File name:

6006d4ca6d518__AlterCam-54-Crack-Keygen--License-Key-Free-Download.zip

Full analysis: https://app.any.run/tasks/49b0d2e5-78a2-4024-a0e4-ffdd995bc2a8
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 19, 2021, 12:50:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
autoit
stealer
trojan
evasion
loader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

1C923162D0CA70EEE3AA4BC2BB40E683

SHA1:

B9123A653F9C86DA631867A529A20836F0141822

SHA256:

7E6220C1DDE32B24D141C1F2B94033069CAE9DBC64D1EC40A2FB2B21635AE8BC

SSDEEP:

24576:RJGhpI/5oUpU9c1fJUlQFBIldeAwl2WBm/MyeZrl4W352qsAAubCCZAy:RU2xJfuCFVPdygN35dsAAumM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Runs app for hidden code execution

      • cmd.exe (PID: 608)

    • Application was dropped or rewritten from another process

      • setup_x86_x64_install.exe (PID: 3252)
      • Ex.com (PID: 4032)
      • Ex.com (PID: 3200)
      • Ex.com (PID: 2080)
      • File53.exe (PID: 792)
      • 4_ico.exe (PID: 3108)
      • 6_ico.exe (PID: 3124)
      • vpn_ico.exe (PID: 4076)
      • SmartClock.exe (PID: 1204)
      • File53.exe (PID: 3032)

    • Runs PING.EXE for delay simulation

      • cmd.exe (PID: 3328)

    • Actions looks like stealing of personal data

      • Ex.com (PID: 2080)

    • Stealing of credential data

      • Ex.com (PID: 2080)

    • Loads dropped or rewritten executable

      • File53.exe (PID: 792)

    • Drops executable file immediately after starts

      • File53.exe (PID: 792)

    • Writes to a start menu file

      • 4_ico.exe (PID: 3108)

    • Loads the Task Scheduler COM API

      • 4_ico.exe (PID: 3108)

    • Steals credentials from Web Browsers

      • Ex.com (PID: 2080)

    • Changes settings of System certificates

      • WScript.exe (PID: 4044)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 328)
      • cmd.exe (PID: 3328)
      • Ex.com (PID: 2080)
      • File53.exe (PID: 792)
      • 4_ico.exe (PID: 3108)

    • Application launched itself

      • cmd.exe (PID: 608)
      • Ex.com (PID: 4032)
      • Ex.com (PID: 3200)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 608)
      • setup_x86_x64_install.exe (PID: 3252)
      • Ex.com (PID: 2080)
      • 6_ico.exe (PID: 3124)

    • Starts CertUtil for decode files

      • cmd.exe (PID: 608)
      • cmd.exe (PID: 3328)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 328)

    • Drop AutoIt3 executable file

      • cmd.exe (PID: 3328)

    • Starts application with an unusual extension

      • cmd.exe (PID: 3328)
      • Ex.com (PID: 4032)
      • Ex.com (PID: 3200)

    • Reads the cookies of Google Chrome

      • Ex.com (PID: 2080)

    • Reads the cookies of Mozilla Firefox

      • Ex.com (PID: 2080)

    • Starts CMD.EXE for self-deleting

      • Ex.com (PID: 2080)
      • 6_ico.exe (PID: 3124)

    • Drops a file with a compile date too recent

      • File53.exe (PID: 792)

    • Starts itself from another location

      • 4_ico.exe (PID: 3108)

    • Creates files in the user directory

      • 4_ico.exe (PID: 3108)
      • WScript.exe (PID: 4044)

    • Checks for external IP

      • vpn_ico.exe (PID: 4076)
      • 6_ico.exe (PID: 3124)

    • Creates files in the program directory

      • 6_ico.exe (PID: 3124)

    • Executes scripts

      • vpn_ico.exe (PID: 4076)

    • Adds / modifies Windows certificates

      • WScript.exe (PID: 4044)

    • Searches for installed software

      • Ex.com (PID: 2080)

  • INFO

    • Manual execution by user

      • WinRAR.exe (PID: 328)
      • NOTEPAD.EXE (PID: 3848)
      • NOTEPAD.EXE (PID: 916)
      • verclsid.exe (PID: 3968)

    • Changes default file association

      • rundll32.exe (PID: 688)

