URL:

https://www.windows7download.com/win7-bonzi-buddy/download-rxcxenfb.html

Full analysis: https://app.any.run/tasks/2d1f965f-a534-4426-903a-fe589feb5064
Verdict: Malicious activity
Analysis date: February 28, 2024, 10:43:47
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

674EC784EB6C5B3E4FE522C4C2FC48C9

SHA1:

D6C50A4835BE84214EDC6CD2BEE3036B27670088

SHA256:

189904E6DF9571B06F6B07636FDA19B3A711F47B75369C6BD7B633DED5DD95E3

SSDEEP:

3:N8DSLjFnKCmHv4kX0uDQJ:2OLdKvutJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • BonziBuddy432.exe (PID: 3980)
      • tv_enua.exe (PID: 2128)
      • BonziBuddy432.exe (PID: 1728)

    • Changes the autorun value in the registry

      • tv_enua.exe (PID: 2128)

    • Creates a writable file in the system directory

      • tv_enua.exe (PID: 2128)

    • Registers / Runs the DLL via REGSVR32.EXE

      • tv_enua.exe (PID: 2128)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • BonziBuddy432.exe (PID: 3980)
      • tv_enua.exe (PID: 2128)
      • BonziBuddy432.exe (PID: 1728)

    • Executable content was dropped or overwritten

      • BonziBuddy432.exe (PID: 3980)
      • tv_enua.exe (PID: 2128)
      • BonziBuddy432.exe (PID: 1728)

    • Creates a software uninstall entry

      • BonziBuddy432.exe (PID: 3980)
      • tv_enua.exe (PID: 2128)
      • BonziBuddy432.exe (PID: 1728)

    • Creates/Modifies COM task schedule object

      • BonziBuddy432.exe (PID: 3980)
      • regsvr32.exe (PID: 2120)
      • regsvr32.exe (PID: 2940)
      • BonziBuddy432.exe (PID: 1728)

    • Reads the Internet Settings

      • BonziBuddy432.exe (PID: 3980)
      • wmplayer.exe (PID: 1596)
      • setup_wm.exe (PID: 1812)
      • BonziBuddy432.exe (PID: 1728)

    • Reads security settings of Internet Explorer

      • BonziBuddy432.exe (PID: 3980)
      • wmplayer.exe (PID: 1596)
      • setup_wm.exe (PID: 1812)
      • BonziBuddy432.exe (PID: 1728)

    • Starts CMD.EXE for commands execution

      • BonziBuddy432.exe (PID: 3980)
      • BonziBuddy432.exe (PID: 1728)

    • Executing commands from a ".bat" file

      • BonziBuddy432.exe (PID: 3980)
      • BonziBuddy432.exe (PID: 1728)

  • INFO

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3708)

    • Checks supported languages

      • BonziBuddy432.exe (PID: 3980)
      • MSAGENT.EXE (PID: 3444)
      • tv_enua.exe (PID: 2128)
      • wmplayer.exe (PID: 1596)
      • setup_wm.exe (PID: 1812)
      • BonziBuddy432.exe (PID: 2016)
      • BonziBuddy432.exe (PID: 1728)
      • MSAGENT.EXE (PID: 3932)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3348)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 3708)

    • The process uses the downloaded file

      • iexplore.exe (PID: 3348)

    • Reads the computer name

      • BonziBuddy432.exe (PID: 3980)
      • tv_enua.exe (PID: 2128)
      • wmplayer.exe (PID: 1596)
      • BonziBuddy432.exe (PID: 2016)
      • setup_wm.exe (PID: 1812)
      • BonziBuddy432.exe (PID: 1728)

    • Application launched itself

      • iexplore.exe (PID: 3348)
      • msedge.exe (PID: 1608)
      • msedge.exe (PID: 3260)
      • msedge.exe (PID: 3940)

    • Creates files in the program directory

      • BonziBuddy432.exe (PID: 3980)
      • BonziBuddy432.exe (PID: 1728)

    • Create files in a temporary directory

      • BonziBuddy432.exe (PID: 3980)
      • tv_enua.exe (PID: 2128)
      • setup_wm.exe (PID: 1812)
      • BonziBuddy432.exe (PID: 2016)
      • BonziBuddy432.exe (PID: 1728)

    • Creates files or folders in the user directory

      • BonziBuddy432.exe (PID: 3980)

