File name:

Voicemod-P-6a74f8debc51-ro-21601-Crack---License-Key-3264-Bit-650b0bc85e07.zip

Full analysis: https://app.any.run/tasks/1dd1009f-d4b4-4c9d-8cfd-bae8f0492149
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: July 29, 2021, 01:40:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
stealer
loader
evasion
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

7A02EFCB06DA34EB6CA6BB104DF1CB66

SHA1:

781B17E11E1A43247498EBC84AAD5901AEE6FD4B

SHA256:

3B9D1FA9DEBF9BACDEA560A16C31C561429EA7912CD56B4A6821ACA23954B9A4

SSDEEP:

24576:TyF+khB+r0sNAoxf5Ukl69bTPgKl0RA7aEjQjxN3FV8:T9khu0y5l6hgo0RAOEjcT8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Setup.exe (PID: 3220)
      • Filett.exe (PID: 3436)
      • Filett.exe (PID: 2704)
      • 4.exe (PID: 3528)
      • SmartClock.exe (PID: 3192)
      • vpn.exe (PID: 3580)
      • vpn.exe (PID: 1536)

    • Runs app for hidden code execution

      • cmd.exe (PID: 3324)
      • cmd.exe (PID: 1024)
      • cmd.exe (PID: 3824)

    • Steals credentials from Web Browsers

      • Ora.exe.com (PID: 2332)

    • Actions looks like stealing of personal data

      • Ora.exe.com (PID: 2332)

    • Stealing of credential data

      • Ora.exe.com (PID: 2332)

    • Changes the autorun value in the registry

      • vpn.exe (PID: 1536)

    • Drops executable file immediately after starts

      • Filett.exe (PID: 2704)

    • Writes to a start menu file

      • 4.exe (PID: 3528)

    • Loads dropped or rewritten executable

      • Filett.exe (PID: 2704)

    • Changes settings of System certificates

      • WScript.exe (PID: 3052)

    • Loads the Task Scheduler COM API

      • 4.exe (PID: 3528)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 4052)
      • WinRAR.exe (PID: 732)
      • Setup.exe (PID: 3220)
      • cmd.exe (PID: 2348)
      • cmd.exe (PID: 3324)
      • cmd.exe (PID: 2356)
      • Ora.exe.com (PID: 3820)
      • Ora.exe.com (PID: 2332)
      • Filett.exe (PID: 2704)
      • cmd.exe (PID: 3052)
      • 4.exe (PID: 3528)
      • vpn.exe (PID: 1536)
      • cmd.exe (PID: 1960)
      • cmd.exe (PID: 1024)
      • cmd.exe (PID: 2244)
      • Veda.exe.com (PID: 1820)
      • Veda.exe.com (PID: 2832)
      • SmartClock.exe (PID: 3192)
      • WScript.exe (PID: 3052)
      • vpn.exe (PID: 3580)
      • cmd.exe (PID: 1168)
      • cmd.exe (PID: 2260)
      • cmd.exe (PID: 3824)
      • Veda.exe.com (PID: 404)
      • Veda.exe.com (PID: 536)

    • Reads the computer name

      • WinRAR.exe (PID: 4052)
      • WinRAR.exe (PID: 732)
      • Ora.exe.com (PID: 2332)
      • Filett.exe (PID: 2704)
      • Veda.exe.com (PID: 2832)
      • 4.exe (PID: 3528)
      • WScript.exe (PID: 3052)
      • Veda.exe.com (PID: 536)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 732)
      • Filett.exe (PID: 2704)
      • 4.exe (PID: 3528)

    • Drops a file with too old compile date

      • WinRAR.exe (PID: 732)
      • Filett.exe (PID: 2704)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 732)
      • Ora.exe.com (PID: 2332)
      • Filett.exe (PID: 2704)
      • 4.exe (PID: 3528)

    • Starts CMD.EXE for commands execution

      • Setup.exe (PID: 3220)
      • cmd.exe (PID: 3324)
      • Ora.exe.com (PID: 2332)
      • vpn.exe (PID: 1536)
      • cmd.exe (PID: 1024)
      • vpn.exe (PID: 3580)
      • cmd.exe (PID: 3824)

