URL:

https://www.moddb.com/mods/carnivores-legacy/downloads/carnivores-legacy-v10

Full analysis: https://app.any.run/tasks/d891ca89-cdc0-4654-b98a-7e73f4d24f3c
Verdict: Malicious activity
Analysis date: December 03, 2023, 00:21:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

438C80BE9182458405772295F6F8D409

SHA1:

D051CA5D95AEA5B1980C52CC9E6443CDD0B0B3B5

SHA256:

9F6DA2F9F4E4FDA234E34ACD5FEC528637D158FE68682BDC0C1987817C5A681F

SSDEEP:

3:N8DSLxBadKGEOKUtE1XKTOKUtEF:2OL6ddW1aHF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2668)

    • Reads the computer name

      • wmpnscfg.exe (PID: 2668)

    • Checks supported languages

      • wmpnscfg.exe (PID: 2668)

    • Application launched itself

      • iexplore.exe (PID: 2144)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
3
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1584"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2144 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2144"C:\Program Files\Internet Explorer\iexplore.exe" "https://www.moddb.com/mods/carnivores-legacy/downloads/carnivores-legacy-v10"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2668"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
18 260
Read events
18 195
Write events
63
Delete events
2

Modification events

(PID) Process:(2144) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(2144) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(2144) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(2144) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2144) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2144) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2144) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2144) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2144) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2144) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
37
Text files
65
Unknown types
0

Dropped files

PID
Process
Filename
Type
1584iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
1584iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\XDJMKQN0.txttext
MD5:F399E7EC62EC451C9F00F57EEDBE53A2
SHA256:55D11975DC5531F5DDBA1CF8CF9FBA5E25EEEE773F8A13FB9A9E47E1347BA673
1584iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\0f73e92f-4074-4fe3-85d3-ed3fc969859e-web[1].jstext
MD5:F0698AC215B2D50851E7103178BFE36C
SHA256:CB25CAC50B84E8E21474C9D4AD46B91230A6218018C250CC0A2AFEE2E364A63A
1584iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:2F5C9C12E409FD813677699911FDE24F
SHA256:741529AF73FB0231BF307378372EBCB061CB83252A2C0AABD0DA4F6E57F326E2
1584iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\jp_tyrannosaurus_rex_carnivores[1].pngimage
MD5:1A3D13DBBF89F58B4EF73D7791201B47
SHA256:B3E8722C0E7553283A5BCD21CCA6633B2833E7201F56AF7FF12CF7935ED5062A
1584iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\Screenshot_2023-11-19_170454.1[1].pngimage
MD5:D92166391D267B4BB986B58DAF835C78
SHA256:DB5875DED5EE3EEA899CB8F2983119586585265D1450B0563CD2701FA2C9C257
1584iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:C8938996C81DAB86541645A0D93C0895
SHA256:F408CC396699F62DC0BB34CB6D1EDBAB9B2E594640C25076963C8BB24BDB18C1
1584iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\5X9A3JUV.txttext
MD5:C0D2B2F3516D896F5164F89BBA3343C0
SHA256:E8D2AE5D7EAC12C9551A8584F944E32BAB2A3748DBDF0C6F2AF1054004294C8E
1584iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\guest7[1].pngimage
MD5:FDA6684BD3ACADEC444AF5D2CED2D57F
SHA256:938ADE58AC883C062EB15C20B5A216D80F1A328F8CCC46E1B482C063B5CBB57E
1584iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:A75A589E15081BBC3F7BE1BCFA700A69
SHA256:D281EDB7C6B59153FDFF3E3B392C18600E6D7429E4D1803346FE209180FCF048
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
66
DNS requests
28
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1584
iexplore.exe
GET
200
184.24.77.202:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?02faf822908f8dc6
unknown
compressed
4.66 Kb
unknown
1584
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
unknown
binary
1.47 Kb
unknown
1584
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
binary
724 b
unknown
1584
iexplore.exe
GET
200
184.24.77.202:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?9535df534679ea01
unknown
compressed
65.2 Kb
unknown
1584
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
1584
iexplore.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
unknown
binary
2.18 Kb
unknown
1584
iexplore.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
binary
1.42 Kb
unknown
1584
iexplore.exe
GET
200
23.212.210.158:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
1584
iexplore.exe
GET
200
184.24.77.202:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5b363f4d4281751e
unknown
compressed
4.66 Kb
unknown
1584
iexplore.exe
GET
—
184.24.77.202:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?b2ac00b319b24bc9
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1584
iexplore.exe
104.26.13.171:443
www.moddb.com
CLOUDFLARENET
US
unknown
1584
iexplore.exe
184.24.77.202:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
1584
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1584
iexplore.exe
104.22.34.123:443
static.kueezrtb.com
CLOUDFLARENET
—
unknown
1584
iexplore.exe
104.18.41.170:443
0f73e92f-4074-4fe3-85d3-ed3fc969859e.edge.permutive.app
CLOUDFLARENET
—
shared
1584
iexplore.exe
172.64.152.129:443
mod.io
CLOUDFLARENET
US
unknown
1584
iexplore.exe
104.26.12.171:443
www.moddb.com
CLOUDFLARENET
US
unknown
1584
iexplore.exe
13.32.99.20:443
live.primis.tech
AMAZON-02
US
unknown
1584
iexplore.exe
185.14.184.154:443
geo.cookie-script.com
DIGITALOCEAN-ASN
NL
unknown
1584
iexplore.exe
142.250.186.168:443
www.googletagmanager.com
GOOGLE
US
unknown

DNS requests

Domain
IP
Reputation
www.moddb.com
  • 104.26.13.171
  • 104.26.12.171
  • 172.67.70.78
unknown
ctldl.windowsupdate.com
  • 184.24.77.202
  • 184.24.77.194
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
static.moddb.com
  • 104.26.13.171
  • 172.67.70.78
  • 104.26.12.171
unknown
static.kueezrtb.com
  • 104.22.34.123
  • 104.22.35.123
  • 172.67.21.232
unknown
0f73e92f-4074-4fe3-85d3-ed3fc969859e.edge.permutive.app
  • 104.18.41.170
  • 172.64.146.86
unknown
mod.io
  • 172.64.152.129
  • 104.18.35.127
unknown
media.moddb.com
  • 104.26.12.171
  • 104.26.13.171
  • 172.67.70.78
unknown
live.primis.tech
  • 13.32.99.20
  • 13.32.99.81
  • 13.32.99.61
  • 13.32.99.104
malicious
geo.cookie-script.com
  • 185.14.184.154
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.moddb.com/mods/carnivores-legacy/downloads/carnivores-legacy-v10