File name:

Spectaculator.v8.0.Incl.Keygen-Lz0.rar

Full analysis: https://app.any.run/tasks/fdbc003c-eb1d-4dcd-a7d9-e9f3e2c80521
Verdict: Malicious activity
Analysis date: June 18, 2023, 12:54:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v2.0, os: Unix
MD5:

2F117C1B5A4C04A2A707573A0D0010F1

SHA1:

87781B3561EA0DA3E22480DDFE173F89851C5147

SHA256:

92F0F5409B547C57CB0EE65DC4D7A18EB1D868ED7673C35F821FD9889C5739C4

SSDEEP:

98304:lr4Iq5UC/RO+7QFA87AGBbtiGRBKPTKqnmzEM:NUn/RP7WAyhbtiGR6WqnfM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • msiexec.exe (PID: 3068)
      • msiexec.exe (PID: 2288)
      • Spectaculator.exe (PID: 2816)
      • Spectaculator.exe (PID: 2180)
      • Spectaculator.exe (PID: 1912)

    • Application was dropped or rewritten from another process

      • keygen.exe (PID: 3968)
      • SpecStub.exe (PID: 1252)
      • Spectaculator.exe (PID: 3016)
      • Spectaculator.exe (PID: 2816)
      • Spectaculator.exe (PID: 3400)
      • Spectaculator.exe (PID: 2180)
      • SpecStub.exe (PID: 2076)
      • Spectaculator.exe (PID: 3468)
      • Spectaculator.exe (PID: 1912)

  • SUSPICIOUS

    • Application launched itself

      • WinRAR.exe (PID: 2544)
      • WinRAR.exe (PID: 2796)
      • Spectaculator.exe (PID: 3016)
      • Spectaculator.exe (PID: 3400)
      • Spectaculator.exe (PID: 2816)
      • Spectaculator.exe (PID: 3468)

    • Executes as Windows Service

      • VSSVC.exe (PID: 3784)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 2504)

    • Detected use of alternative data streams (AltDS)

      • msiexec.exe (PID: 2288)
      • Spectaculator.exe (PID: 2816)
      • Spectaculator.exe (PID: 2180)
      • Spectaculator.exe (PID: 1912)

    • Reads the BIOS version

      • msiexec.exe (PID: 2288)
      • Spectaculator.exe (PID: 2816)
      • Spectaculator.exe (PID: 2180)
      • Spectaculator.exe (PID: 1912)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3820)
      • msiexec.exe (PID: 2388)
      • msiexec.exe (PID: 2504)

    • Checks supported languages

      • msiexec.exe (PID: 2504)
      • msiexec.exe (PID: 3068)
      • msiexec.exe (PID: 2288)
      • keygen.exe (PID: 3968)
      • SpecStub.exe (PID: 1252)
      • Spectaculator.exe (PID: 3016)
      • Spectaculator.exe (PID: 2816)
      • Spectaculator.exe (PID: 3400)
      • Spectaculator.exe (PID: 2180)
      • SpecStub.exe (PID: 2076)
      • Spectaculator.exe (PID: 3468)
      • Spectaculator.exe (PID: 1912)

    • The process checks LSA protection

      • msiexec.exe (PID: 2504)
      • msiexec.exe (PID: 2388)
      • msiexec.exe (PID: 3068)
      • VSSVC.exe (PID: 3784)
      • msiexec.exe (PID: 2288)
      • Spectaculator.exe (PID: 2180)
      • Spectaculator.exe (PID: 1912)

    • Application launched itself

      • msiexec.exe (PID: 2504)
      • chrome.exe (PID: 1040)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 3068)
      • msiexec.exe (PID: 2504)
      • msiexec.exe (PID: 2288)
      • Spectaculator.exe (PID: 2180)
      • Spectaculator.exe (PID: 1912)

    • Manual execution by a user

      • msiexec.exe (PID: 2388)
      • SpecStub.exe (PID: 1252)
      • keygen.exe (PID: 3968)
      • notepad.exe (PID: 2736)
      • SpecStub.exe (PID: 2076)
      • chrome.exe (PID: 1040)

