URL:

https://www.moddb.com/mods/carnivores-legacy/downloads/carnivores-legacy-v10

Full analysis: https://app.any.run/tasks/d891ca89-cdc0-4654-b98a-7e73f4d24f3c
Verdict: Malicious activity
Analysis date: December 03, 2023, 00:21:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

438C80BE9182458405772295F6F8D409

SHA1:

D051CA5D95AEA5B1980C52CC9E6443CDD0B0B3B5

SHA256:

9F6DA2F9F4E4FDA234E34ACD5FEC528637D158FE68682BDC0C1987817C5A681F

SSDEEP:

3:N8DSLxBadKGEOKUtE1XKTOKUtEF:2OL6ddW1aHF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2144)

    • Reads the computer name

      • wmpnscfg.exe (PID: 2668)

    • Checks supported languages

      • wmpnscfg.exe (PID: 2668)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2668)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
3
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1584"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2144 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2144"C:\Program Files\Internet Explorer\iexplore.exe" "https://www.moddb.com/mods/carnivores-legacy/downloads/carnivores-legacy-v10"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2668"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
18 260
Read events
18 195
Write events
63
Delete events
2

Modification events

(PID) Process:(2144) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(2144) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(2144) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(2144) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2144) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2144) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2144) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2144) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2144) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2144) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
37
Text files
65
Unknown types
0

Dropped files

PID
Process
Filename
Type
1584iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:A7AD5CEFA1A2D8B54EC271C7FDA9B023
SHA256:064DB3735E3EA881CD42A55B691D8A66030C9CE043A95FC17974FB3ADE06B78A
1584iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\5X9A3JUV.txttext
MD5:C0D2B2F3516D896F5164F89BBA3343C0
SHA256:E8D2AE5D7EAC12C9551A8584F944E32BAB2A3748DBDF0C6F2AF1054004294C8E
1584iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:A75A589E15081BBC3F7BE1BCFA700A69
SHA256:D281EDB7C6B59153FDFF3E3B392C18600E6D7429E4D1803346FE209180FCF048
1584iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
1584iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\carnivores-legacy-v10[1].htmhtml
MD5:C33DFE1FED1AA771ABA2CD9C18549B82
SHA256:8C9D8B6993AB24744805ABC1D95BAFC3FC8F84FAC27324831BE99E484712BA94
1584iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\guest7[1].pngimage
MD5:FDA6684BD3ACADEC444AF5D2CED2D57F
SHA256:938ADE58AC883C062EB15C20B5A216D80F1A328F8CCC46E1B482C063B5CBB57E
1584iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\Klombo_and_klomberry[1].pngimage
MD5:88AA92B7B4076C489B0E3FE1ED5DE887
SHA256:5BE4AD696B014FBE83F686AAD810C4EE00D904E679A0F92056665A661539CEEA
1584iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:2F5C9C12E409FD813677699911FDE24F
SHA256:741529AF73FB0231BF307378372EBCB061CB83252A2C0AABD0DA4F6E57F326E2
1584iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\guest2[1].pngimage
MD5:F7A2E6746B6006F989743A076634F56E
SHA256:F61830841CD32B4D355CF7BA474E094A8B181229813F2B758FBF8DAB0903251B
1584iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\btn_search_box[1].pngimage
MD5:46F2952ACF8FC427154FE6D87E43CDEF
SHA256:1F0997571F8D78242DEC288A0C9F433921577132C335B0916D1CEFF610FFFFFB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
66
DNS requests
28
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1584
iexplore.exe
GET
200
23.212.210.158:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
1584
iexplore.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEFQk2SKBwSEsDLSjaFDeg1s%3D
unknown
binary
471 b
unknown
1584
iexplore.exe
GET
200
23.212.210.158:80
http://x2.c.lencr.org/
unknown
binary
300 b
unknown
1584
iexplore.exe
GET
200
184.24.77.202:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?02faf822908f8dc6
unknown
compressed
4.66 Kb
unknown
1584
iexplore.exe
GET
200
184.24.77.202:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5b363f4d4281751e
unknown
compressed
4.66 Kb
unknown
1584
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
unknown
binary
1.47 Kb
unknown
1584
iexplore.exe
GET
—
184.24.77.202:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?b2ac00b319b24bc9
unknown
—
—
unknown
1584
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
binary
724 b
unknown
1584
iexplore.exe
GET
—
184.24.77.202:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?670410f8a5996d9a
unknown
—
—
unknown
1584
iexplore.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
binary
1.42 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1584
iexplore.exe
104.26.13.171:443
www.moddb.com
CLOUDFLARENET
US
unknown
1584
iexplore.exe
184.24.77.202:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
1584
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1584
iexplore.exe
104.22.34.123:443
static.kueezrtb.com
CLOUDFLARENET
—
unknown
1584
iexplore.exe
104.18.41.170:443
0f73e92f-4074-4fe3-85d3-ed3fc969859e.edge.permutive.app
CLOUDFLARENET
—
shared
1584
iexplore.exe
172.64.152.129:443
mod.io
CLOUDFLARENET
US
unknown
1584
iexplore.exe
104.26.12.171:443
www.moddb.com
CLOUDFLARENET
US
unknown
1584
iexplore.exe
13.32.99.20:443
live.primis.tech
AMAZON-02
US
unknown
1584
iexplore.exe
185.14.184.154:443
geo.cookie-script.com
DIGITALOCEAN-ASN
NL
unknown
1584
iexplore.exe
142.250.186.168:443
www.googletagmanager.com
GOOGLE
US
unknown

DNS requests

Domain
IP
Reputation
www.moddb.com
  • 104.26.13.171
  • 104.26.12.171
  • 172.67.70.78
unknown
ctldl.windowsupdate.com
  • 184.24.77.202
  • 184.24.77.194
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
static.moddb.com
  • 104.26.13.171
  • 172.67.70.78
  • 104.26.12.171
unknown
static.kueezrtb.com
  • 104.22.34.123
  • 104.22.35.123
  • 172.67.21.232
unknown
0f73e92f-4074-4fe3-85d3-ed3fc969859e.edge.permutive.app
  • 104.18.41.170
  • 172.64.146.86
unknown
mod.io
  • 172.64.152.129
  • 104.18.35.127
unknown
media.moddb.com
  • 104.26.12.171
  • 104.26.13.171
  • 172.67.70.78
unknown
live.primis.tech
  • 13.32.99.20
  • 13.32.99.81
  • 13.32.99.61
  • 13.32.99.104
malicious
geo.cookie-script.com
  • 185.14.184.154
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.moddb.com/mods/carnivores-legacy/downloads/carnivores-legacy-v10