analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://ly4ujziucz.slemmnp.tk/1.txt

Full analysis: https://app.any.run/tasks/033634f0-c87e-4306-8495-681342a2ac0e
Verdict: Malicious activity
Analysis date: May 20, 2022, 22:35:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

445E060BF0A549E76515C87B4C3AA59B

SHA1:

34CF76FBF714AFD9E84D29E064ED4D84A512EDE3

SHA256:

011FE85A0C4FD44DB03F941DB85838CA48B06FD972D3F61ABCCA7B26576C5A1D

SSDEEP:

3:N8cRtfLWniu:2cbjWnh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • chrome.exe (PID: 1272)
      • chrome.exe (PID: 3212)
      • test.exe (PID: 1304)
      • wscript.exe (PID: 3588)
      • UnSigner.exe (PID: 3112)

    • Application was dropped or rewritten from another process

      • idman640build11.exe (PID: 3228)
      • idman640build11.exe (PID: 2612)
      • test.exe (PID: 2728)
      • test.exe (PID: 1304)
      • IDMan.exe (PID: 1964)
      • UnSigner.exe (PID: 3112)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 1264)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 1272)

    • Drops a file with a compile date too recent

      • chrome.exe (PID: 1272)
      • chrome.exe (PID: 3212)
      • test.exe (PID: 1304)
      • wscript.exe (PID: 3588)
      • UnSigner.exe (PID: 3112)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 1272)
      • chrome.exe (PID: 3212)
      • test.exe (PID: 1304)
      • wscript.exe (PID: 3588)
      • UnSigner.exe (PID: 3112)

    • Checks supported languages

      • idman640build11.exe (PID: 2612)
      • IDM1.tmp (PID: 3640)
      • IDMan.exe (PID: 1964)
      • idmBroker.exe (PID: 2364)
      • test.exe (PID: 1304)
      • wscript.exe (PID: 3588)
      • UnSigner.exe (PID: 3112)

    • Starts application with an unusual extension

      • idman640build11.exe (PID: 2612)

    • Reads the computer name

      • IDMan.exe (PID: 1964)
      • IDM1.tmp (PID: 3640)
      • wscript.exe (PID: 3588)
      • test.exe (PID: 1304)

    • Creates a directory in Program Files

      • IDM1.tmp (PID: 3640)

    • Creates a software uninstall entry

      • IDM1.tmp (PID: 3640)

    • Creates/Modifies COM task schedule object

      • IDMan.exe (PID: 1964)
      • IDM1.tmp (PID: 3640)

    • Creates files in the user directory

      • IDM1.tmp (PID: 3640)
      • IDMan.exe (PID: 1964)

    • Searches for installed software

      • test.exe (PID: 1304)

    • Executes scripts

      • test.exe (PID: 1304)

    • Creates files in the program directory

      • IDM1.tmp (PID: 3640)
      • wscript.exe (PID: 3588)

    • Uses TASKKILL.EXE to kill process

      • test.exe (PID: 1304)

    • Uses REG.EXE to modify Windows registry

      • test.exe (PID: 1304)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 1264)
      • iexplore.exe (PID: 2944)
      • chrome.exe (PID: 1272)
      • chrome.exe (PID: 3212)
      • chrome.exe (PID: 3320)
      • chrome.exe (PID: 1036)
      • chrome.exe (PID: 3972)
      • chrome.exe (PID: 3860)
      • chrome.exe (PID: 3332)
      • chrome.exe (PID: 2584)
      • chrome.exe (PID: 3204)
      • taskkill.exe (PID: 3992)
      • chrome.exe (PID: 1132)