    • Dropped object may contain Bitcoin addresses

      • certutil.exe (PID: 696)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xpi | Mozilla Firefox browser extension (66.6)
.zip | ZIP compressed archive (33.3)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2021:01:19 12:47:03
ZipCRC: 0x8e9b4fea
ZipCompressedSize: 310
ZipUncompressedSize: 459
ZipFileName: AlterCam-54-Crack-Keygen--License-Key-Free-Download/6006d4ca2f40f6006d4ca-files/6006d4ca2f40f6006d4ca_Read-Me-First.txt
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
74
Monitored processes
30
Malicious processes
10
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start rundll32.exe no specs winrar.exe no specs notepad.exe no specs notepad.exe no specs winrar.exe setup_x86_x64_install.exe no specs cmd.exe no specs cmd.exe no specs certutil.exe no specs cmd.exe findstr.exe no specs certutil.exe no specs ex.com no specs ping.exe no specs ex.com no specs ex.com file53.exe no specs file53.exe cmd.exe no specs timeout.exe no specs 4_ico.exe 6_ico.exe vpn_ico.exe smartclock.exe cmd.exe no specs timeout.exe no specs cmd.exe no specs timeout.exe no specs wscript.exe verclsid.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
328"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\AlterCam-54-Crack-Keygen--License-Key-Free-Download\6006d4ca2f40f6006d4ca-files\6006d4ca5fcc3_setup_files.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
608cmd /c certutil -decode Chirurgo.vob Le.bmp & cmd < Le.bmpC:\Windows\system32\cmd.exe—setup_x86_x64_install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
688"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\6006d4ca6d518__AlterCam-54-Crack-Keygen--License-Key-Free-Download.zip.xpiC:\Windows\system32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
696certutil -decode Fu.xltx oC:\Windows\system32\certutil.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CertUtil.exe
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\certutil.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\certcli.dll
c:\windows\system32\atl.dll
792"C:\Users\admin\AppData\Local\Temp\File53.exe" C:\Users\admin\AppData\Local\Temp\File53.exe
Ex.com
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\file53.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shell32.dll
916"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\AlterCam-54-Crack-Keygen--License-Key-Free-Download\6006d4ca2f40f6006d4ca-files\6006d4ca2f40f6006d4ca_Read-Me-First.txtC:\Windows\system32\NOTEPAD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1204"C:\Users\admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\admin\AppData\Roaming\Smart Clock\SmartClock.exe
4_ico.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\smart clock\smartclock.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
1816"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\admin\AppData\Local\Temp\te0UMtuyoi & timeout 2 & del /f /q "C:\Users\admin\AppData\Local\Temp\IXP000.TMP\Ex.com"C:\Windows\system32\cmd.exe—Ex.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2080C:\Users\admin\AppData\Local\Temp\IXP000.TMP\Ex.com C:\Users\admin\AppData\Local\Temp\IXP000.TMP\Ex.com
Ex.com
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Exit code:
0
Version:
3, 3, 15, 3
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\ex.com
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2168findstr /V /R "^teHtqRnWsCilZMvpf7f81a39-5f63-5b42-9efd-1f13b5431005quot; Appartiene.pptm C:\Windows\system32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\findstr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
Total events
3 928
Read events
3 685
Write events
242
Delete events
1

Modification events

(PID) Process:(688) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Value:
Adobe Acrobat Reader DC
(PID) Process:(688) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Windows\eHome\ehshell.exe
Value:
Windows Media Center
(PID) Process:(688) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Windows\system32\mspaint.exe
Value:
Paint
(PID) Process:(688) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Windows\system32\NOTEPAD.EXE
Value:
Notepad
(PID) Process:(688) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\PROGRA~1\MICROS~1\Office14\OIS.EXE
Value:
Microsoft Office 2010
(PID) Process:(688) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Opera\Opera.exe
Value:
Opera Internet Browser
(PID) Process:(688) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Windows Photo Viewer\PhotoViewer.dll
Value:
Windows Photo Viewer
(PID) Process:(688) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\VideoLAN\VLC\vlc.exe
Value:
VLC media player
(PID) Process:(688) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Value:
Microsoft Word
(PID) Process:(688) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
9
Suspicious files
10
Text files
253
Unknown types
12

