File name:

VALORANT HACK.exe

Full analysis: https://app.any.run/tasks/6ad057d8-bc6a-4523-96aa-a213337575b2
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: August 02, 2024, 10:20:09
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
telegram
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

F3EC92776E756B393A09B1AF72F697C8

SHA1:

EDC146728BC006B76094DD1D21A8217E612BEF0F

SHA256:

FB240F8A4AA481C107C8DC11F1831558F109838F7E887247383FCA779F562607

SSDEEP:

49152:oMLj0+Dg5czP0iNkrfa5dLndzfIuSvFb+1eo3WsfVOgwxUI0BrsO4Op7hNKUkRys:ouHDg2z8iSra5dn5ebUeoGGVzwx/0Zsb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • VALORANT HACK.exe (PID: 5028)

    • Actions looks like stealing of personal data

      • VALORANT HACK.exe (PID: 5028)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • VALORANT HACK.exe (PID: 5028)

    • Searches for installed software

      • VALORANT HACK.exe (PID: 5028)

    • Checks for external IP

      • svchost.exe (PID: 2256)
      • VALORANT HACK.exe (PID: 5028)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • VALORANT HACK.exe (PID: 5028)

    • Connects to unusual port

      • VALORANT HACK.exe (PID: 5028)

    • Executes application which crashes

      • VALORANT HACK.exe (PID: 5028)

  • INFO

    • Reads the computer name

      • Activator.exe (PID: 6476)
      • VALORANT HACK.exe (PID: 5028)

    • Checks supported languages

      • Activator.exe (PID: 6476)
      • VALORANT HACK.exe (PID: 5028)

    • Reads the machine GUID from the registry

      • Activator.exe (PID: 6476)

    • Creates files or folders in the user directory

      • VALORANT HACK.exe (PID: 5028)
      • WerFault.exe (PID: 5104)

    • Create files in a temporary directory

      • VALORANT HACK.exe (PID: 5028)

    • Attempting to use instant messaging service

      • svchost.exe (PID: 2256)
      • VALORANT HACK.exe (PID: 5028)

    • Checks proxy server information

      • WerFault.exe (PID: 5104)

    • Reads the software policy settings

      • WerFault.exe (PID: 5104)

    • Dropped object may contain TOR URL's

      • WerFault.exe (PID: 5104)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:25 22:52:16+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.39
CodeSize: 2521088
InitializedDataSize: 835072
UninitializedDataSize: -
EntryPoint: 0x336001
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
2256C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
5028"C:\Users\admin\Downloads\VALORANT HACK.exe" C:\Users\admin\Downloads\VALORANT HACK.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226505
Modules
Images
c:\users\admin\downloads\valorant hack.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
5104C:\WINDOWS\SysWOW64\WerFault.exe -u -p 5028 -s 1128C:\Windows\SysWOW64\WerFault.exe
VALORANT HACK.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
6476"C:\Users\admin\AppData\Local\Temp\Activator.exe"C:\Users\admin\AppData\Local\Temp\Activator.exe—VALORANT HACK.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WindowsFormsApp1
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\activator.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
7 388
Read events
7 384
Write events
4
Delete events
0

