URL:

https://startcrack.com/bandicam-crack/

Full analysis: https://app.any.run/tasks/c6538bef-7248-49b7-8f7d-959c2b3dd157
Verdict: Malicious activity
Threats:

Danabot is an advanced banking Trojan malware that was designed to steal financial information from victims. Out of the Trojans in the wild, this is one of the most advanced thanks to the modular design and a complex delivery method.

Malware Trends Tracker     >>>
Analysis date: September 18, 2020, 07:21:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
stealer
trojan
opendir
loader
danabot
Indicators:
MD5:

5B029D22F6E377B5766E9598D74C7541

SHA1:

D8FF3C5CD7DED7FEA102B7B4CD330C0A3F12C59A

SHA256:

E46CDEA86BEFF43AF2345659A8C9DE57E2215064CE8E834588672253A826B676

SSDEEP:

3:N8c8LGTBBkM9:2caKBBkw

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Setup.exe (PID: 4052)
      • Setup.exe (PID: 3096)
      • Setup1.exe (PID: 1972)
      • ns9DB6.tmp (PID: 3460)
      • 1.exe (PID: 3376)
      • bhfcrslrg.exe (PID: 3432)
      • yywahrgd.exe (PID: 2184)
      • Helper.exe (PID: 4008)
      • Helper.exe (PID: 1448)
      • SmartClock.exe (PID: 2796)
      • CL_Debug_Log.txt (PID: 2424)
      • tuyijamvvex.exe (PID: 2336)
      • Helper.exe (PID: 1948)
      • Helper.exe (PID: 4032)
      • Helper.exe (PID: 2572)
      • Helper.exe (PID: 3780)

    • Changes settings of System certificates

      • CScript.exe (PID: 2884)

    • Loads dropped or rewritten executable

      • Setup.exe (PID: 3096)
      • regsvr32.exe (PID: 1848)
      • rundll32.exe (PID: 2076)

    • Stealing of credential data

      • 1.exe (PID: 3376)

    • Actions looks like stealing of personal data

      • 1.exe (PID: 3376)

    • Writes to a start menu file

      • tuyijamvvex.exe (PID: 2336)

    • Loads the Task Scheduler COM API

      • tuyijamvvex.exe (PID: 2336)
      • schtasks.exe (PID: 3896)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 2532)

    • Registers / Runs the DLL via REGSVR32.EXE

      • yywahrgd.exe (PID: 2184)

    • Downloads executable files from IP

      • Setup1.exe (PID: 1972)

    • Downloads executable files from the Internet

      • Setup1.exe (PID: 1972)

    • Connects to CnC server

      • rundll32.exe (PID: 2076)

    • DANABOT was detected

      • rundll32.exe (PID: 2076)

  • SUSPICIOUS

    • Starts application with an unusual extension

      • Setup.exe (PID: 3096)
      • bhfcrslrg.exe (PID: 3432)

    • Executes scripts

      • ns9DB6.tmp (PID: 3460)

    • Creates files in the program directory

      • Setup.exe (PID: 3096)

    • Adds / modifies Windows certificates

      • CScript.exe (PID: 2884)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3120)
      • Setup.exe (PID: 3096)
      • tuyijamvvex.exe (PID: 2336)
      • Setup1.exe (PID: 1972)
      • bhfcrslrg.exe (PID: 3432)
      • CL_Debug_Log.txt (PID: 2424)
      • yywahrgd.exe (PID: 2184)

    • Reads Internet Cache Settings

      • CScript.exe (PID: 2884)
      • Setup1.exe (PID: 1972)
      • 1.exe (PID: 3376)

    • Reads the cookies of Google Chrome

      • 1.exe (PID: 3376)

    • Reads the cookies of Mozilla Firefox

      • 1.exe (PID: 3376)

    • Starts CMD.EXE for commands execution

      • 1.exe (PID: 3376)
      • Setup1.exe (PID: 1972)
      • bhfcrslrg.exe (PID: 3432)

    • Starts CMD.EXE for self-deleting

      • 1.exe (PID: 3376)

    • Creates files in the user directory

      • Setup1.exe (PID: 1972)
      • tuyijamvvex.exe (PID: 2336)
      • bhfcrslrg.exe (PID: 3432)

    • Checks for external IP

      • Setup1.exe (PID: 1972)

    • Starts itself from another location

      • tuyijamvvex.exe (PID: 2336)

    • Searches for installed software

      • 1.exe (PID: 3376)

    • Executed via Task Scheduler

      • Helper.exe (PID: 4008)
      • Helper.exe (PID: 1448)
      • Helper.exe (PID: 1948)
      • Helper.exe (PID: 4032)
      • Helper.exe (PID: 3780)
      • Helper.exe (PID: 2572)

    • Uses RUNDLL32.EXE to load library

      • regsvr32.exe (PID: 1848)