    • Checks supported languages

      • iexplore.exe (PID: 2944)
      • iexplore.exe (PID: 1264)
      • chrome.exe (PID: 1272)
      • chrome.exe (PID: 2252)
      • chrome.exe (PID: 3212)
      • chrome.exe (PID: 3776)
      • chrome.exe (PID: 3140)
      • chrome.exe (PID: 3320)
      • chrome.exe (PID: 3500)
      • chrome.exe (PID: 1840)
      • chrome.exe (PID: 1036)
      • chrome.exe (PID: 3752)
      • chrome.exe (PID: 3728)
      • chrome.exe (PID: 2756)
      • chrome.exe (PID: 352)
      • chrome.exe (PID: 3972)
      • chrome.exe (PID: 1988)
      • chrome.exe (PID: 3860)
      • chrome.exe (PID: 3528)
      • chrome.exe (PID: 480)
      • chrome.exe (PID: 3152)
      • chrome.exe (PID: 968)
      • chrome.exe (PID: 3332)
      • chrome.exe (PID: 2584)
      • chrome.exe (PID: 304)
      • chrome.exe (PID: 3860)
      • chrome.exe (PID: 3860)
      • chrome.exe (PID: 3204)
      • chrome.exe (PID: 3564)
      • chrome.exe (PID: 1124)
      • taskkill.exe (PID: 3992)
      • reg.exe (PID: 3928)
      • chrome.exe (PID: 1132)

    • Changes internet zones settings

      • iexplore.exe (PID: 2944)

    • Application launched itself

      • iexplore.exe (PID: 2944)
      • chrome.exe (PID: 1272)

    • Manual execution by user

      • chrome.exe (PID: 1272)
      • test.exe (PID: 2728)
      • test.exe (PID: 1304)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 2944)
      • chrome.exe (PID: 1132)

    • Reads the hosts file

      • chrome.exe (PID: 1272)
      • chrome.exe (PID: 3212)

    • Reads settings of System Certificates

      • chrome.exe (PID: 3212)
      • chrome.exe (PID: 1272)
      • IDMan.exe (PID: 1964)

    • Checks Windows Trust Settings

      • chrome.exe (PID: 1272)
      • IDMan.exe (PID: 1964)
      • wscript.exe (PID: 3588)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
89
Monitored processes
42
Malicious processes
5
Suspicious processes
3

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start iexplore.exe no specs iexplore.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs idman640build11.exe no specs chrome.exe no specs idman640build11.exe chrome.exe no specs chrome.exe no specs idm1.tmp no specs idmbroker.exe no specs idman.exe no specs test.exe no specs test.exe wscript.exe chrome.exe no specs taskkill.exe no specs reg.exe no specs unsigner.exe

Process information

PID
CMD
Path
Indicators
Parent process
2944"C:\Program Files\Internet Explorer\iexplore.exe" "https://ly4ujziucz.slemmnp.tk/1.txt"C:\Program Files\Internet Explorer\iexplore.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
1264"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2944 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
1272"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
Explorer.EXE
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\winmm.dll
c:\windows\system32\user32.dll
2252"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=86.0.4240.198 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x6eb0d988,0x6eb0d998,0x6eb0d9a4C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
3320"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1032,12838671286459521698,5126343874368471945,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1052 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
3212"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1032,12838671286459521698,5126343874368471945,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1328 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
3140"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1032,12838671286459521698,5126343874368471945,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1940 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
3776"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1032,12838671286459521698,5126343874368471945,131072 --enable-features=PasswordImport --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1952 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
1840"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1032,12838671286459521698,5126343874368471945,131072 --enable-features=PasswordImport --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2276 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
3500"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1032,12838671286459521698,5126343874368471945,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
Total events
29 841
Read events
28 982
Write events
0
Delete events
0