Modification events

(PID) Process:(5104) WerFault.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
Operation:writeName:00180010F429971D
Value:
0100000001000000D08C9DDF0115D1118C7A00C04FC297EB0100000042CB6C300049C042863C8A748EF9A2B20000000002000000000010660000000100002000000019B8AC2CEED4FB3D94AF4CCE019153EA9B212908B1D6279E642213607973FDC2000000000E80000000020000200000006D7EA8F35C7FE359750165854B938DD21F8D9511280F7EE78C9384A7B6B4E97680000000A1DA9199186B3991F55E845CADB9B7AD8E25B4EB90E1D8DBAF1E68A1B72F7A94C2D3A39504B828EDC090CBD8D2823FC7408A84AC6BDA94C7D59A815F5F7E13063F11CA2AAE138DE72177FFB40700213A9ADC6A056CD26FC1FC17ECAC33BE27FE6977BBEB7F86F27EA55780F10F2E081535302F6BA6CD2AF541A10E2B9C73E88E40000000E492E53467DFC645BF4617E421D31C3D4299513D70DDB2AB3F383DF1FC189DFE2020FCDC7190AA2C408DD3E5ADABD1FB4643E8827FB0F8CA44FD2C9FD109FD1E
(PID) Process:(5104) WerFault.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
Operation:writeName:DeviceTicket
Value:
0100000001000000D08C9DDF0115D1118C7A00C04FC297EB0100000042CB6C300049C042863C8A748EF9A2B2000000000200000000001066000000010000200000004B30143AC28223970F3463F35953DD5C4720CA318F1EB92D040B9F7F1DEDD146000000000E800000000200002000000005AD72DD76383511A10DDF55C7A415A4075DCD89A09F5E117C7EAA29D0914A30200800004F7DF8EB86AFC92CF7DAFA4A15CD5DAE44D2C667430F7F0165884C0338C4EED178A011E1A5B462749BA707437A33A2CA36BE2989317DD72A04B6C3342463B644CF45B76CC370905E736E4C446AAC74B92686B7074861D6E18AA6F33E7FC5C5FF370130CB7CAB3A37BD3565EA6E9B36ED7ED46A1F7354D7D1BF2DB40F0614F67250C274E0B09688EFC5D95F72D20720B0EEF16EAC8DD54E21C3A6FEE9E61AC27ACE61CE235D77551679EE46E5E4F633F2B169DB2B0A5A2E6589D32CAD1EB57AC708CADD58B54A947666CFCFCB54DF3145B4B323EF981E76B78C863A180ABC217B5D973AE37A3B9F91E69448289036147905966D4D782F2A58F02B5DECB0F298E1ECE39415893B063BF8E3832FBD1C484825A9A99BF5B448AC2BFC4ED1C9AFD78C12B6461B7391FB425253B70DDC07FF2CACF503BDFA9A11CF61E7E8E76E952699F89A561BE74D097B809A177C3A6616A927E56BCE37881B0C6FA7F10F7ED2D2DDC5F3861C61FC34AE97D595FC793E526BB2DB9FC76F709CE4579599FC36D969430184DB4A48C76C3BF105ED85B9EF570EC4135211A1995ACD4F4CA85FF193655055625F2DA7528FC020399789ADB78FE8C41729F5E4D12616000D6ED9A0FCF765C2CDAB159D40955A0B52CAB9195261DEBEFCBF07E71D9FE0FF044C9AEC0DF585AA21C8A566EFBDD199C92DFF738919869A085ECF945C23B7389289631F0D824B44AE73DC3F71772A05AE7789185F36DA3E77826E078BEBE2141EB6E3778966A591EE9E618FFCF6E4F9B73E5242D9A4E673A29D23B3472B5F9AC45001E91C84C411FE12315484211BCE13BCB969A5D375E882E8674E681FA239A2C5A7E5622946A889CEAFD8B3DEC23D398A1D4C015664BFFD18763387D37CBBAEAC4CA077F34BD7E9A357DF43296D176E55A1C48E69DF90BA4A333054D7A39C41CCD4352A3BB9AEE4A8A4AF0D0F6F0B0738F70DF1861775BEF7A46BC7A1645B4258A76638BC530EEB7A234B86F481CB1F3744981819B082AE7A4CC07BC692E8D30986934560F6962EF69D8087F28CD5B33FA30A3F20B5473B44DB829ECF950D560FB8A7AE0E40CDE0F7C62C5DE09659564B1A3D43DE68C5D191E5B05FCCACD2433E6FD2269EF0DE37F3FD71BF4E29FA83EAF3800863F11B760490871C381BA2E8A1BA377FD498537B8704B45923EFD8268ADF95C47B5910E8040240AE5E605BE39829C6B31890197BDE589666091B8CC17D54FA706889A464B87BE223FD376E72B8C6ECFF84749C7DC84233EAC66DC4639A736881519E1D08342F6E050E2EF40AF461F063105AB2E484930488563B67D09A137EE4FCF8E024EE13290F21E36ACB77CB26C0778A9E41D6067AF0D1E9F1CB7BD6F9E86D7F01FB321B77345E4CA441B9E12757549CA956C69E4E8C2A2D730169F9059967B77DE194CDEA7102F35479558731F99234790BBD12B035CFF9672E299D253CEE7424F57EC94E0B7855CD95475EF2A665844C5C9587D3EF676DEA62F29BD41B999491EBAC3164C11968692F9EB79CC1F51AB3A281072CC53D1B5FF982F4DCBF5EDC77B57F4A26CCE1D64F5AA59D8CBFCAC8E27E190F0B9E7129C961A0FC5D696B9136455F9EEBA5302940C20A36EB018C42BE7099B1F63CFB42448DC1895E2EED3D868A51109466486902438235E72178F0FFFC39D1230EC47DAD97E05D35287245B446DDF904BAE4F3F5381453FAF31DE2F223795AC4547AE635F5CB333D5B1B3C1CB8F969A22470BBD87DFEB63D6CDC256782350E5118CDD517FDE3BA57CD17DFD791796A366FD05D68370098D46E49D6ED7A40D40ACACF40931D1FD822EE06F444A6D07019F03E6246371AC198CD92C43E8E18856B68AE04EDA3EFC0F9290486A471C804691D71E277206FF7E74D767AD086D017C3B4BD6CE7219BF779F26D6CF9957327986C99AA1539B166D78B2F73FA13F4E8788FECD1E3EFD87E4421FE0790F1BBBB910A634F59CCE80D7B4F3B2CCD4F7601A30C7CF4942E74BA573833F261A9D2E3A437113620FD87EEBC03A6A25B1C95EBD59771E9E281CAAA97146D272CFD50372273FFAFB2D431962DC5B082CB6F45289DA4A364F344FB8387DDAFBB6F1E294D550789B2E58141A4A6CCCAD2936786C8E7B595FDF803326165B817BAF2A83686889EA69194854E90A9FF8CC896170016BABA4EA46B15E43AACA8333E5C8473FBB05CDFBF0670626E304244102156B51680FAC417A28C9ACEC611D14097FA68E0F38ED266386DDF4DDD9C838F4A7D65699E3C06704ED31C17E084D0B08D8EAF55BCF271616686B81090B10A3B3B0BB773CCDCD13F930016D5932835D3B0D50C93C3BE8DC737FA1D91FBB04292FBA8A71858FDE67BB8539450B320D8F65EFB319DE9DC138AB601BD849517A3472BBC0168E8A02DBDE26FDD856ED353AD6712F3E36DFA8B058F61F7085820AD8D7F658BD30E47016C05324D48B5D28843C479197EA368111EF1E52AFA631F9AADD7D569DB63F27926546CF6C14F0033270A4758DBFEDB8E46458D8F9CBBF5EA597D4EFC2AB05138EDE1BA077105FEE85771A8A6F2CEAF34B344865893BCF55B199D57121668E3BE02051B32073EB8F5C005ABEB1018BDE95D3BE8B40E126D4079AADFCF59DB775359272D5AF20AD0FF07772C3255C688D2337176339701D5357C094840E8FF22B08824ED7CFB6CE0FE2372A655C0786DB93D65C53A001FA1679D586F28675CB721AA6B78633F7DE506147A4D88E4705B7372E8F189C6DE63AB8A2F894185FD98A70DDE3171A5E70C41F6D9843FD1B2786735ECBE0E42B2B662BEB733AB34E0974609C04BDC74F3E2B4E423632F63786AAE947DB5A90CE70E438B6C1F97EF79568150BE966DF6C52758F5FE2F17F8861E4DDAEA55B4FF7BFE2577A77652A2B460BBD4F55D426F0EF1097F88D90B477F06070C8A967D3E9CB1680A40000000208A281A92BC0213AF41F79554DC61E0171AC8EEE034B391C0CFD9D115868307D3657F00C086B52D44BBA4019F08BEAF24D3259E12504C70ADD9C0D34798AE18
(PID) Process:(5104) WerFault.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
Operation:writeName:DeviceId
Value:
00180010F429971D
(PID) Process:(5104) WerFault.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
Operation:writeName:ApplicationFlags
Value:
1
Executable files
1
Suspicious files
16
Text files
6
Unknown types
1