    • Reads the computer name

      • msiexec.exe (PID: 3068)
      • msiexec.exe (PID: 2504)
      • keygen.exe (PID: 3968)
      • msiexec.exe (PID: 2288)
      • Spectaculator.exe (PID: 2816)
      • Spectaculator.exe (PID: 2180)
      • Spectaculator.exe (PID: 1912)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 2388)

    • Create files in a temporary directory

      • msiexec.exe (PID: 2504)

    • Creates files in the program directory

      • Spectaculator.exe (PID: 2816)

    • Creates files or folders in the user directory

      • Spectaculator.exe (PID: 2180)
      • Spectaculator.exe (PID: 1912)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

ArchivedFileName: Spectaculator.v8.0.Incl.Keygen-Lz0\linezer0.nfo
PackingMethod: Stored
ModifyDate: 2013:01:19 07:57:48
OperatingSystem: Unix
UncompressedSize: 24814
CompressedSize: 24884
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
101
Monitored processes
58
Malicious processes
12
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe no specs winrar.exe msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs msiexec.exe keygen.exe no specs notepad.exe no specs specstub.exe no specs spectaculator.exe spectaculator.exe no specs spectaculator.exe spectaculator.exe no specs specstub.exe no specs spectaculator.exe spectaculator.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
452"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=880,1923266466735472522,8398665086163468587,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=532 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
780"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=880,1923266466735472522,8398665086163468587,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1124 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
1008"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=880,1923266466735472522,8398665086163468587,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3584 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
1040"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\winmm.dll
c:\windows\system32\gdi32.dll
1092"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=880,1923266466735472522,8398665086163468587,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2708 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
1116"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=880,1923266466735472522,8398665086163468587,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2976 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
1252"C:\Program Files\Spectaculator\SpecStub.exe" C:\Program Files\Spectaculator\SpecStub.exe—explorer.exe
User:
admin
Company:
spectaculator.com
Integrity Level:
MEDIUM
Description:
Spectaculator ZX Spectrum Emulator
Exit code:
0
Version:
8.0.0.3092
Modules
Images
c:\program files\spectaculator\specstub.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
1352"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=880,1923266466735472522,8398665086163468587,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3556 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
1560"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=880,1923266466735472522,8398665086163468587,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3584 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\msvcrt.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\version.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\user32.dll
1572"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=880,1923266466735472522,8398665086163468587,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3352 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
Total events
28 404
Read events
28 083
Write events
301
Delete events
20

Modification events

(PID) Process:(2544) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2544) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2544) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2544) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2544) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2544) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2544) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2544) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2544) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2544) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
40
Suspicious files
173
Text files
138
Unknown types
0

