File name:

Adobe-Photoshop-CS6-Crack---Serial-Key-2021-Latest_5fc390fbac0e9.zip

Full analysis: https://app.any.run/tasks/7560af47-bb09-4ce8-8004-207463b5c468
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: November 29, 2020, 12:23:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
autoit
stealer
trojan
loader
evasion
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

397B13C495DA1404721B5138F0569D16

SHA1:

45B2C2A80D1FE478E1282C83974496139444E075

SHA256:

4AB8916FD108B0BC29F3CCAD5150F32CFA543ECF26A001AB6762E26FACAE6448

SSDEEP:

24576:iqMy4h2tsXzYByyzVSTbjx8+6C9PcuUWImJ8SoIh8SkctQg:7N4hu/IIYjaZC9O6mIawQg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Runs app for hidden code execution

      • cmd.exe (PID: 3184)

    • Application was dropped or rewritten from another process

      • setup_install.exe (PID: 3040)
      • SearchIndexer.com (PID: 3680)
      • SearchIndexer.com (PID: 3000)
      • File.exe (PID: 2700)
      • File.exe (PID: 2380)
      • 4fra.exe (PID: 2332)
      • startjo.exe (PID: 3688)
      • lvbop.exe (PID: 1868)
      • SmartClock.exe (PID: 932)
      • 6las.exe (PID: 3396)
      • CL_Debug_Log.txt (PID: 1408)
      • Helper.exe (PID: 3756)
      • Helper.exe (PID: 3860)
      • Helper.exe (PID: 3944)
      • tor.exe (PID: 2152)
      • Helper.exe (PID: 1396)
      • Helper.exe (PID: 1884)

    • Runs PING.EXE for delay simulation

      • cmd.exe (PID: 3012)

    • Stealing of credential data

      • ipconfig.exe (PID: 2720)

    • Actions looks like stealing of personal data

      • ipconfig.exe (PID: 2720)

    • Loads the Task Scheduler COM API

      • 4fra.exe (PID: 2332)
      • schtasks.exe (PID: 3568)

    • Writes to a start menu file

      • 4fra.exe (PID: 2332)

    • Loads dropped or rewritten executable

      • File.exe (PID: 2700)
      • tor.exe (PID: 2152)

    • Changes settings of System certificates

      • startjo.exe (PID: 3688)
      • WScript.exe (PID: 2736)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 576)

  • SUSPICIOUS

    • Application launched itself

      • WinRAR.exe (PID: 2256)
      • cmd.exe (PID: 3184)
      • SearchIndexer.com (PID: 3000)
      • Helper.exe (PID: 3756)

    • Drops a file with too old compile date

      • WinRAR.exe (PID: 1880)
      • Helper.exe (PID: 3944)
      • Helper.exe (PID: 3756)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1880)
      • cmd.exe (PID: 3012)
      • ipconfig.exe (PID: 2720)
      • File.exe (PID: 2700)
      • 4fra.exe (PID: 2332)
      • startjo.exe (PID: 3688)
      • CL_Debug_Log.txt (PID: 1408)
      • Helper.exe (PID: 3944)
      • Helper.exe (PID: 3756)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 1880)
      • Helper.exe (PID: 3944)

    • Starts CMD.EXE for commands execution

      • setup_install.exe (PID: 3040)
      • cmd.exe (PID: 3184)
      • ipconfig.exe (PID: 2720)
      • 6las.exe (PID: 3396)
      • startjo.exe (PID: 3688)
      • lvbop.exe (PID: 1868)

    • Starts CertUtil for decode files

      • cmd.exe (PID: 3012)
      • cmd.exe (PID: 3184)

    • Starts application with an unusual extension

      • cmd.exe (PID: 3012)
      • SearchIndexer.com (PID: 3000)
      • startjo.exe (PID: 3688)

    • Drop AutoIt3 executable file

      • cmd.exe (PID: 3012)

    • Uses IPCONFIG.EXE to discover IP address

      • SearchIndexer.com (PID: 3680)

    • Reads the cookies of Google Chrome

      • ipconfig.exe (PID: 2720)

    • Reads the cookies of Mozilla Firefox

      • ipconfig.exe (PID: 2720)

    • Starts CMD.EXE for self-deleting

      • ipconfig.exe (PID: 2720)
      • 6las.exe (PID: 3396)

    • Creates files in the program directory

      • File.exe (PID: 2700)
      • 6las.exe (PID: 3396)

    • Drops a file with a compile date too recent

      • File.exe (PID: 2700)
      • CL_Debug_Log.txt (PID: 1408)
      • startjo.exe (PID: 3688)

    • Creates a directory in Program Files

      • File.exe (PID: 2700)