    • Application launched itself

      • cmd.exe (PID: 3324)
      • Ora.exe.com (PID: 3820)
      • cmd.exe (PID: 1024)
      • Veda.exe.com (PID: 1820)
      • cmd.exe (PID: 3824)
      • Veda.exe.com (PID: 404)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2356)
      • Ora.exe.com (PID: 3820)
      • Veda.exe.com (PID: 1820)
      • cmd.exe (PID: 2244)
      • cmd.exe (PID: 1168)
      • Veda.exe.com (PID: 404)

    • Reads the cookies of Google Chrome

      • Ora.exe.com (PID: 2332)

    • Reads CPU info

      • Ora.exe.com (PID: 2332)
      • Veda.exe.com (PID: 2832)

    • Starts CHOICE.EXE (used to create a delay)

      • cmd.exe (PID: 2356)
      • cmd.exe (PID: 2244)
      • cmd.exe (PID: 1168)

    • Reads mouse settings

      • Ora.exe.com (PID: 3820)
      • Ora.exe.com (PID: 2332)
      • Veda.exe.com (PID: 1820)
      • Veda.exe.com (PID: 2832)
      • Veda.exe.com (PID: 404)
      • Veda.exe.com (PID: 536)

    • Reads Environment values

      • Ora.exe.com (PID: 2332)

    • Reads the cookies of Mozilla Firefox

      • Ora.exe.com (PID: 2332)

    • Starts CMD.EXE for self-deleting

      • Ora.exe.com (PID: 2332)

    • Creates files in the program directory

      • Filett.exe (PID: 2704)

    • Creates a directory in Program Files

      • Filett.exe (PID: 2704)

    • Searches for installed software

      • Ora.exe.com (PID: 2332)

    • Creates files in the user directory

      • 4.exe (PID: 3528)
      • WScript.exe (PID: 3052)

    • Starts itself from another location

      • 4.exe (PID: 3528)

    • Checks for external IP

      • Veda.exe.com (PID: 2832)

    • Executes scripts

      • Veda.exe.com (PID: 2832)

    • Adds / modifies Windows certificates

      • WScript.exe (PID: 3052)

  • INFO

    • Checks supported languages

      • NOTEPAD.EXE (PID: 3728)
      • findstr.exe (PID: 3472)
      • choice.exe (PID: 3860)
      • timeout.exe (PID: 2352)
      • findstr.exe (PID: 1632)
      • choice.exe (PID: 276)
      • findstr.exe (PID: 2328)
      • choice.exe (PID: 312)

    • Manual execution by user

      • WinRAR.exe (PID: 732)
      • NOTEPAD.EXE (PID: 3728)
      • Setup.exe (PID: 3220)
      • vpn.exe (PID: 3580)

    • Reads settings of System Certificates

      • WScript.exe (PID: 3052)

    • Checks Windows Trust Settings

      • WScript.exe (PID: 3052)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: Voicemod-P-6a74f8debc51-ro-21601-Crack---License-Key-3264-Bit-a7e465f869cf0f6705563de58b7b1314/a7e465f869cf0f6705563de58b7b1314-Setup-File/a7e465f869cf0f6705563de58b7b1314_setup_files.zip
ZipUncompressedSize: 1373787
ZipCompressedSize: 1373997
ZipCRC: 0x73e56510
ZipModifyDate: 2021:07:29 01:20:01
ZipCompression: Deflated
ZipBitFlag: 0x0002
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
88
Monitored processes
34
Malicious processes
7
Suspicious processes
9

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start winrar.exe no specs notepad.exe no specs winrar.exe setup.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs findstr.exe no specs ora.exe.com no specs choice.exe no specs ora.exe.com filett.exe no specs filett.exe cmd.exe no specs timeout.exe no specs vpn.exe 4.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs findstr.exe no specs choice.exe no specs veda.exe.com no specs veda.exe.com smartclock.exe no specs wscript.exe vpn.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs findstr.exe no specs veda.exe.com no specs choice.exe no specs veda.exe.com no specs