    • Reads mouse settings

      • BonziBuddy432.exe (PID: 3980)
      • BonziBuddy432.exe (PID: 1728)

    • Manual execution by a user

      • msedge.exe (PID: 3260)
      • wmplayer.exe (PID: 1596)
      • BonziBuddy432.exe (PID: 2016)
      • BonziBuddy432.exe (PID: 2128)
      • BonziBuddy432.exe (PID: 2348)
      • BonziBuddy432.exe (PID: 1728)
      • explorer.exe (PID: 296)

    • Reads Environment values

      • setup_wm.exe (PID: 1812)

    • Reads the machine GUID from the registry

      • setup_wm.exe (PID: 1812)

    • Process checks computer location settings

      • setup_wm.exe (PID: 1812)

    • Checks proxy server information

      • setup_wm.exe (PID: 1812)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
102
Monitored processes
46
Malicious processes
5
Suspicious processes
2

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe iexplore.exe bonzibuddy432.exe no specs bonzibuddy432.exe cmd.exe no specs tv_enua.exe msagent.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs regsvr32.exe no specs regsvr32.exe no specs grpconv.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs wmplayer.exe no specs setup_wm.exe explorer.exe no specs bonzibuddy432.exe no specs bonzibuddy432.exe bonzibuddy432.exe no specs bonzibuddy432.exe cmd.exe no specs msagent.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
296"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
748"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3348 CREDAT:988441 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1020"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1196 --field-trial-handle=1268,i,12317205874989256796,7929829615632782821,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1172"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1248 --field-trial-handle=1316,i,18319293847973100622,5998117851974374878,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1548"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3784 --field-trial-handle=1316,i,18319293847973100622,5998117851974374878,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1556"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3544 --field-trial-handle=1316,i,18319293847973100622,5998117851974374878,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1592"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1428 --field-trial-handle=1268,i,12317205874989256796,7929829615632782821,131072 /prefetch:3C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1596"C:\Program Files\Windows Media Player\wmplayer.exe" /prefetch:1C:\Program Files\Windows Media Player\wmplayer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player
Exit code:
0
Version:
12.0.7601.23517 (win7sp1_ldr.160812-0732)
Modules
Images
c:\program files\windows media player\wmplayer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1608"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument http://bonzibuddy.tk/C:\Program Files\Microsoft\Edge\Application\msedge.exe—BonziBuddy432.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1728"C:\Users\admin\Downloads\BonziBuddy432.exe" C:\Users\admin\Downloads\BonziBuddy432.exe
explorer.exe
User:
admin
Company:
Bonzi Software
Integrity Level:
HIGH
Description:
BonziBuddy432 4 Installation
Exit code:
3221225547
Version:
4
Modules
Images
c:\users\admin\downloads\bonzibuddy432.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
61 551
Read events
60 350
Write events
767
Delete events
434

Modification events

(PID) Process:(3348) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3348) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
123992704
(PID) Process:(3348) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31091251
(PID) Process:(3348) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
424155204
(PID) Process:(3348) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31091251
(PID) Process:(3348) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3348) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3348) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3348) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3348) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
80
Suspicious files
118
Text files
578
Unknown types
107