  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2632)
      • iexplore.exe (PID: 2736)
      • iexplore.exe (PID: 1868)

    • Application launched itself

      • iexplore.exe (PID: 2632)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2632)
      • iexplore.exe (PID: 1868)
      • iexplore.exe (PID: 2736)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2632)

    • Changes internet zones settings

      • iexplore.exe (PID: 2632)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2632)

    • Creates files in the user directory

      • iexplore.exe (PID: 1868)
      • iexplore.exe (PID: 2632)
      • iexplore.exe (PID: 2736)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2736)
      • iexplore.exe (PID: 1868)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2632)

    • Manual execution by user

      • WinRAR.exe (PID: 3120)
      • Setup.exe (PID: 3096)
      • Setup.exe (PID: 4052)
      • taskmgr.exe (PID: 3988)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
83
Monitored processes
32
Malicious processes
8
Suspicious processes
10

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe iexplore.exe winrar.exe no specs winrar.exe setup.exe no specs setup.exe ns9db6.tmp no specs cscript.exe 1.exe setup1.exe cmd.exe no specs timeout.exe no specs taskmgr.exe no specs cmd.exe no specs bhfcrslrg.exe cmd.exe no specs tuyijamvvex.exe smartclock.exe cl_debug_log.txt cmd.exe no specs yywahrgd.exe cmd.exe no specs schtasks.exe no specs helper.exe no specs helper.exe no specs regsvr32.exe no specs #DANABOT rundll32.exe helper.exe no specs helper.exe no specs helper.exe no specs helper.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2632"C:\Program Files\Internet Explorer\iexplore.exe" https://startcrack.com/bandicam-crack/C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1868"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2632 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2736"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2632 CREDAT:1578247 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2144"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\bandicam-4-6-3-1725-crack-latest-version-2020-1600413759.zip"C:\Program Files\WinRAR\WinRAR.exe—iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3120"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\bandicam-4-6-3-1725-crack-latest-version-2020-1600413759-zip\installer_file.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
4052"C:\Users\admin\Desktop\Setup.exe" C:\Users\admin\Desktop\Setup.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Version:
4.2.0.0
Modules
Images
c:\users\admin\desktop\setup.exe
c:\systemroot\system32\ntdll.dll
3096"C:\Users\admin\Desktop\Setup.exe" C:\Users\admin\Desktop\Setup.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
4.2.0.0
Modules
Images
c:\users\admin\desktop\setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3460"C:\Users\admin\AppData\Local\Temp\nsk9D67.tmp\ns9DB6.tmp" "C:\Windows\system32\CScript.exe" "C:\Program Files\Mader\lase\Setup1.vbs" //e:vbscript //B //NOLOGO C:\Users\admin\AppData\Local\Temp\nsk9D67.tmp\ns9DB6.tmp—Setup.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsk9d67.tmp\ns9db6.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
2884"C:\Windows\system32\CScript.exe" "C:\Program Files\Mader\lase\Setup1.vbs" //e:vbscript //B //NOLOGO C:\Windows\system32\CScript.exe
ns9DB6.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\cscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3376"C:\Program Files\Mader\lase\1.exe"C:\Program Files\Mader\lase\1.exe
Setup.exe
User:
admin
Company:
Doctor Web, Ltd.
Integrity Level:
HIGH
Description:
Dr.Web Security Space
Exit code:
0
Version:
12.0.2.07150
Modules
Images
c:\program files\mader\lase\1.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
Total events
3 760
Read events
3 544
Write events
210
Delete events
6

Modification events

(PID) Process:(2632) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
2142663824
(PID) Process:(2632) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30838156
(PID) Process:(2632) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2632) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2632) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2632) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2632) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2632) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A3000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2632) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2632) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
18
Suspicious files
83
Text files
353
Unknown types
50