Process information

PID
CMD
Path
Indicators
Parent process
276choice /C YN /D Y /t 30C:\Windows\system32\choice.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Offers the user a choice
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\choice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\usp10.dll
312choice /C YN /D Y /t 30C:\Windows\system32\choice.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Offers the user a choice
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\choice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ws2_32.dll
404Veda.exe.com ZC:\Users\admin\AppData\Local\Temp\IXP000.TMP\Veda.exe.com—cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
0
Version:
3, 3, 14, 5
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\veda.exe.com
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
536C:\Users\admin\AppData\Local\Temp\IXP000.TMP\Veda.exe.com ZC:\Users\admin\AppData\Local\Temp\IXP000.TMP\Veda.exe.com—Veda.exe.com
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
0
Version:
3, 3, 14, 5
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\veda.exe.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
732"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Voicemod-P-6a74f8debc51-ro-21601-Crack---License-Key-3264-Bit-a7e465f869cf0f6705563de58b7b1314\a7e465f869cf0f6705563de58b7b1314-Setup-File\a7e465f869cf0f6705563de58b7b1314_setup_files.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\winrar\winrar.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1024cmd /c cmd < Ammirabile.aviC:\Windows\system32\cmd.exe—vpn.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
1168cmd C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1536"C:\Users\admin\AppData\Local\Temp\New Feature\vpn.exe"C:\Users\admin\AppData\Local\Temp\New Feature\vpn.exe
Filett.exe
User:
admin
Company:
Yfuphxtbk Hqikmcqxto
Integrity Level:
HIGH
Description:
Lgf80 Vidjnwp Lfddqshkyd
Exit code:
0
Version:
71.9.7404.25454 (zuermgg_vvf.240763-6027)
Modules
Images
c:\users\admin\appdata\local\temp\new feature\vpn.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\user32.dll
1632findstr /V /R "^PshvtheoAFounjmHfEgVWzPYeQjQPCykWNpsekOPBPRzWKRoiZWfvFLcBfxgqjzXAWlKroErPnxuCvwsYtIQFPPdeOPNRmOfvTSqAuyZxTmXkETthefWDCaLuTIgaf7f81a39-5f63-5b42-9efd-1f13b5431005quot; Vedrai.avi C:\Windows\system32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\findstr.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\apphelp.dll
1820Veda.exe.com ZC:\Users\admin\AppData\Local\Temp\IXP001.TMP\Veda.exe.com—cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
HIGH
Description:
AutoIt v3 Script
Exit code:
0
Version:
3, 3, 14, 5
Modules
Images
c:\users\admin\appdata\local\temp\ixp001.tmp\veda.exe.com
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\winmm.dll
Total events
11 263
Read events
11 133
Write events
127
Delete events
3

Modification events

(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(4052) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Voicemod-P-6a74f8debc51-ro-21601-Crack---License-Key-3264-Bit-650b0bc85e07.zip
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(732) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
Executable files
10
Suspicious files
15
Text files
31
Unknown types
12

Dropped files

PID
Process
Filename
Type
4052WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4052.48873\Voicemod-P-6a74f8debc51-ro-21601-Crack---License-Key-3264-Bit-a7e465f869cf0f6705563de58b7b1314\a7e465f869cf0f6705563de58b7b1314-Setup-File\a7e465f869cf0f6705563de58b7b1314_setup_files.zipcompressed
MD5:—
SHA256:—
3220Setup.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\Osi.pubtext
MD5:—
SHA256:—
3220Setup.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\Accendeva.pubtext
MD5:—
SHA256:—
3220Setup.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\Dianzi.pubbinary
MD5:—
SHA256:—
2356cmd.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\Ntext
MD5:—
SHA256:—
4052WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4052.48873\Voicemod-P-6a74f8debc51-ro-21601-Crack---License-Key-3264-Bit-a7e465f869cf0f6705563de58b7b1314\a7e465f869cf0f6705563de58b7b1314-Setup-File\-6a74f8debc51--ReadMe-it.txttext
MD5:—
SHA256:—
4052WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4052.48873\Voicemod-P-6a74f8debc51-ro-21601-Crack---License-Key-3264-Bit-a7e465f869cf0f6705563de58b7b1314\a7e465f869cf0f6705563de58b7b1314-Setup-File\-6a74f8debc51-_Password_Here.txttext
MD5:—
SHA256:—
732WinRAR.exeC:\Users\admin\Desktop\Voicemod-P-6a74f8debc51-ro-21601-Crack---License-Key-3264-Bit-a7e465f869cf0f6705563de58b7b1314\a7e465f869cf0f6705563de58b7b1314-Setup-File\a7e465f869cf0f6705563de58b7b1314_setup_files\Setup.exeexecutable
MD5:—
SHA256:—
3220Setup.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\Inebriato.pubbinary
MD5:—
SHA256:—
2356cmd.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\Ora.exe.comtext
MD5:AC6AD5D9B99757C3A878F2D275ACE198
SHA256:9B8DB510EF42B8ED54A3712636FDA55A4F8CFCD5493E20B74AB00CD4F3979F2D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
11
DNS requests
12
Threats
38

