)
      • WerFault.exe (PID: 3888)
      • WerFault.exe (PID: 3360)
      • WerFault.exe (PID: 3644)
      • GmaLoPpQEd9dkNrcPZWJ5AxG.exe (PID: 1508)
      • WerFault.exe (PID: 3316)
      • 0s61FfRN3S_z1DUPFATSXV1b.exe (PID: 768)

    • Uses RUNDLL32.EXE to load library

      • wmiprvse.exe (PID: 3500)

    • Searches for installed software

      • 2416004.exe (PID: 4072)
      • sahiba_3.exe (PID: 1448)
      • 8243832.exe (PID: 2680)
      • 6377007.exe (PID: 2380)
      • svchost.exe (PID: 3520)
      • GmaLoPpQEd9dkNrcPZWJ5AxG.exe (PID: 1508)

    • Starts CMD.EXE for self-deleting

      • sahiba_3.exe (PID: 1448)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2756)

    • Creates a directory in Program Files

      • 0s61FfRN3S_z1DUPFATSXV1b.exe (PID: 768)

    • Creates a software uninstall entry

      • 0s61FfRN3S_z1DUPFATSXV1b.exe (PID: 768)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 4056)
      • iexplore.exe (PID: 2768)
      • DllHost.exe (PID: 3060)
      • chrome.exe (PID: 3828)
      • chrome.exe (PID: 3980)
      • chrome.exe (PID: 3600)
      • chrome.exe (PID: 1580)
      • chrome.exe (PID: 128)
      • chrome.exe (PID: 3472)
      • chrome.exe (PID: 3852)
      • chrome.exe (PID: 2852)
      • DllHost.exe (PID: 3308)
      • DllHost.exe (PID: 2864)
      • DllHost.exe (PID: 3724)
      • chrome.exe (PID: 2660)
      • svchost.exe (PID: 2072)
      • chrome.exe (PID: 3024)
      • DllHost.exe (PID: 3972)
      • DllHost.exe (PID: 412)
      • chrome.exe (PID: 3936)
      • consent.exe (PID: 668)
      • DllHost.exe (PID: 2240)
      • PING.EXE (PID: 3320)
      • svchost.exe (PID: 2384)
      • WerFault.exe (PID: 3316)
      • DllHost.exe (PID: 2660)
      • rundll32.exe (PID: 2148)
      • svchost.exe (PID: 3520)
      • WerFault.exe (PID: 3644)
      • WerFault.exe (PID: 3888)
      • WerFault.exe (PID: 2392)
      • rundll32.exe (PID: 2212)
      • DllHost.exe (PID: 3844)
      • WerFault.exe (PID: 3360)
      • taskkill.exe (PID: 3148)
      • rundll32.exe (PID: 908)
      • WerFault.exe (PID: 3856)
      • DllHost.exe (PID: 316)

    • Application launched itself

      • iexplore.exe (PID: 4056)
      • chrome.exe (PID: 3828)

    • Checks supported languages

      • iexplore.exe (PID: 4056)
      • iexplore.exe (PID: 2768)
      • DllHost.exe (PID: 3060)
      • chrome.exe (PID: 2184)
      • chrome.exe (PID: 3828)
      • chrome.exe (PID: 3980)
      • chrome.exe (PID: 2852)
      • chrome.exe (PID: 3600)
      • chrome.exe (PID: 2376)
      • chrome.exe (PID: 1580)
      • chrome.exe (PID: 3544)
      • chrome.exe (PID: 3784)
      • chrome.exe (PID: 748)
      • chrome.exe (PID: 724)
      • chrome.exe (PID: 4028)
      • chrome.exe (PID: 4016)
      • chrome.exe (PID: 2308)
      • chrome.exe (PID: 2548)
      • chrome.exe (PID: 128)
      • chrome.exe (PID: 1616)
      • chrome.exe (PID: 748)
      • chrome.exe (PID: 3288)
      • chrome.exe (PID: 1408)
      • chrome.exe (PID: 4008)
      • chrome.exe (PID: 2152)
      • chrome.exe (PID: 568)
      • chrome.exe (PID: 188)
      • chrome.exe (PID: 3472)
      • chrome.exe (PID: 3560)
      • DllHost.exe (PID: 3308)
      • DllHost.exe (PID: 2864)
      • DllHost.exe (PID: 3724)
      • NOTEPAD.EXE (PID: 2924)
      • chrome.exe (PID: 2660)
      • chrome.exe (PID: 3776)
      • chrome.exe (PID: 3024)
      • chrome.exe (PID: 2636)
      • DllHost.exe (PID: 412)
      • svchost.exe (PID: 2072)
      • chrome.exe (PID: 3936)
      • consent.exe (PID: 668)
      • DllHost.exe (PID: 3972)
      • chrome.exe (PID: 3852)
      • DllHost.exe (PID: 2240)
      • findstr.exe (PID: 1708)
      • PING.EXE (PID: 3320)
      • svchost.exe (PID: 2384)
      • DllHost.exe (PID: 2660)
      • WerFault.exe (PID: 3316)
      • rundll32.exe (PID: 2148)
      • svchost.exe (PID: 3520)
      • WerFault.exe (PID: 3644)
      • WerFault.exe (PID: 3888)
      • WerFault.exe (PID: 2392)
      • rundll32.exe (PID: 2212)
      • chrome.exe (PID: 968)
      • DllHost.exe (PID: 3844)
      • WerFault.exe (PID: 3360)
      • taskkill.exe (PID: 3148)
      • timeout.exe (PID: 2584)
      • rundll32.exe (PID: 908)
      • WerFault.exe (PID: 3856)
      • DllHost.exe (PID: 316)