Dropped files

PID
Process
Filename
Type
3820WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3820.38743\spectaculator80.msi —
MD5:—
SHA256:—
2504msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
2504msiexec.exeC:\Windows\Installer\11e471.msi —
MD5:—
SHA256:—
3820WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3820.38743\Lz0\keygen.exeexecutable
MD5:A207C5D5DDF65B0A19D666DD89EA30D3
SHA256:492A9C4531CD85F8F490C7E6B8E52AB529E6F3E2F257D52E5824BAF0D8BCD211
2388msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIB8ED.tmpexecutable
MD5:84FE6543A5357793615375E62914C76A
SHA256:E8BE4BEBBEC150DEA0FFFE4AD32DD4B7F2A2CEE317EFB3FE8F127E49E64794E7
2544WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa2544.38212\lzqdcsu1.zipcompressed
MD5:E2CFAA0E20CB9ADF0809F2EEDD7290EB
SHA256:07EF6BF27F85FA192DECA16D18819070742B6E682C770D219E7A4D5B784BB76B
2504msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:B4403FEEA3B08FADAE36E690D207154D
SHA256:DED789BCF0960B62A62BDDCCDE45DCF2B337D1C5F1622F9DDF426E3B8330E727
2796WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa2796.38345\linezer0.rarcompressed
MD5:7A82FD663A45234926B4B3EC238A288D
SHA256:D556085CEE22AF01692BE7F187FDFE3404F765800BE4BB5838E55858AF9959EB
2504msiexec.exeC:\System Volume Information\SPP\OnlineMetadataCache\{4e3f8ee4-f3c9-416f-84a9-48d7f8f27383}_OnDiskSnapshotPropbinary
MD5:B4403FEEA3B08FADAE36E690D207154D
SHA256:DED789BCF0960B62A62BDDCCDE45DCF2B337D1C5F1622F9DDF426E3B8330E727
2504msiexec.exeC:\Windows\Installer\11e472.ipibinary
MD5:66954CDC43566C36C7F462CB366219A9
SHA256:3659EEB7B74CD91058F10FAA55C1CD4D6F82C375954827D5AFA853EB89CAF474
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
52
DNS requests
28
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2428
chrome.exe
GET
301
188.114.97.3:80
http://sharedrop.io/
US
—
—
malicious
852
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvMjg0QUFYSnN4MFUtaEQwNDZqVGRkVkFmZw/1.0.6.0_aemomkdncapdnfajjbbcbdebjljbpmpj.crx
US
crx
2.81 Kb
whitelisted
852
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvMjg0QUFYSnN4MFUtaEQwNDZqVGRkVkFmZw/1.0.6.0_aemomkdncapdnfajjbbcbdebjljbpmpj.crx
US
binary
3.84 Kb
whitelisted
852
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/YGkwa4MXjfWSuERyWQYP_A_4/aapLKTSZ439A-0g3nqJr3Q
US
binary
3.84 Kb
whitelisted
852
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvMjg0QUFYSnN4MFUtaEQwNDZqVGRkVkFmZw/1.0.6.0_aemomkdncapdnfajjbbcbdebjljbpmpj.crx
US
binary
5.44 Kb
whitelisted
2428
chrome.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D
US
binary
471 b
whitelisted
2428
chrome.exe
GET
200
67.27.158.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5ff400915d9e9fd4
US
compressed
4.70 Kb
whitelisted
852
svchost.exe
GET
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/cxpsjblnoxgjoqggdsbvujtof4_58/khaoiebndkojlmppeemjhbpbandiljpe_58_win_advr4ucepztwtigvw3fduftsvbeq.crx3
US
crx
5.46 Kb
whitelisted
852
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/cxpsjblnoxgjoqggdsbvujtof4_58/khaoiebndkojlmppeemjhbpbandiljpe_58_win_advr4ucepztwtigvw3fduftsvbeq.crx3
US
crx
3.72 Kb
whitelisted
852
svchost.exe
GET
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/YGkwa4MXjfWSuERyWQYP_A_4/aapLKTSZ439A-0g3nqJr3Q
US
crx
3.72 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1076
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
568
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2428
chrome.exe
216.58.212.141:443
accounts.google.com
GOOGLE
US
whitelisted
1040
chrome.exe
239.255.255.250:1900
—
—
—
whitelisted
2428
chrome.exe
172.217.16.206:443
clients2.google.com
GOOGLE
US
whitelisted
2428
chrome.exe
142.250.186.68:443
www.google.com
GOOGLE
US
whitelisted
2428
chrome.exe
172.217.16.129:443
clients2.googleusercontent.com
GOOGLE
US
whitelisted
2428
chrome.exe
142.250.185.234:443
fonts.googleapis.com
GOOGLE
US
whitelisted
2428
chrome.exe
142.250.186.99:443
www.gstatic.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
www.google.com
  • 142.250.186.68
malicious
accounts.google.com
  • 216.58.212.141
shared
clients2.google.com
  • 172.217.16.206
whitelisted
clients2.googleusercontent.com
  • 172.217.16.129
whitelisted
fonts.googleapis.com
  • 142.250.185.234
whitelisted
www.gstatic.com
  • 142.250.186.99
whitelisted
fonts.gstatic.com
  • 216.58.212.163
whitelisted
apis.google.com
  • 216.58.212.142
whitelisted
clientservices.googleapis.com
  • 142.250.185.67
whitelisted
encrypted-tbn0.gstatic.com
  • 142.250.185.238
whitelisted

Threats

No threats detected
Process
Message
msiexec.exe
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
msiexec.exe
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
Spectaculator.exe
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
Spectaculator.exe
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
Spectaculator.exe
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
Spectaculator.exe
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
Spectaculator.exe
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
Spectaculator.exe
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Spectaculator.v8.0.Incl.Keygen-Lz0.rar