Dropped files

PID
Process
Filename
Type
5028VALORANT HACK.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\Fredy_Places.sqlite —
MD5:—
SHA256:—
5028VALORANT HACK.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Fredy_Datasqlite
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
5028VALORANT HACK.exeC:\Users\admin\AppData\Local\Temp\AUTOSAVE\Cookies\Microsoft Edge Browser_Default.txttext
MD5:FC45AF089CC49C5D727F254852D5BD06
SHA256:6DDE22F5C4F397D97193933AD317FBD3BEA6460047FBAD9FD7FAC7C1F86FD1B1
5028VALORANT HACK.exeC:\Users\admin\AppData\Local\Temp\Activator.exeexecutable
MD5:2B2204C85F334DE4695369F631926664
SHA256:69DB6B1262AF756060EFD63CA54A933CBEC740AC193221A88BBC46DF9AC53DE9
5028VALORANT HACK.exeC:\Users\admin\AppData\Local\Temp\AUTOSAVE\Informations.txtbinary
MD5:0D07E567FA535C3AE023937B6C08E371
SHA256:BD3E0BC5078B8F1A58EA30F8DDBA3A9B7FDD0D8D7BF0663916716415AC8C20C7
5104WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_VALORANT HACK.ex_6592d5e7c559b467d428c19b7ccd890f26baaa8_e3124dad_af8ef87e-0488-4a2b-96df-26749923a8cd\Report.wer —
MD5:—
SHA256:—
5028VALORANT HACK.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Fredy_Historybinary
MD5:FDDE63730E15DD2E18C540BA52B6A945
SHA256:40740EAABD14FC0E08D3B5EE340C1E1B372E158F61EF58AEED1EE4B3A3F4492E
5028VALORANT HACK.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Network\Fredy_Cookiesbinary
MD5:06AD9E737639FDC745B3B65312857109
SHA256:C8925892CA8E213746633033AE95ACFB8DD9531BC376B82066E686AC6F40A404
5028VALORANT HACK.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Fredy_Web_Databinary
MD5:F6C33AC5E1032A0873BE7BFC65169287
SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83
5028VALORANT HACK.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Fredy_Datasqlite
MD5:29A644B1F0D96166A05602FE27B3F4AD
SHA256:BF96902FEB97E990A471492F78EE8386BCF430D66BDAEFDEAFBF912C8CF7CE46
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
53
DNS requests
22
Threats
18