    • Changes internet zones settings

      • iexplore.exe (PID: 4056)

    • Manual execution by user

      • chrome.exe (PID: 3828)
      • WinRAR.exe (PID: 3776)
      • NOTEPAD.EXE (PID: 2924)
      • x86_x64_setup.exe (PID: 3908)
      • x86_x64_setup.exe (PID: 2584)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2768)
      • consent.exe (PID: 668)
      • sahiba_3.exe (PID: 1448)
      • sahiba_6.exe (PID: 2800)
      • askinstall54.exe (PID: 3468)
      • FN8FMEspSmoY2d4lklDeZv5n.exe (PID: 3640)
      • GmaLoPpQEd9dkNrcPZWJ5AxG.exe (PID: 1508)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 4056)
      • chrome.exe (PID: 3024)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2768)
      • chrome.exe (PID: 3980)
      • sahiba_6.exe (PID: 2800)
      • sahiba_1.exe (PID: 1312)
      • sahiba_5.exe (PID: 2276)
      • sahiba_4.exe (PID: 3864)
      • sahiba_3.exe (PID: 1448)
      • 2416004.exe (PID: 4072)
      • 6377007.exe (PID: 2380)
      • 3002.exe (PID: 2480)
      • BearVpn 1.exe (PID: 1300)
      • askinstall54.exe (PID: 3468)
      • M2_wZY8WkpsSMB0Bg1eA_jQW.exe (PID: 3960)
      • 8243832.exe (PID: 2680)
      • FN8FMEspSmoY2d4lklDeZv5n.exe (PID: 3640)
      • GmaLoPpQEd9dkNrcPZWJ5AxG.exe (PID: 1508)
      • WxTB3fv25NdlgnLk5gVHsR8y.exe (PID: 2324)
      • jooyu.exe (PID: 1348)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2768)

    • Reads the hosts file

      • chrome.exe (PID: 3980)
      • chrome.exe (PID: 3828)

    • Dropped object may contain Bitcoin addresses

      • sahiba_6.exe (PID: 2800)

    • Reads CPU info

      • svchost.exe (PID: 3520)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
168
Monitored processes
137
Malicious processes
37
Suspicious processes
22