Modification events

No data
Executable files
9
Suspicious files
139
Text files
102
Unknown types
23

Dropped files

PID
Process
Filename
Type
1272chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-628817C9-4F8.pma —
MD5:—
SHA256:—
2944iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF1FF835E1FF2AF5AB.TMPgmc
MD5:886F5393A2E198B9CA11831C07F95710
SHA256:520F63A503A14C76C801BC2B85F721E6C7F9E1142FEC8AF5FD3D5EE8B15D17DF
2944iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF8EBF876B4E5EE913.TMPgmc
MD5:2367A58B74D1D9F92C422E759D976A69
SHA256:C823031B69F85D3B7AB2FD7E21CD7523B35A272BAD9A28CBA65CB1DB0E1D38E3
2944iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFC039EA9596CDCF3B.TMPgmc
MD5:CE2B8FDF1C042277E1AA452F283184E3
SHA256:93F3D9F5A858AAD2ECABD478A07DC7EB3A4C46173492537750A13D39DABFDF33
2944iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{3095B06D-D88D-11EC-BF60-12A9866C77DE}.datbinary
MD5:A8CB3F8D799AEA09FD85B83B1B49BB68
SHA256:0BB964DB27DF0BB0D10B68334644526B45B5831DFB358701F02F73D218900974
2944iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\RecoveryStore.{42C873D0-1D90-11EB-BA2C-12A9866C77DE}.datbinary
MD5:F879D7CC98556EA324B4FAA65C7163DF
SHA256:26B0F9745E38C359E3C8D8A75107001624E7801E4849EB5EECD8CFB72A522F79
2944iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{3095B06F-D88D-11EC-BF60-12A9866C77DE}.datbinary
MD5:BB2EE95F662AFB2E485C365B30086A84
SHA256:4549F80BD807359CCB9664E9099C32AA4B1D2522C7D755DC7EE184F7986D5D70
2944iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\{3095B070-D88D-11EC-BF60-12A9866C77DE}.datbinary
MD5:F74434A727B8F4C6EEC063B6DA019414
SHA256:B280C9C3F281D9A8D6E1F6DDBD91ED547BC321D6107AB8984538C4B41E176101
2252chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pmabinary
MD5:03C4F648043A88675A920425D824E1B3
SHA256:F91DBB7C64B4582F529C968C480D2DCE1C8727390482F31E4355A27BB3D9B450
3212chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cache\indexbinary
MD5:FF2220C61A72C19B07CCB157F54587F4
SHA256:57E58A52E480E281A32A5395D6C43F4BF64DFA5E1E12DE24FC68D0149F1D87AB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
32
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3212
chrome.exe
GET
200
23.216.77.80:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?d818397021ff8279
US
compressed
60.0 Kb
whitelisted
3212
chrome.exe
GET
302
142.250.184.206:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx
US
html
591 b
whitelisted
3212
chrome.exe
GET
200
173.194.150.219:80
http://r5---sn-5goeen7r.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx?cms_redirect=yes&mh=e_&mip=196.196.52.6&mm=28&mn=sn-5goeen7r&ms=nvh&mt=1653085939&mv=m&mvi=5&pl=24&rmhost=r6---sn-5goeen7r.gvt1.com&shardbypass=sd&smhost=r5---sn-5goeen7y.gvt1.com
US
crx
242 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3212
chrome.exe
172.217.16.131:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
3212
chrome.exe
142.250.185.174:443
clients2.google.com
Google Inc.
US
whitelisted
3212
chrome.exe
142.250.186.173:443
accounts.google.com
Google Inc.
US
suspicious
3212
chrome.exe
142.250.185.110:443
apis.google.com
Google Inc.
US
whitelisted
3212
chrome.exe
142.250.185.196:443
www.google.com
Google Inc.
US
whitelisted
3212
chrome.exe
142.250.181.225:443
clients2.googleusercontent.com
Google Inc.
US
whitelisted
1264
iexplore.exe
172.67.186.19:443
ly4ujziucz.slemmnp.tk
—
US
malicious
3212
chrome.exe
142.250.185.163:443
www.gstatic.com
Google Inc.
US
whitelisted
3212
chrome.exe
172.217.16.138:443
fonts.googleapis.com
Google Inc.
US
whitelisted
3212
chrome.exe
104.21.84.39:443
ly4ujziucz.slemmnp.tk
Cloudflare Inc
US
unknown

DNS requests

Domain
IP
Reputation
ly4ujziucz.slemmnp.tk
  • 172.67.186.19
  • 104.21.84.39
malicious
clientservices.googleapis.com
  • 172.217.16.131
whitelisted
accounts.google.com
  • 142.250.186.173
shared
clients2.google.com
  • 142.250.185.174
whitelisted
www.google.com
  • 142.250.185.196
whitelisted
clients2.googleusercontent.com
  • 142.250.181.225
whitelisted
fonts.googleapis.com
  • 172.217.16.138
whitelisted
www.gstatic.com
  • 142.250.185.163
whitelisted
apis.google.com
  • 142.250.185.110
whitelisted
a.nel.cloudflare.com
  • 35.190.80.1
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query to a .tk domain - Likely Hostile
—
—
Potentially Bad Traffic
ET DNS Query to a .tk domain - Likely Hostile
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://ly4ujziucz.slemmnp.tk/1.txt