URL:

https://docviewer.yandex.ru/view/0/?*=ICHLGq4F0lg40wR5z89QwuW7A0R7InVybCI6InlhLWRpc2stcHVibGljOi8vM0JSRFRUR3FqN0pjZmhlS2cwRzJNVVBGNWVwV2JEU2g5b3Ird0dsMzZrZStjb3JhaXUzQTZqd29lb25YaWxBd3EvSjZicG1SeU9Kb25UM1ZvWG5EYWc9PTovR3RhNiB2MDA2ICgyMDIzKS5yYXIiLCJ0aXRsZSI6Ikd0YTYgdjAwNiAoMjAyMykucmFyIiwibm9pZnJhbWUiOmZhbHNlLCJ1aWQiOiIwIiwidHMiOjE3MDMzOTc4Njk1NjMsInl1IjoiOTE3OTIzNjI4MTcwMjk5ODU5OSJ9

Full analysis: https://app.any.run/tasks/05745b60-ed9a-4edf-814c-802e254216d1
Verdict: Malicious activity
Analysis date: December 24, 2023, 06:05:14
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

6D6C33C587ECDE5246FC81B314706E7D

SHA1:

D87042F17E775A3848818FE2305CEDB3B4CBCB6D

SHA256:

001EC9915F9C903D53AE42D15F613638ED4C3AF69064A029382566A6860C856D

SSDEEP:

12:2MQdTHUgAUA5V4MqyzpQwkkb5m5ZvJfyN8HZw:29NH3k4NyNldbgv1yNsZw

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Disables Windows Defender

      • Topich.exe (PID: 292)

    • Changes appearance of the Explorer extensions

      • Topich.exe (PID: 292)

    • UAC/LUA settings modification

      • Topich.exe (PID: 292)

    • Using BCDEDIT.EXE to modify recovery options

      • cmd.exe (PID: 2776)

    • Changes the login/logoff helper path in the registry

      • Topich.exe (PID: 292)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Topich.exe (PID: 292)
      • sipnotify.exe (PID: 1600)
      • Run.exe (PID: 2332)
      • Gta6.exe (PID: 2672)

    • The system shut down or reboot

      • cmd.exe (PID: 2776)

    • Starts CMD.EXE for commands execution

      • Topich.exe (PID: 292)
      • Gta6.exe (PID: 2672)

    • Reads settings of System Certificates

      • sipnotify.exe (PID: 1600)

  • INFO

    • The process uses the downloaded file

      • iexplore.exe (PID: 128)
      • WinRAR.exe (PID: 2332)

    • Application launched itself

      • iexplore.exe (PID: 128)

    • Checks supported languages

      • Gta6.exe (PID: 2672)
      • IMEKLMG.EXE (PID: 2068)
      • IMEKLMG.EXE (PID: 2080)
      • Run.exe (PID: 2332)
      • wmpnscfg.exe (PID: 2644)
      • Topich.exe (PID: 292)
      • wmpnscfg.exe (PID: 2664)
      • Rndmsms.exe (PID: 2816)
      • Rndmsms.exe (PID: 2876)
      • Rndmsms.exe (PID: 2912)
      • Gdi_Radial_Blur.exe (PID: 3100)
      • Rndmsms.exe (PID: 3076)
      • Rndmsms.exe (PID: 3148)
      • Rndmsms.exe (PID: 3284)
      • Rndmsms.exe (PID: 3208)

    • Reads the computer name

      • Gta6.exe (PID: 2672)
      • Topich.exe (PID: 292)
      • IMEKLMG.EXE (PID: 2068)
      • IMEKLMG.EXE (PID: 2080)
      • Run.exe (PID: 2332)
      • wmpnscfg.exe (PID: 2644)
      • wmpnscfg.exe (PID: 2664)
      • Rndmsms.exe (PID: 2816)
      • Rndmsms.exe (PID: 2876)
      • Rndmsms.exe (PID: 3148)
      • Rndmsms.exe (PID: 2912)
      • Rndmsms.exe (PID: 3076)
      • Gdi_Radial_Blur.exe (PID: 3100)
      • Rndmsms.exe (PID: 3208)
      • Rndmsms.exe (PID: 3284)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2332)
      • Gta6.exe (PID: 2672)
      • Topich.exe (PID: 292)

    • Manual execution by a user

      • Gta6.exe (PID: 2672)
      • IMEKLMG.EXE (PID: 2080)
      • IMEKLMG.EXE (PID: 2068)
      • wmpnscfg.exe (PID: 2644)
      • wmpnscfg.exe (PID: 2664)

    • Reads the machine GUID from the registry

      • Gta6.exe (PID: 2672)
      • Topich.exe (PID: 292)
      • Run.exe (PID: 2332)
      • Rndmsms.exe (PID: 2816)
      • Rndmsms.exe (PID: 2876)
      • Rndmsms.exe (PID: 2912)
      • Rndmsms.exe (PID: 3076)
      • Rndmsms.exe (PID: 3148)
      • Rndmsms.exe (PID: 3208)
      • Rndmsms.exe (PID: 3284)

    • Starts itself from another location

      • Gta6.exe (PID: 2672)