    • Creates files in the user directory

      • 4fra.exe (PID: 2332)
      • startjo.exe (PID: 3688)
      • Helper.exe (PID: 3756)
      • Helper.exe (PID: 3944)
      • tor.exe (PID: 2152)

    • Searches for installed software

      • ipconfig.exe (PID: 2720)

    • Starts itself from another location

      • 4fra.exe (PID: 2332)

    • Checks for external IP

      • 6las.exe (PID: 3396)
      • lvbop.exe (PID: 1868)

    • Adds / modifies Windows certificates

      • startjo.exe (PID: 3688)
      • WScript.exe (PID: 2736)

    • Executes scripts

      • cmd.exe (PID: 1776)

    • Executed via Task Scheduler

      • Helper.exe (PID: 3756)
      • Helper.exe (PID: 3860)
      • Helper.exe (PID: 1396)
      • Helper.exe (PID: 1884)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • tor.exe (PID: 2152)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xpi | Mozilla Firefox browser extension (66.6)
.zip | ZIP compressed archive (33.3)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2020:11:29 12:15:27
ZipCRC: 0x1ea06776
ZipCompressedSize: 242
ZipUncompressedSize: 349
ZipFileName: Adobe-Photoshop-CS6-Crack---Serial-Key-2021-Latest/5fc390fb374a05fc390f-files/5fc390fb374a05fc390f-ReadMe-First.txt
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
86
Monitored processes
39
Malicious processes
14
Suspicious processes
8

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe no specs winrar.exe no specs notepad.exe no specs winrar.exe setup_install.exe no specs cmd.exe no specs cmd.exe no specs certutil.exe no specs cmd.exe ping.exe no specs certutil.exe no specs searchindexer.com no specs ping.exe no specs searchindexer.com no specs ipconfig.exe file.exe no specs file.exe cmd.exe no specs timeout.exe no specs lvbop.exe 6las.exe 4fra.exe startjo.exe smartclock.exe cmd.exe no specs timeout.exe no specs cmd.exe no specs timeout.exe no specs cl_debug_log.txt cmd.exe no specs schtasks.exe no specs cmd.exe no specs wscript.exe helper.exe helper.exe no specs helper.exe tor.exe helper.exe no specs helper.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
572certutil -decode 4-25 8-68 C:\Windows\system32\certutil.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CertUtil.exe
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\certutil.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\certcli.dll
c:\windows\system32\atl.dll
576C:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"C:\Windows\system32\cmd.exe—startjo.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
932"C:\Users\admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\admin\AppData\Roaming\Smart Clock\SmartClock.exe
4fra.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\smart clock\smartclock.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
1396C:\Users\admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheckC:\Users\admin\AppData\Roaming\Microsoft\Windows\Helper.exe—taskeng.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\microsoft\windows\helper.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
1408C:\Users\admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\admin\AppData\Local\Temp\"C:\Users\admin\AppData\Local\Temp\CL_Debug_Log.txt
startjo.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Standalone Console
Exit code:
0
Version:
19.00
Modules
Images
c:\users\admin\appdata\local\temp\cl_debug_log.txt
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1776"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\admin\AppData\Local\Temp\sbhsxnsofa.vbs"C:\Windows\system32\cmd.exe—lvbop.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1868"C:\Program Files\solfer\boleroh\lvbop.exe"C:\Program Files\solfer\boleroh\lvbop.exe
File.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\solfer\boleroh\lvbop.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
1880"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIa2256.619\5fc390fb9dd89_setup_files.zipC:\Program Files\WinRAR\WinRAR.exe
WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1884C:\Users\admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheckC:\Users\admin\AppData\Roaming\Microsoft\Windows\Helper.exe—taskeng.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\microsoft\windows\helper.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
2152"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe" -f TorConfigC:\Users\admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe
Helper.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\microsoft\windows\tor\tor.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\roaming\microsoft\windows\tor\zlib1.dll
c:\windows\system32\msvcrt.dll
c:\users\admin\appdata\roaming\microsoft\windows\tor\libssp-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
4 070
Read events
3 916
Write events
154
Delete events
0

Modification events

(PID) Process:(2256) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2256) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2256) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2256) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Adobe-Photoshop-CS6-Crack---Serial-Key-2021-Latest_5fc390fbac0e9.zip
(PID) Process:(2256) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2256) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2256) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2256) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2788) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2788) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
Executable files
28
Suspicious files
14
Text files
375
Unknown types
18