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start inject iexplore.exe no specs iexplore.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winrar.exe no specs winrar.exe notepad.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs x86_x64_setup.exe no specs x86_x64_setup.exe setup_installer.exe setup_install.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs sahiba_1.exe no specs sahiba_2.exe #VIDAR sahiba_3.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs sahiba_4.exe cmd.exe no specs sahiba_5.exe sahiba_7.exe no specs sahiba_6.exe sahiba_1.exe cmd.exe no specs cmd.exe no specs findstr.exe no specs triste.exe.com no specs ping.exe no specs triste.exe.com 2416004.exe 8130469.exe winhoster.exe no specs #REDLINE 8243832.exe Thumbnail Cache Class Factory for Out of Proc Server no specs consent.exe no specs conhost.exe no specs conhost.exe no specs svchost.exe no specs PSIProfileNotify no specs svchost.exe no specs DllHost.exe no specs Thumbnail Cache Class Factory for Out of Proc Server no specs DllHost.exe no specs DllHost.exe no specs werfault.exe no specs conhost.exe no specs wmiprvse.exe no specs Thumbnail Cache Class Factory for Out of Proc Server no specs conhost.exe no specs Profile Notification Host no specs 6377007.exe rundll32.exe no specs svchost.exe lzmwaqmv.exe 3002.exe no specs conhost.exe no specs askinstall54.exe bearvpn 1.exe werfault.exe no specs 3002.exe conhost.exe no specs werfault.exe no specs _snwwdjr9ss9_px8vhztgvt6.exe no specs werfault.exe no specs snipbo8hbgfnxjqhkw8pv4mg.exe no specs conhost.exe no specs wxtb3fv25ndlgnlk5gvhsr8y.exe no specs conhost.exe no specs #REDLINE snipbo8hbgfnxjqhkw8pv4mg.exe #REDLINE wxtb3fv25ndlgnlk5gvhsr8y.exe m2_wzy8wkpssmb0bg1ea_jqw.exe no specs conhost.exe no specs m2_wzy8wkpssmb0bg1ea_jqw.exe conhost.exe no specs _snwwdjr9ss9_px8vhztgvt6.exe no specs #VIDAR gmaloppqed9dknrcpzwj5axg.exe rundll32.exe no specs fn8fmespsmoy2d4lkldezv5n.exe chrome.exe no specs WinInetBrokerServer no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs werfault.exe no specs timeout.exe no specs 0s61ffrn3s_z1dupfatsxv1b.exe no specs rundll32.exe no specs svchost.exe jooyu.exe md8_8eus.exe jfiag3g_gg.exe no specs werfault.exe no specs #REDLINE hul7c7x6l5yfh_l5tx5qgivx.exe conhost.exe no specs Thumbnail Cache Class Factory for Out of Proc Server no specs #REDLINE hfm8bg7hewpevelvpe51qvs3.exe conhost.exe no specs #REDLINE mqapjzxl8pxuwykyjj3pphb8.exe conhost.exe no specs g18_0b9n84pcw438ifpf1e8a.exe no specs vktmzxoogplyhflnoryw9gbs.exe no specs regasm.exe no specs 6ualvsqqssnojur9ivjnfus1.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
128"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1028,3741616456602892420,5077145455231098977,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3356 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
188"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1028,3741616456602892420,5077145455231098977,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3948 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
188"C:\Users\admin\AppData\Roaming\8130469.exe" C:\Users\admin\AppData\Roaming\8130469.exe
sahiba_5.exe
User:
admin
Company:
Hosting
Integrity Level:
HIGH
Description:
Hosting
Exit code:
0
Version:
1.0.1.2
Modules
Images
c:\users\admin\appdata\roaming\8130469.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
316C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
336C:\Users\admin\Documents\SnIpBO8HBGFNxjQhKW8pV4MG.exeC:\Users\admin\Documents\SnIpBO8HBGFNxjQhKW8pV4MG.exe
SnIpBO8HBGFNxjQhKW8pV4MG.exe
User:
admin
Integrity Level:
HIGH
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\documents\snipbo8hbgfnxjqhkw8pv4mg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
404sahiba_2.exeC:\Users\admin\AppData\Local\Temp\7zSC1B2B5D1\sahiba_2.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\temp\7zsc1b2b5d1\sahiba_2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\sechost.dll
c:\windows\system32\sfc_os.dll
412C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\dllhost.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
568"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1028,3741616456602892420,5077145455231098977,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
668consent.exe 896 318 01E2EB08C:\Windows\system32\consent.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Consent UI for administrative applications
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\consent.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
668\??\C:\Windows\system32\conhost.exe "872626474881043525312515363-2235365851063489673-1331494354-7188827391198833030"\??\C:\Windows\system32\conhost.exe—csrss.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
Total events
94 794
Read events
93 895
Write events
890
Delete events
9

Modification events

(PID) Process:(4056) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(4056) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
856578928
(PID) Process:(4056) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30900632
(PID) Process:(4056) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(4056) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30900632
(PID) Process:(4056) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4056) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4056) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4056) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(4056) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
92
Suspicious files
100
Text files
252
Unknown types
151

Dropped files

PID
Process
Filename
Type
2768iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691binary
MD5:—
SHA256:—
2768iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
2768iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDAbinary
MD5:—
SHA256:—
2768iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691der
MD5:—
SHA256:—
2768iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDAder
MD5:—
SHA256:—
2768iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\jetpack-baa3806ecf8e06a3456624dbdce6d1da[1].csstext
MD5:—
SHA256:—
2768iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\soundpad-crack-license-key-download[1].htmhtml
MD5:—
SHA256:—
2768iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\style-4c7910a2ac1296f0896152c6531f057d[1].csstext
MD5:—
SHA256:—
3828chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-60FDD120-EF4.pma —
MD5:—
SHA256:—
2768iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\selectnav-e707bd1d510b0204e02f4e701412b36c[1].jstext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
175
TCP/UDP connections
217
DNS requests
89
Threats
302