    • The process executes via Task Scheduler

      • sipnotify.exe (PID: 1600)
      • ctfmon.exe (PID: 1804)

    • Reads security settings of Internet Explorer

      • sipnotify.exe (PID: 1600)

    • Process checks are UAC notifies on

      • IMEKLMG.EXE (PID: 2080)
      • IMEKLMG.EXE (PID: 2068)
      • Topich.exe (PID: 292)

    • Checks proxy server information

      • Run.exe (PID: 2332)

    • Reads Environment values

      • Run.exe (PID: 2332)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
115
Monitored processes
26
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe winrar.exe no specs gta6.exe topich.exe cmd.exe no specs cmd.exe no specs bcdedit.exe no specs reagentc.exe no specs bcdedit.exe no specs shutdown.exe no specs ctfmon.exe no specs sipnotify.exe imeklmg.exe no specs imeklmg.exe no specs run.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs rndmsms.exe no specs rndmsms.exe no specs rndmsms.exe no specs rndmsms.exe no specs gdi_radial_blur.exe no specs rndmsms.exe no specs rndmsms.exe no specs rndmsms.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
128"C:\Program Files\Internet Explorer\iexplore.exe" "https://docviewer.yandex.ru/view/0/?*=ICHLGq4F0lg40wR5z89QwuW7A0R7InVybCI6InlhLWRpc2stcHVibGljOi8vM0JSRFRUR3FqN0pjZmhlS2cwRzJNVVBGNWVwV2JEU2g5b3Ird0dsMzZrZStjb3JhaXUzQTZqd29lb25YaWxBd3EvSjZicG1SeU9Kb25UM1ZvWG5EYWc9PTovR3RhNiB2MDA2ICgyMDIzKS5yYXIiLCJ0aXRsZSI6Ikd0YTYgdjAwNiAoMjAyMykucmFyIiwibm9pZnJhbWUiOmZhbHNlLCJ1aWQiOiIwIiwidHMiOjE3MDMzOTc4Njk1NjMsInl1IjoiOTE3OTIzNjI4MTcwMjk5ODU5OSJ9"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
292"C:\Windows\Setup\State\Topich.exe" C:\Windows\Setup\State\Topich.exe
Gta6.exe
User:
admin
Integrity Level:
HIGH
Description:
Gta6
Exit code:
1073807364
Version:
1.0.0.0
Modules
Images
c:\windows\setup\state\topich.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
324"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:128 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1600C:\Windows\system32\sipnotify.exe -LogonOrUnlockC:\Windows\System32\sipnotify.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
sipnotify
Exit code:
0
Version:
6.1.7602.20480 (win7sp1_ldr_escrow.191010-1716)
Modules
Images
c:\windows\system32\sipnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1804C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
CTF Loader
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
2068"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /JPN /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
2080"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /KOR /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
2104bcdedit /set {globalsettings} advancedoptions falseC:\Windows\System32\bcdedit.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Boot Configuration Data Editor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\bcdedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2332"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\Gta6 v006 (2023).rar"C:\Program Files\WinRAR\WinRAR.exe—iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2332"C:\VirusNew17\Topich\Run.exe" C:\VirusNew17\Topich\Run.exe—Topich.exe
User:
admin
Integrity Level:
HIGH
Description:
Run
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\virusnew17\topich\run.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
22 461
Read events
22 253
Write events
182
Delete events
26

Modification events

(PID) Process:(128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
9
Suspicious files
61
Text files
35
Unknown types
0