Dropped files

PID
Process
Filename
Type
1868iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\CabE68E.tmp —
MD5:—
SHA256:—
1868iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\TarE68F.tmp —
MD5:—
SHA256:—
1868iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_637E13846EBA0E514706B3E4EFEC0CA1der
MD5:04ABD0E012E29AF5B68809E7A83DAD44
SHA256:2B0A74BB564E8B963FC1D56D67E36165A9AF18EA4EDB38BEB068CAC0E58B70BF
1868iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27der
MD5:6EFD06360730C271450E02D4AEC1808B
SHA256:5D28D4DE4EE3A4D56814878CE0D0E4E3844DED75CFB77BAE6ACE150EB557A37D
1868iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\W1AMYTC7.txttext
MD5:421CE730D8959767B13E3C9D7D61CC93
SHA256:B5FACF5E0C9C237B32EC73026586138779CDD6E96C3C092D56335A36589D99FA
1868iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\style[1].csstext
MD5:63B4191B10A2CE2AB18D3A86698A07A3
SHA256:0ED33FC009F43CD7A37392F12D0772B3B0F3C8EF79E394FF4EC6C331F88B1011
1868iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_637E13846EBA0E514706B3E4EFEC0CA1binary
MD5:22E139BB445BF1FF02170F03D1052E27
SHA256:404E5E7D68947BA02CB34CB465794B12EDA256AF3803842375C51BF5BFE2490C
1868iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\bandicam-crack[1].htmhtml
MD5:CEC451B0B17150AD202DB37DACE5A13F
SHA256:9D76AE693AA25727442D9A3E61214A8B54591159BCECE7A93DEAA91C280E1945
1868iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:DEACC494A955AD3B30C1E56996B380D6
SHA256:7145B13A932FA31E27CCFC72A97FEE839619C10C8AD4D3C3FDB72A1682FE56FB
1868iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\Bandicam-Crack[1].gifimage
MD5:0758546EF46F8EC597FD209A0B859BA4
SHA256:3A3DD0BA398325646ED0892D445A87AA9699565154742E13936B47ED650F66A0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
54
TCP/UDP connections
90
DNS requests
40
Threats
62

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1868
iexplore.exe
GET
304
151.139.128.14:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
—
—
whitelisted
1868
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
1868
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQS14tALDViBvqCf47YkiQRtKz1BAQUpc436uuwdQ6UZ4i0RfrZJBCHlh8CEAaJQ9pyIyeUDQGGyCnUt%2BI%3D
US
der
279 b
whitelisted
1868
iexplore.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/rootr1/ME8wTTBLMEkwRzAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDkbwjNvPLFRm7zMB3V80
US
der
1.49 Kb
whitelisted
1868
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
1868
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
1868
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
1868
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
1868
iexplore.exe
GET
304
151.139.128.14:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
1868
iexplore.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/rootr1/ME8wTTBLMEkwRzAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDkbwjNvPLFRm7zMB3V80
US
der
1.49 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1868
iexplore.exe
192.0.73.2:443
secure.gravatar.com
Automattic, Inc
US
whitelisted
1868
iexplore.exe
172.217.21.206:443
www.google-analytics.com
Google Inc.
US
whitelisted
1868
iexplore.exe
142.250.74.202:443
fonts.googleapis.com
Google Inc.
US
whitelisted
1868
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1868
iexplore.exe
172.67.155.69:443
startcrack.com
—
US
suspicious
1868
iexplore.exe
151.101.2.109:443
cdn.jsdelivr.net
Fastly
US
suspicious
1868
iexplore.exe
151.139.128.14:80
ocsp.comodoca.com
Highwinds Network Group, Inc.
US
suspicious
1868
iexplore.exe
172.217.18.3:80
ocsp.pki.goog
Google Inc.
US
whitelisted
1868
iexplore.exe
104.18.20.226:80
ocsp.globalsign.com
Cloudflare Inc
US
shared
1868
iexplore.exe
104.18.226.52:443
cdn.onesignal.com
Cloudflare Inc
US
malicious

DNS requests

Domain
IP
Reputation
startcrack.com
  • 172.67.155.69
  • 104.27.143.235
  • 104.27.142.235
malicious
ocsp.digicert.com
  • 93.184.220.29
whitelisted
fonts.googleapis.com
  • 142.250.74.202
whitelisted
cdn.jsdelivr.net
  • 151.101.2.109
  • 151.101.66.109
  • 151.101.130.109
  • 151.101.194.109
whitelisted
secure.gravatar.com
  • 192.0.73.2
whitelisted
www.google-analytics.com
  • 172.217.21.206
whitelisted
cdn.onesignal.com
  • 104.18.226.52
  • 104.18.225.52
whitelisted
ocsp.comodoca.com
  • 151.139.128.14
whitelisted
ocsp.globalsign.com
  • 104.18.20.226
  • 104.18.21.226
whitelisted
ocsp.pki.goog
  • 172.217.18.3
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO DNS Query for Suspicious .cf Domain
—
—
Potentially Bad Traffic
ET INFO Suspicious Domain (*.cf) in TLS SNI
—
—
Potential Corporate Privacy Violation
POLICY [PTsecurity] IP Check Domain SSL certificate
—
—
Potential Corporate Privacy Violation
POLICY [PTsecurity] IP Check Domain SSL certificate
—
—
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
—
—
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
—
—
A Network Trojan was detected
ET TROJAN Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
—
—
A Network Trojan was detected
ET CURRENT_EVENTS SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016
—
—
A Network Trojan was detected
ET TROJAN Single char EXE direct download likely trojan (multiple families)
—
—
A Network Trojan was detected
ET TROJAN Possible Malicious Macro DL EXE Feb 2016
23 ETPRO signatures available at the full report
Process
Message
1.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
Setup1.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
bhfcrslrg.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
tuyijamvvex.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
SmartClock.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://startcrack.com/bandicam-crack/