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2332
Ora.exe.com
GET
302
45.131.46.175:80
http://winxob04.top/download.php?file=lv.exe
unknown
—
—
malicious
2332
Ora.exe.com
GET
200
45.131.46.175:80
http://winxob04.top/downfiles/lv.exe
unknown
executable
1.15 Mb
malicious
2332
Ora.exe.com
POST
200
185.147.128.78:80
http://ewaisb31.top/index.php
RU
text
36 b
malicious
3052
WScript.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
2332
Ora.exe.com
POST
—
185.147.128.78:80
http://ewaisb31.top/index.php
RU
—
—
malicious
2832
Veda.exe.com
GET
200
208.95.112.1:80
http://ip-api.com/json
unknown
text
289 b
malicious
3052
WScript.exe
GET
200
151.139.128.14:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEGmjTouN%2FW5s3CDseaiw7qE%3D
US
der
471 b
whitelisted
3052
WScript.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
2332
Ora.exe.com
POST
200
135.125.191.12:80
http://morxeg03.top/index.php
US
text
3 b
malicious
3052
WScript.exe
GET
200
205.185.216.10:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2cf8ceb55f942912
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3052
WScript.exe
205.185.216.10:80
ctldl.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
2332
Ora.exe.com
185.147.128.78:80
ewaisb31.top
LLC Internet Tehnologii
RU
malicious
3052
WScript.exe
151.139.128.14:80
ocsp.comodoca.com
Highwinds Network Group, Inc.
US
suspicious
2332
Ora.exe.com
45.131.46.175:80
winxob04.top
—
—
malicious
3052
WScript.exe
88.99.66.31:443
iplogger.org
Hetzner Online GmbH
DE
malicious
2332
Ora.exe.com
135.125.191.12:80
morxeg03.top
Avaya Inc.
US
malicious
2832
Veda.exe.com
208.95.112.1:80
ip-api.com
IBURST
—
malicious

DNS requests

Domain
IP
Reputation
mCHBljMFgmTAiiK.mCHBljMFgmTAiiK
  • —
unknown
ewaisb31.top
  • 185.147.128.78
  • 93.99.104.183
malicious
morxeg03.top
  • 135.125.191.12
  • 142.11.209.158
malicious
winxob04.top
  • 45.131.46.175
malicious
nULmPlSLTBiT.nULmPlSLTBiT
  • —
unknown
ip-api.com
  • 208.95.112.1
malicious
iplogger.org
  • 88.99.66.31
shared
ctldl.windowsupdate.com
  • 205.185.216.10
  • 205.185.216.42
whitelisted
ocsp.comodoca.com
  • 151.139.128.14
whitelisted
ocsp.usertrust.com
  • 151.139.128.14
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2332
Ora.exe.com
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
2332
Ora.exe.com
A Network Trojan was detected
ET TROJAN Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
2332
Ora.exe.com
A Network Trojan was detected
ET CURRENT_EVENTS SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016
2332
Ora.exe.com
A Network Trojan was detected
ET CURRENT_EVENTS SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016
2332
Ora.exe.com
Potentially Bad Traffic
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
2332
Ora.exe.com
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2332
Ora.exe.com
Misc activity
ET INFO Possible EXE Download From Suspicious TLD
2832
Veda.exe.com
Potential Corporate Privacy Violation
ET POLICY External IP Lookup ip-api.com
2832
Veda.exe.com
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
28 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Voicemod-P-6a74f8debc51-ro-21601-Crack---License-Key-3264-Bit-650b0bc85e07.zip