Dropped files

PID
Process
Filename
Type
324iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81Bbinary
MD5:5460898F536ECB258319AB8DC96C50A7
SHA256:70B7FE9D795A9280B40F6C2B648AB99106FB9635D5C5452FD5A75CB1B942518F
324iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3binary
MD5:3B555AAF57E9BF83DCCCFDAEA95D5853
SHA256:628B6C27DCBCE820E8AAD2661EE8C14A57D0EFA4BC078FA57672421BCE60858C
324iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046binary
MD5:C5801D65BFCDE07D756EBD7D5027C244
SHA256:2F9939A8D81CB0E0D510B74DF942A537F2D151BECAA835749DD03CE4BC44F702
324iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\DNBG1FNU.txttext
MD5:5A31A2F75C51434AC19CAD25D67ED624
SHA256:D411A0C15135287174DDE0FAB5FA2D4FEB5D9AF3A576F69F4B05520364A3835D
324iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\349D186F1CB5682FA0194D4F3754EF36_24189A5ADBE6F590307BAA21110D145Dbinary
MD5:DBF4058D46AA6E74637E75EA89B3A015
SHA256:747BC27A316C05642DD1E50C6FCAE8B8DC2326228805322C0E682A86AEE61E09
324iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D0EECC40864A7E2AABBD4325CBB7C9B5binary
MD5:80EA74B9A0EAB939601A62190943A547
SHA256:E00A67C35220148900EC78939884BE8F42E4A1102623F79A9AE26FD1259B51DB
324iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\DOTBATAV\docviewer.yandex[1].xmltext
MD5:C1DDEA3EF6BBEF3E7060A1A9AD89E4C5
SHA256:B71E4D17274636B97179BA2D97C742735B6510EB54F22893D3A2DAFF2CEB28DB
324iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\2C09EEZD.txttext
MD5:D90BA5F8EBC8616C61D1D76E971CF77F
SHA256:5D8B9C87A5EE9A337362512BF81AD8C72AEB87A73D2126FF9D55F4A274F8A746
324iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\ZMJ1NFZA.txttext
MD5:1ED99C6BD28EEB8F0976368250FCC810
SHA256:2C2E7DFE0536ED3939055DF31645173A46E6EAEA8F6CC14F9399044055B79B9C
324iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3binary
MD5:766CA97EE637ADA127BC0EF12FA79BAB
SHA256:DA39C10F9DD5F1C966B2F1599CF06C7A3C81F1CBC404674580F2E32A7BBBA981
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
35
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
324
iexplore.exe
GET
200
87.248.204.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?53bfb7cf8a6cf97e
unknown
compressed
4.66 Kb
unknown
324
iexplore.exe
GET
200
87.248.204.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?129d20c84d8c4223
unknown
compressed
4.66 Kb
unknown
324
iexplore.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/rootr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDQHuXxad%2F5c1K2Rl1mo%3D
unknown
binary
1.41 Kb
unknown
324
iexplore.exe
GET
200
104.18.21.226:80
http://ocsp2.globalsign.com/rootr3/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCDQHuXyId%2FGI71DM6hVc%3D
unknown
binary
1.40 Kb
unknown
324
iexplore.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/gseccovsslca2018/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBSTMjK03nNiYoQYvu4Izyfn9OJNdAQUWHuOdSr%2BYYCqkEABrtboB0ZuP0gCDDeQwBkGHaRwgVLWqQ%3D%3D
unknown
binary
938 b
unknown
128
iexplore.exe
GET
304
87.248.204.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a85e8d0c2f0a71a5
unknown
—
—
unknown
324
iexplore.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/gseccovsslca2018/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBSTMjK03nNiYoQYvu4Izyfn9OJNdAQUWHuOdSr%2BYYCqkEABrtboB0ZuP0gCDGR9zAVCqD3GmxxJUg%3D%3D
unknown
binary
938 b
unknown
324
iexplore.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/gsrsaovsslca2018/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBRrcGT%2BanRD3C1tW3nsrKeuXC7DPwQU%2BO9%2F8s14Z6jeb48kjYjxhwMCs%2BsCDHqNhO3StBqmI6fkdA%3D%3D
unknown
binary
1.40 Kb
unknown
128
iexplore.exe
GET
304
87.248.204.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1a6e676fbb64f2cc
unknown
—
—
unknown
128
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
313 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
324
iexplore.exe
77.88.21.148:443
docviewer.yandex.ru
YANDEX LLC
RU
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
324
iexplore.exe
87.248.204.0:80
ctldl.windowsupdate.com
LLNW
US
unknown
324
iexplore.exe
104.18.20.226:80
ocsp.globalsign.com
CLOUDFLARENET
—
shared
324
iexplore.exe
104.18.21.226:80
ocsp.globalsign.com
CLOUDFLARENET
—
shared
324
iexplore.exe
87.250.251.119:443
mc.yandex.ru
YANDEX LLC
RU
whitelisted
324
iexplore.exe
93.158.134.119:443
mc.yandex.ru
YANDEX LLC
RU
whitelisted
128
iexplore.exe
77.88.21.148:443
docviewer.yandex.ru
YANDEX LLC
RU
unknown

DNS requests

Domain
IP
Reputation
docviewer.yandex.ru
  • 77.88.21.148
whitelisted
ctldl.windowsupdate.com
  • 87.248.204.0
whitelisted
ocsp.globalsign.com
  • 104.18.20.226
  • 104.18.21.226
whitelisted
ocsp2.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted
mc.yandex.ru
  • 87.250.251.119
  • 87.250.250.119
  • 77.88.21.119
  • 93.158.134.119
whitelisted
mc.yandex.com
  • 93.158.134.119
  • 77.88.21.119
  • 87.250.250.119
  • 87.250.251.119
whitelisted
yastatic.net
  • 178.154.131.217
  • 178.154.131.216
  • 178.154.131.215
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.139
  • 104.126.37.131
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://docviewer.yandex.ru/view/0/?*=ICHLGq4F0lg40wR5z89QwuW7A0R7InVybCI6InlhLWRpc2stcHVibGljOi8vM0JSRFRUR3FqN0pjZmhlS2cwRzJNVVBGNWVwV2JEU2g5b3Ird0dsMzZrZStjb3JhaXUzQTZqd29lb25YaWxBd3EvSjZicG1SeU9Kb25UM1ZvWG5EYWc9PTovR3RhNiB2MDA2ICgyMDIzKS5yYXIiLCJ0aXRsZSI6Ikd0YTYgdjAwNiAoMjAyMykucmFyIiwibm9pZnJhbWUiOmZhbHNlLCJ1aWQiOiIwIiwidHMiOjE3MDMzOTc4Njk1NjMsInl1IjoiOTE3OTIzNjI4MTcwMjk5ODU5OSJ9