Dropped files

PID
Process
Filename
Type
3440WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3440.5067\AlterCam-54-Crack-Keygen--License-Key-Free-Download\6006d4ca2f40f6006d4ca-files\6006d4ca2f40f6006d4ca_Read-Me-First.txt —
MD5:—
SHA256:—
3440WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3440.5067\AlterCam-54-Crack-Keygen--License-Key-Free-Download\6006d4ca2f40f6006d4ca-files\6006d4ca5fcc3_setup_files.zip —
MD5:—
SHA256:—
3440WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3440.5067\AlterCam-54-Crack-Keygen--License-Key-Free-Download\6006d4ca2f40f6006d4ca-files\6006d4ca2f40f6006d4ca-PASSWORD.txt —
MD5:—
SHA256:—
3440WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3440.5067\AlterCam-54-Crack-Keygen--License-Key-Free-Download\6006d4ca2f40f6006d4ca-files\6006d4ca2f40f6006d4ca-licensing.txt —
MD5:—
SHA256:—
3252setup_x86_x64_install.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\Chirurgo.vobtext
MD5:—
SHA256:—
3252setup_x86_x64_install.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\Fu.xltxtext
MD5:—
SHA256:—
3252setup_x86_x64_install.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\Appartiene.pptmbinary
MD5:—
SHA256:—
2972certutil.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\Le.bmptext
MD5:—
SHA256:—
3252setup_x86_x64_install.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\Esprime.avibinary
MD5:—
SHA256:—
328WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb328.11005\setup_x86_x64_install.exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
9
DNS requests
10
Threats
25

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2080
Ex.com
GET
302
45.142.215.107:80
http://dowhhap15.top/download.php?file=lv.exe
unknown
—
—
suspicious
4044
WScript.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
4044
WScript.exe
GET
200
151.139.128.14:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEGmjTouN%2FW5s3CDseaiw7qE%3D
US
der
471 b
whitelisted
2080
Ex.com
POST
200
193.38.55.86:80
http://morohfcajlrq02.top/index.php
unknown
text
3 b
malicious
2080
Ex.com
POST
200
89.235.184.199:80
http://ipgqbjcel17.top/index.php
RU
text
2 b
malicious
2080
Ex.com
GET
200
45.142.215.107:80
http://dowhhap15.top/downfiles/lv.exe
unknown
executable
5.17 Mb
suspicious
4076
vpn_ico.exe
GET
200
208.95.112.1:80
http://ip-api.com/json
unknown
text
273 b
malicious
3124
6_ico.exe
GET
200
208.95.112.1:80
http://ip-api.com/line
unknown
text
132 b
malicious
4044
WScript.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2080
Ex.com
89.235.184.199:80
ipgqbjcel17.top
MarComNet
RU
malicious
2080
Ex.com
193.38.55.86:80
ipgqbjcel17.top
—
—
malicious
2080
Ex.com
45.142.215.107:80
dowhhap15.top
—
—
suspicious
4076
vpn_ico.exe
208.95.112.1:80
ip-api.com
IBURST
—
malicious
3124
6_ico.exe
208.95.112.1:80
ip-api.com
IBURST
—
malicious
4044
WScript.exe
88.99.66.31:443
iplogger.org
Hetzner Online GmbH
DE
malicious
4044
WScript.exe
151.139.128.14:80
ocsp.comodoca.com
Highwinds Network Group, Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
fmpRVGWxRGycqfZCtRROTYRbHzT.fmpRVGWxRGycqfZCtRROTYRbHzT
  • —
unknown
ipgqbjcel17.top
  • 89.235.184.199
  • 193.38.55.86
malicious
morohfcajlrq02.top
  • 193.38.55.86
  • 89.235.184.199
malicious
dowhhap15.top
  • 45.142.215.107
  • 78.155.205.61
suspicious
ip-api.com
  • 208.95.112.1
malicious
iplogger.org
  • 88.99.66.31
shared
ocsp.comodoca.com
  • 151.139.128.14
whitelisted
ocsp.usertrust.com
  • 151.139.128.14
whitelisted
ocsp.sectigo.com
  • 151.139.128.14
whitelisted

Threats

PID
Process
Class
Message
1052
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2080
Ex.com
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
2080
Ex.com
A Network Trojan was detected
STEALER [PTsecurity] Possible Exfiltration Action (POST Zip Archive)
2080
Ex.com
A Network Trojan was detected
STEALER [PTsecurity] Possible Exfiltration Action (POST Zip Archive)
2080
Ex.com
A Network Trojan was detected
ET TROJAN Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
2080
Ex.com
A Network Trojan was detected
STEALER [PTsecurity] Possible Exfiltration Action (POST Zip Archive)
2080
Ex.com
A Network Trojan was detected
ET CURRENT_EVENTS SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016
2080
Ex.com
A Network Trojan was detected
ET CURRENT_EVENTS SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016
2080
Ex.com
Potentially Bad Traffic
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
2080
Ex.com
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
10 ETPRO signatures available at the full report
Process
Message
4_ico.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
6_ico.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
vpn_ico.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
SmartClock.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
6006d4ca6d518__AlterCam-54-Crack-Keygen--License-Key-Free-Download.zip