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5028
VALORANT HACK.exe
GET
200
44.198.106.96:80
http://httpbin.org/ip
US
binary
33 b
shared
5028
VALORANT HACK.exe
GET
200
44.198.106.96:80
http://httpbin.org/ip
US
binary
33 b
shared
768
lsass.exe
GET
200
184.24.77.48:80
http://r10.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgRFR8WyY%2FlMkr0lsTk9YS076A%3D%3D
DE
binary
504 b
whitelisted
5028
VALORANT HACK.exe
HEAD
403
185.53.177.31:80
http://suckmydick.com/
DE
—
—
malicious
5028
VALORANT HACK.exe
GET
200
44.198.106.96:80
http://httpbin.org/ip
US
binary
33 b
shared
5028
VALORANT HACK.exe
GET
200
44.198.106.96:80
http://httpbin.org/ip
US
binary
33 b
shared
5028
VALORANT HACK.exe
POST
200
5.161.243.5:6969
http://5.161.243.5:6969/
US
text
27 b
unknown
768
lsass.exe
GET
200
192.124.249.22:80
http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D
US
binary
2.01 Kb
whitelisted
768
lsass.exe
GET
200
192.124.249.22:80
http://ocsp.godaddy.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D
US
binary
1.98 Kb
whitelisted
768
lsass.exe
GET
200
192.124.249.22:80
http://ocsp.godaddy.com//MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQDflMUbWnbjyw%3D%3D
US
binary
2.06 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4088
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4560
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5028
VALORANT HACK.exe
44.198.106.96:80
httpbin.org
AMAZON-AES
US
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
5028
VALORANT HACK.exe
34.117.59.81:443
ipinfo.io
GOOGLE-CLOUD-PLATFORM
US
whitelisted
768
lsass.exe
184.24.77.48:80
r10.o.lencr.org
Akamai International B.V.
DE
unknown
5028
VALORANT HACK.exe
185.53.177.31:80
suckmydick.com
Team Internet AG
DE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.142
whitelisted
httpbin.org
  • 44.198.106.96
  • 44.207.203.25
  • 34.194.112.169
  • 54.87.89.151
shared
ipinfo.io
  • 34.117.59.81
shared
r10.o.lencr.org
  • 184.24.77.48
  • 184.24.77.79
  • 184.24.77.54
  • 184.24.77.46
  • 184.24.77.62
  • 184.24.77.67
whitelisted
suckmydick.com
  • 185.53.177.31
malicious
api.telegram.org
  • 149.154.167.220
shared
ocsp.godaddy.com
  • 192.124.249.22
  • 192.124.249.36
  • 192.124.249.41
  • 192.124.249.23
  • 192.124.249.24
whitelisted
www.bing.com
  • 104.126.37.171
  • 104.126.37.170
  • 104.126.37.176
  • 104.126.37.160
  • 104.126.37.179
  • 104.126.37.186
  • 104.126.37.162
  • 104.126.37.185
  • 104.126.37.161
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted

Threats

PID
Process
Class
Message
5028
VALORANT HACK.exe
Device Retrieving External IP Address Detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
2256
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ipinfo .io)
5028
VALORANT HACK.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup SSL Cert Observed (ipinfo .io)
5028
VALORANT HACK.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup SSL Cert Observed (ipinfo .io)
5028
VALORANT HACK.exe
Device Retrieving External IP Address Detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
5028
VALORANT HACK.exe
A Network Trojan was detected
ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt) M2
5028
VALORANT HACK.exe
A Network Trojan was detected
ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
5028
VALORANT HACK.exe
A Network Trojan was detected
ET MALWARE Suspicious Zipped Filename in Outbound POST Request (passwords.txt) M2
2256
svchost.exe
Misc activity
SUSPICIOUS [ANY.RUN] Possible sending an external IP address to Telegram
2256
svchost.exe
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
6 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
VALORANT HACK.exe