File name:

PhotoshopCS6Portable.exe

Full analysis: https://app.any.run/tasks/3fcce6e9-df37-467b-a7e0-fc72f5778bcf
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: January 08, 2024, 10:13:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
xworm
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

8C59765B5462FC6F7A0C99DDB058AE8A

SHA1:

91E0EF8F0BB753EF12678917BB4D187B949F4D1E

SHA256:

AB5943F11C2DEEBD2BFAA20AF9EEC98756CB10F0E0D02B8E37F0601BA3BC6118

SSDEEP:

1536:6QpQ5EP0ijnRTXJUQIQQQJQSOb4fy56nwQX3CN0sWutCOWpK4znC9D:6QIURTXJUQIQQQJQDb+y56nwQX3CN0st

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • XWORM has been detected (YARA)

      • XClient.exe (PID: 2424)

    • Steals credentials from Web Browsers

      • Insidious.exe (PID: 2748)
      • Insidious.exe (PID: 968)

    • Actions looks like stealing of personal data

      • Insidious.exe (PID: 2748)
      • Insidious.exe (PID: 968)

  • SUSPICIOUS

    • Reads the Internet Settings

      • XClient.exe (PID: 1632)
      • XClient.exe (PID: 2424)
      • Insidious.exe (PID: 2748)
      • Insidious.exe (PID: 968)

    • Reads browser cookies

      • Insidious.exe (PID: 2748)

    • Loads DLL from Mozilla Firefox

      • Insidious.exe (PID: 2748)
      • Insidious.exe (PID: 968)

    • Reads settings of System Certificates

      • Insidious.exe (PID: 2748)
      • Insidious.exe (PID: 968)

  • INFO

    • Reads the computer name

      • PhotoshopCS6Portable.exe (PID: 2208)
      • XClient.exe (PID: 1632)
      • XClient.exe (PID: 2424)
      • Insidious.exe (PID: 968)
      • Insidious.exe (PID: 2748)

    • Drops the executable file immediately after the start

      • PhotoshopCS6Portable.exe (PID: 2208)

    • Checks supported languages

      • PhotoshopCS6Portable.exe (PID: 2208)
      • XClient.exe (PID: 1632)
      • XClient.exe (PID: 2424)
      • Insidious.exe (PID: 2748)
      • Insidious.exe (PID: 968)

    • Create files in a temporary directory

      • PhotoshopCS6Portable.exe (PID: 2208)
      • Insidious.exe (PID: 2748)
      • Insidious.exe (PID: 968)

    • Reads the machine GUID from the registry

      • XClient.exe (PID: 1632)
      • XClient.exe (PID: 2424)
      • Insidious.exe (PID: 2748)
      • Insidious.exe (PID: 968)

    • Manual execution by a user

      • XClient.exe (PID: 1632)
      • XClient.exe (PID: 2424)
      • Insidious.exe (PID: 2748)
      • Insidious.exe (PID: 968)
      • taskmgr.exe (PID: 3124)
      • taskmgr.exe (PID: 3188)

    • Reads Environment values

      • XClient.exe (PID: 1632)
      • XClient.exe (PID: 2424)
      • Insidious.exe (PID: 2748)
      • Insidious.exe (PID: 968)

    • Checks for external IP

      • XClient.exe (PID: 1632)
      • XClient.exe (PID: 2424)

    • Creates files in the program directory

      • Insidious.exe (PID: 2748)

    • Steals credentials

      • Insidious.exe (PID: 2748)
      • Insidious.exe (PID: 968)

    • Reads CPU info

      • Insidious.exe (PID: 2748)
      • Insidious.exe (PID: 968)

    • Creates files or folders in the user directory

      • Insidious.exe (PID: 968)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

XWorm

(PID) Process(2424) XClient.exe
C2127.0.0.1,5.tcp.eu.ngrok.io,4.tcp.eu.ngrok.io:13152
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameXWorm V5.2
MutexNleNvfXaePDDITvq
No Malware configuration.