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3980
chrome.exe
GET
301
172.67.143.52:80
http://kjsijh.xyz/?s=29&q=SoundPad-41-Crack-With-License-Key-Free-Download&g=39f602b50e14cfc74e73f25b9fe73190&mode=
US
—
—
suspicious
3980
chrome.exe
GET
200
18.236.165.204:80
http://18.236.165.204/favicon.ico
US
text
106 b
unknown
2800
sahiba_6.exe
POST
200
37.0.11.9:80
http://37.0.11.9/base/api/getData.php
NL
text
108 b
malicious
3980
chrome.exe
GET
200
18.236.165.204:80
http://18.236.165.204/favicon.ico
US
text
106 b
unknown
2768
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY
US
der
728 b
whitelisted
2968
setup_install.exe
GET
200
104.21.47.76:80
http://watira.xyz/addInstall.php?key=125478824515ADNxu2ccbwe&ip=&oid=139&oname[]=26July1206AM&oname[]=7&oname[]=1&oname[]=2&oname[]=3&oname[]=4&oname[]=5&oname[]=6&oname[]=8&cnt=8
US
text
10 b
malicious
1448
sahiba_3.exe
GET
200
151.139.128.14:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQDrMNf9g78s2B0RdM6vHPcU
US
der
472 b
whitelisted
2800
sahiba_6.exe
GET
200
37.0.8.235:80
http://37.0.8.235/proxies.txt
NL
text
2.45 Kb
suspicious
3980
chrome.exe
GET
200
18.236.165.204:80
http://18.236.165.204/?verify-id=29&verify-hash=7719a1c782a1ba91c031a682a0a2f8658209adbf&verify-msch=U291bmRQYWQtNDEtQ3JhY2stV2l0aC1MaWNlbnNlLUtleS1GcmVlLURvd25sb2Fk&download=1&xtrans=MTM4
US
compressed
2.77 Mb
unknown
2800
sahiba_6.exe
POST
200
37.0.11.9:80
http://37.0.11.9/base/api/getData.php
NL
text
108 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2768
iexplore.exe
151.139.128.14:80
ocsp.comodoca.com
Highwinds Network Group, Inc.
US
suspicious
2768
iexplore.exe
142.250.186.106:443
fonts.googleapis.com
Google Inc.
US
whitelisted
2768
iexplore.exe
192.0.76.3:443
stats.wp.com
Automattic, Inc
US
suspicious
3980
chrome.exe
142.250.181.227:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
3980
chrome.exe
142.250.184.205:443
accounts.google.com
Google Inc.
US
whitelisted
3980
chrome.exe
142.250.186.106:443
fonts.googleapis.com
Google Inc.
US
whitelisted
3980
chrome.exe
142.250.185.195:443
www.gstatic.com
Google Inc.
US
whitelisted
3980
chrome.exe
142.250.186.46:443
clients2.google.com
Google Inc.
US
whitelisted
3980
chrome.exe
142.250.186.36:443
www.google.com
Google Inc.
US
whitelisted
3980
chrome.exe
142.250.185.67:443
fonts.gstatic.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
ijicrack.com
  • 95.111.231.16
malicious
ctldl.windowsupdate.com
  • 205.185.216.10
  • 205.185.216.42
whitelisted
ocsp.comodoca.com
  • 151.139.128.14
whitelisted
fonts.googleapis.com
  • 142.250.186.106
whitelisted
stats.wp.com
  • 192.0.76.3
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
clientservices.googleapis.com
  • 142.250.181.227
whitelisted
clients2.google.com
  • 142.250.186.46
whitelisted
www.google.com
  • 142.250.186.36
malicious

Threats

PID
Process
Class
Message
3980
chrome.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
2800
sahiba_6.exe
A Network Trojan was detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
2800
sahiba_6.exe
Potential Corporate Privacy Violation
ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io)
2968
setup_install.exe
A Network Trojan was detected
AV TROJAN GCleaner Downloader CnC Activity
2968
setup_install.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
2680
8243832.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
1448
sahiba_3.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
1448
sahiba_3.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .dll file with no User-Agent
1448
sahiba_3.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1448
sahiba_3.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
102 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://ijicrack.com/soundpad-crack-license-key-download/