Dropped files

PID
Process
Filename
Type
3708iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:A3E83983976824369105FB2B8DA67800
SHA256:AB1B07DBCB87632B224CDB4A634A8F00C13305CB2D79DE39B3714287BCAE70DA
3708iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\TF0JWWFH.txttext
MD5:2B7C92B912FB05DD2438BCAAB17CC583
SHA256:FFA0C2997B1C3DA97D3FE9258E9E6922E20800222A9DE743B6EFEAB0507F92FB
3708iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAder
MD5:CAA11E25E05806D8291BB6AA9922D368
SHA256:871C385776C3EF94D3B09C9A6C982480A33FFF198FA3C106047C3DB492AF087C
3708iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751binary
MD5:822467B728B7A66B081C91795373789A
SHA256:AF2343382B88335EEA72251AD84949E244FF54B6995063E24459A7216E9576B9
3708iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:121366102F905B8D1F7365563BA034AC
SHA256:CEF81500E4463B29A9A2D22E1AF64289F56A29B82ADB58897716B7167480FEC7
3708iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\download-rxcxenfb[1].htmhtml
MD5:D209BBC7ED5D1F2F63EB5BFDEFB7F77C
SHA256:B139AB416339FF44F146BFBE5BDA306A61CB9F73CBB2DD638D64B133F7D0287D
3708iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:C6CE22E145317BE1F3DE39551B5C1B5C
SHA256:632E17FC58E98CE713651BEF702B2CDB2D60F226EC2F7FBCC9BB41421D191C6C
3708iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\rating[1].csstext
MD5:FDDFBEB5892D4F867112A989EDF187A1
SHA256:4F861DE38EF4934745376B48CB698DB4C6ACB156378D0AEAF6778FE15185B787
3708iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\main[1].csstext
MD5:B9CD2D43FD364EAECB259B0694A63F5A
SHA256:850AD9918252F236F56B9262ED63DF37FBFE2B21B0669FEFEF6D8F75107E086D
3708iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419der
MD5:36FAC61743E405273BC3E5C76F30993B
SHA256:7C7BD64AC168CD144F3B5F5109452715E1A66A7D5222E83B0B3E8E543B437DED
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
40
TCP/UDP connections
202
DNS requests
99
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3708
iexplore.exe
GET
304
173.222.108.226:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c9f2b763ba05a2db
unknown
—
—
unknown
3708
iexplore.exe
GET
304
173.222.108.147:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?14266dff8470122f
unknown
—
—
unknown
3708
iexplore.exe
GET
200
23.192.153.142:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
3708
iexplore.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
3708
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
binary
471 b
unknown
3708
iexplore.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
binary
724 b
unknown
3708
iexplore.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFXRaa0xCYMwCsaHL3qLKxQ%3D
unknown
binary
471 b
unknown
3708
iexplore.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGHsycmQas7CCZXEOfu%2B%2Bqs%3D
unknown
binary
471 b
unknown
3708
iexplore.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDWcu1vhm%2F7Dgq%2BMnSH3EBn
unknown
binary
472 b
unknown
3708
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3708
iexplore.exe
193.203.165.208:443
www.windows7download.com
—
US
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3708
iexplore.exe
173.222.108.147:80
ctldl.windowsupdate.com
Akamai International B.V.
CH
unknown
3708
iexplore.exe
173.222.108.226:80
ctldl.windowsupdate.com
Akamai International B.V.
CH
unknown
3708
iexplore.exe
23.192.153.142:80
x1.c.lencr.org
AKAMAI-AS
GB
unknown
3708
iexplore.exe
216.58.212.132:443
www.google.com
GOOGLE
US
whitelisted
3708
iexplore.exe
142.250.186.34:443
pagead2.googlesyndication.com
GOOGLE
US
unknown
3708
iexplore.exe
93.184.220.66:443
platform.twitter.com
EDGECAST
GB
whitelisted

DNS requests

Domain
IP
Reputation
www.windows7download.com
  • 193.203.165.208
unknown
ctldl.windowsupdate.com
  • 173.222.108.147
  • 173.222.108.243
  • 173.222.108.226
  • 173.222.108.210
whitelisted
x1.c.lencr.org
  • 23.192.153.142
whitelisted
pagead2.googlesyndication.com
  • 142.250.186.34
whitelisted
www.google.com
  • 216.58.212.132
whitelisted
platform.twitter.com
  • 93.184.220.66
whitelisted
ocsp.pki.goog
  • 142.250.186.131
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
googleads.g.doubleclick.net
  • 142.250.185.98
whitelisted
www.gstatic.com
  • 142.250.74.195
whitelisted

Threats

PID
Process
Class
Message
3988
msedge.exe
Potentially Bad Traffic
ET DNS Query to a .tk domain - Likely Hostile
3988
msedge.exe
Potentially Bad Traffic
ET DNS Query to a .tk domain - Likely Hostile
3988
msedge.exe
Potentially Bad Traffic
ET DNS Query to a .tk domain - Likely Hostile
3988
msedge.exe
Potentially Bad Traffic
ET DNS Query to a .tk domain - Likely Hostile
3988
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] jQuery JavaScript Library Code Loaded (code.jquery .com)
3988
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
Process
Message
msedge.exe
[0228/104801.979:ERROR:exception_handler_server.cc(527)] ConnectNamedPipe: The pipe is being closed. (0xE8)
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.windows7download.com/win7-bonzi-buddy/download-rxcxenfb.html