TRiD

.exe | NSIS - Nullsoft Scriptable Install System (94.8)
.exe | Win32 Executable MS Visual C++ (generic) (3.4)
.dll | Win32 Dynamic Link Library (generic) (0.7)
.exe | Win32 Executable (generic) (0.5)
.exe | Generic Win/DOS Executable (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2009:12:05 23:50:46+01:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 23552
InitializedDataSize: 119808
UninitializedDataSize: 1024
EntryPoint: 0x323c
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Windows, Latin1
Comments: Allows Adobe Photoshop CS6 to be run from a removable drive. For additional details, visit http://portableappz.blogspot.com
CompanyName: PortableAppZ.blogspot.com
FileDescription: Adobe Photoshop CS6 Portable
FileVersion: 0.0.0.0
InternalName: Adobe Photoshop CS6 Portable
LegalCopyright: Bernat
LegalTrademarks: PortableAppZ is a Trademark of Bernat
OriginalFileName: PhotoshopCS6Portable.exe
ProductName: Adobe Photoshop CS6 Portable
ProductVersion: 0.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
60
Monitored processes
8
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start photoshopcs6portable.exe xclient.exe #XWORM xclient.exe insidious.exe insidious.exe taskmgr.exe no specs taskmgr.exe no specs photoshopcs6portable.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
968"C:\Users\admin\Desktop\Insidious.exe" C:\Users\admin\Desktop\Insidious.exe
explorer.exe
User:
admin
Company:
44 CALIBER
Integrity Level:
HIGH
Description:
44 CALIBER
Exit code:
0
Version:
1.6.2.0
Modules
Images
c:\users\admin\desktop\insidious.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1632"C:\Users\admin\Desktop\XClient.exe" C:\Users\admin\Desktop\XClient.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
2148734499
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\xclient.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2044"C:\Users\admin\AppData\Local\Temp\PhotoshopCS6Portable.exe" C:\Users\admin\AppData\Local\Temp\PhotoshopCS6Portable.exe—explorer.exe
User:
admin
Company:
PortableAppZ.blogspot.com
Integrity Level:
MEDIUM
Description:
Adobe Photoshop CS6 Portable
Exit code:
3221226540
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\photoshopcs6portable.exe
c:\windows\system32\ntdll.dll
2208"C:\Users\admin\AppData\Local\Temp\PhotoshopCS6Portable.exe" C:\Users\admin\AppData\Local\Temp\PhotoshopCS6Portable.exe
explorer.exe
User:
admin
Company:
PortableAppZ.blogspot.com
Integrity Level:
HIGH
Description:
Adobe Photoshop CS6 Portable
Exit code:
2
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\photoshopcs6portable.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2424"C:\Users\admin\Desktop\XClient.exe" C:\Users\admin\Desktop\XClient.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Exit code:
2148734499
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\xclient.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
XWorm
(PID) Process(2424) XClient.exe
C2127.0.0.1,5.tcp.eu.ngrok.io,4.tcp.eu.ngrok.io:13152
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameXWorm V5.2
MutexNleNvfXaePDDITvq
2748"C:\Users\admin\Desktop\Insidious.exe" C:\Users\admin\Desktop\Insidious.exe
explorer.exe
User:
admin
Company:
44 CALIBER
Integrity Level:
HIGH
Description:
44 CALIBER
Exit code:
0
Version:
1.6.2.0
Modules
Images
c:\users\admin\desktop\insidious.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3124"C:\Windows\system32\taskmgr.exe" /4C:\Windows\System32\taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3188"C:\Windows\system32\taskmgr.exe" /4C:\Windows\System32\taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
8 576
Read events
8 544
Write events
32
Delete events
0