Dropped files

PID
Process
Filename
Type
3208certutil.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\I —
MD5:—
SHA256:—
2256WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa2256.49916\5fc390fb374a05fc390f-PASSWORD.txttext
MD5:—
SHA256:—
3040setup_install.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\1-0image
MD5:—
SHA256:—
2256WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa2256.44993\5fc390fb9dd89_setup_files.zipcompressed
MD5:—
SHA256:—
3040setup_install.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\1-23text
MD5:—
SHA256:—
3040setup_install.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\4-25text
MD5:—
SHA256:—
2720ipconfig.exeC:\Users\admin\AppData\Local\Temp\Y5OWyUHzAa\3pNhO.tmpsqlite
MD5:—
SHA256:—
3040setup_install.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\56-50binary
MD5:—
SHA256:—
2720ipconfig.exeC:\Users\admin\AppData\Local\Temp\Y5OWyUHzAa\BDfx.tmpsqlite
MD5:—
SHA256:—
2720ipconfig.exeC:\Users\admin\AppData\Local\Temp\Y5OWyUHzAa\zHXI.tmpsqlite
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
16
DNS requests
11
Threats
39

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2720
ipconfig.exe
GET
200
45.8.124.132:80
http://shhhes02.top/downfiles/lv.exe
unknown
executable
20.5 Mb
malicious
2736
WScript.exe
GET
200
151.139.128.14:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEGmjTouN%2FW5s3CDseaiw7qE%3D
US
der
471 b
whitelisted
2736
WScript.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
1868
lvbop.exe
GET
200
208.95.112.1:80
http://ip-api.com/json
unknown
text
276 b
malicious
3396
6las.exe
GET
200
208.95.112.1:80
http://ip-api.com/line
unknown
text
135 b
malicious
2720
ipconfig.exe
POST
200
185.238.1.60:80
http://humusser25.top/index.php
unknown
text
2 b
malicious
2720
ipconfig.exe
POST
200
185.238.1.60:80
http://moraffdd03.top/index.php
unknown
text
3 b
malicious
2720
ipconfig.exe
GET
302
45.8.124.132:80
http://shhhes02.top/download.php?file=lv.exe
unknown
—
—
malicious
2736
WScript.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1868
lvbop.exe
208.95.112.1:80
ip-api.com
IBURST
—
malicious
2152
tor.exe
45.79.108.130:9001
—
Linode, LLC
US
suspicious
2152
tor.exe
96.253.78.108:443
—
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2152
tor.exe
199.184.246.250:443
—
dao Consulting, LLC
US
suspicious
3688
startjo.exe
88.99.66.31:443
2no.co
Hetzner Online GmbH
DE
malicious
2736
WScript.exe
88.99.66.31:443
2no.co
Hetzner Online GmbH
DE
malicious
2736
WScript.exe
151.139.128.14:80
ocsp.comodoca.com
Highwinds Network Group, Inc.
US
suspicious
2152
tor.exe
163.172.184.32:443
—
Online S.a.s.
FR
suspicious
2152
tor.exe
178.62.252.82:443
—
Digital Ocean, Inc.
NL
suspicious
2720
ipconfig.exe
45.8.124.132:80
shhhes02.top
—
—
malicious

DNS requests

Domain
IP
Reputation
DJrui.DJrui
  • —
unknown
heExvnEUQmrowxbOmY.heExvnEUQmrowxbOmY
  • —
unknown
humusser25.top
  • 185.238.1.60
  • 193.106.175.29
malicious
moraffdd03.top
  • 185.238.1.60
  • 193.106.175.29
malicious
shhhes02.top
  • 45.8.124.132
  • 188.120.239.57
malicious
ip-api.com
  • 208.95.112.1
malicious
2no.co
  • 88.99.66.31
whitelisted
iplogger.org
  • 88.99.66.31
shared
ocsp.comodoca.com
  • 151.139.128.14
whitelisted
ocsp.usertrust.com
  • 151.139.128.14
whitelisted

Threats

PID
Process
Class
Message
1060
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2720
ipconfig.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
2720
ipconfig.exe
A Network Trojan was detected
STEALER [PTsecurity] Possible Exfiltration Action (POST Zip Archive)
2720
ipconfig.exe
A Network Trojan was detected
STEALER [PTsecurity] Possible Exfiltration Action (POST Zip Archive)
2720
ipconfig.exe
A Network Trojan was detected
ET TROJAN Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
2720
ipconfig.exe
A Network Trojan was detected
STEALER [PTsecurity] Possible Exfiltration Action (POST Zip Archive)
2720
ipconfig.exe
A Network Trojan was detected
ET CURRENT_EVENTS SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016
2720
ipconfig.exe
A Network Trojan was detected
ET CURRENT_EVENTS SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016
2720
ipconfig.exe
Potentially Bad Traffic
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
2720
ipconfig.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
12 ETPRO signatures available at the full report
Process
Message
lvbop.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
6las.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
4fra.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
startjo.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
SmartClock.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Adobe-Photoshop-CS6-Crack---Serial-Key-2021-Latest_5fc390fbac0e9.zip