Modification events

(PID) Process:(2748) Insidious.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(968) Insidious.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3124) taskmgr.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\TaskManager
Operation:writeName:UsrColumnSettings
Value:
1C0C0000340400000000000050000000010000001D0C0000350400000000000023000000010000001E0C000036040000000000003C000000010000001F0C000039040000000000004E00000001000000200C000037040000000000004E00000001000000
(PID) Process:(3124) taskmgr.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\TaskManager
Operation:writeName:Preferences
Value:
30030000E803000001000000010000004401000077000000DC0200005C0200000300000001000000000000000000000001000000000000000100000000000000000000000200000004000000090000001D000000FFFFFFFF00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009C00000040000000210000004600000052000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000002000000010000000300000004000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0500000000000000FFFFFFFF00000000020000000300000004000000FFFFFFFF00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000630060003C005A00FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000000000010000000200000003000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0400000000000000FFFFFFFF02000000FFFFFFFF4F00000028000000970000003400000050000000000000000100000002000000030000000400000000000000FFFFFFFF43000000000000000000000001000000
(PID) Process:(3188) taskmgr.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\TaskManager
Operation:writeName:UsrColumnSettings
Value:
1C0C0000340400000000000050000000010000001D0C0000350400000000000023000000010000001E0C000036040000000000003C000000010000001F0C000039040000000000004E00000001000000200C000037040000000000004E00000001000000
(PID) Process:(3188) taskmgr.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\TaskManager
Operation:writeName:Preferences
Value:
30030000E803000001000000010000004401000077000000DC0200005C0200000100000001000000000000000000000001000000000000000100000000000000000000000200000004000000090000001D000000FFFFFFFF00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009C00000040000000210000004600000052000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000000002000000010000000300000004000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0500000000000000FFFFFFFF00000000020000000300000004000000FFFFFFFF00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000630060003C005A00FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF000000000000010000000200000003000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0400000000000000FFFFFFFF02000000FFFFFFFF4F00000028000000970000003400000050000000000000000100000002000000030000000400000000000000FFFFFFFF43000000000000000000000001000000
Executable files
0
Suspicious files
21
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
2748Insidious.exeC:\Users\admin\AppData\Local\Temp\tmp6A3A.tmp.tmpdb —
MD5:—
SHA256:—
2748Insidious.exeC:\Users\admin\AppData\Local\Temp\tmp6A5A.tmp.datbinary
MD5:F47EB60CDF981C17722D0CE740129927
SHA256:0210071DF12CA42D70DCB679926668AE072264705AC139A24F94BBC5A129DD8F
968Insidious.exeC:\Users\admin\AppData\Local\Temp\tmpAB3B.tmp.tmpdb —
MD5:—
SHA256:—
2748Insidious.exeC:\Users\Public\qldyz51w.default\key4.dbbinary
MD5:F62D8E993EA9C3B3A89DA19E4012638D
SHA256:0971230A77EE2C3531E8B97E14954692713D5F7C8684788F4A823BBC05AD377A
2748Insidious.exeC:\Users\admin\AppData\Local\Temp\tmp6A8A.tmp.datbinary
MD5:52E51471E9281235323F633CD0DEA56C
SHA256:147F3137B387FE4FBE3215B7864568404580A799D031009FE9C718F4C2EF87D0
2748Insidious.exeC:\Users\Public\qldyz51w.default\cert9.dbbinary
MD5:ABD01A62C4D5F31D0B0A9474DEB33DD1
SHA256:77EC9DE5C309DC06D88FFA2D38148DA637637B145EC35CFE2EDBDC3148D56128
2748Insidious.exeC:\Users\admin\AppData\Local\Temp\tmp6B1A.tmp.datbinary
MD5:03EF1C0012EE77CDA2C2CB36DFBDA123
SHA256:800D734016D8FBCDE263D8CD2411167406C544FC090A5DCBD2D374CABF918B86
2748Insidious.exeC:\ProgramData\44\Passwords.txttext
MD5:A37DD22710F86F9D5C6809086C5A4AB6
SHA256:185E064F80DD71863EE5E1B224ECC21EC30B9CFBF0BC24891AFDB1CB8A05A29B
2748Insidious.exeC:\ProgramData\44\Screen.pngimage
MD5:C1D43A1257997CF26DFEA85EAF013A67
SHA256:1C30ED9DEABD1676469C6FDEC718FBC78BBD6D8CED666113CBB63432544752D4
2748Insidious.exeC:\Users\Public\qldyz51w.default\logins.jsonbinary
MD5:E7CE898AADD69F4E4280010B7808116E
SHA256:C9214BB54F10242AA254F0758372A440C8D8F49934021F8F08B6DF9FB377EB02
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
11
DNS requests
4
Threats
13

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1632
XClient.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
text
5 b
unknown
2424
XClient.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
text
5 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1632
XClient.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
unknown
2424
XClient.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
unknown
2748
Insidious.exe
188.114.97.3:443
freegeoip.app
CLOUDFLARENET
NL
unknown
2748
Insidious.exe
104.21.85.189:443
ipbase.com
CLOUDFLARENET
—
unknown
968
Insidious.exe
188.114.96.3:443
freegeoip.app
CLOUDFLARENET
NL
unknown
968
Insidious.exe
104.21.85.189:443
ipbase.com
CLOUDFLARENET
—
unknown

DNS requests

Domain
IP
Reputation
ip-api.com
  • 208.95.112.1
shared
freegeoip.app
  • 188.114.97.3
  • 188.114.96.3
whitelisted
ipbase.com
  • 104.21.85.189
  • 172.67.209.71
unknown

Threats

PID
Process
Class
Message
1632
XClient.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
1632
XClient.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
1632
XClient.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
2424
XClient.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
2424
XClient.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
2424
XClient.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
1080
svchost.exe
Potentially Bad Traffic
ET INFO External IP Lookup Domain Domain in DNS Lookup (ipbase .com)
2748
Insidious.exe
Potentially Bad Traffic
ET INFO Observed External IP Lookup Domain (ipbase .com in TLS SNI)
968
Insidious.exe
Potentially Bad Traffic
ET INFO Observed External IP Lookup Domain (ipbase .com in TLS SNI)
4 ETPRO signatures available at the full report
Process
Message
XClient.exe
CLR: Managed code called FailFast without specifying a reason.
XClient.exe
CLR: Managed code called FailFast without specifying a reason.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
PhotoshopCS6Portable.exe