URL:

http://webdefence.global.blackspider.com/urlwrap/?q=AXicFcqxDoIwFEDRx-TidziYUCwMoAlRY0iMEhcHw2RKW4Gk9DVtUfgrP1EZ7nQuLKBYB1AsA7BqimlDnH2TnnWKo_YWFeHYQ3Isr-3DVJssjbMUHNPCMiEPQlrH5uMftN4bt4sigdyRBrFRcqZo4Hs5GrQ-F_jRCplYdSKnz_slbL0ewluyfdE0OVcsPJlQ1pOthRlLAPjSAH7c3DNb&Z

Full analysis: https://app.any.run/tasks/eeb8b5c8-d5b1-4c24-8cca-99341b39b458
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: November 28, 2023, 16:33:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
remcos
Indicators:
SHA1:

06D97DD2B921877A3D83D4DB650AE9F252FD8E12

SHA256:

219E0552498B812DD2EC822BB3D99B52A0C42152B7058159E5B610F3C59CB081

SSDEEP:

6:COcuCugjiER0cr3KhGenzhmvZbDr1f0ylHmeuPqQTJfQYnAD:xDg3R1r3MGKQZbBdmeuPNJfQu6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts Visual C# compiler

      • B86D95DEDBF3E8812D138BC94FE38559ACF5AEB6679396261240.exe (PID: 880)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 3356)

    • Remcos is detected

      • csc.exe (PID: 2728)

    • REMCOS has been detected (YARA)

      • csc.exe (PID: 2728)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • B86D95DEDBF3E8812D138BC94FE38559ACF5AEB6679396261240.exe (PID: 880)

    • Connects to unusual port

      • csc.exe (PID: 2728)

    • Writes files like Keylogger logs

      • csc.exe (PID: 2728)

  • INFO

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2252)
      • wmpnscfg.exe (PID: 2520)

    • Application launched itself

      • iexplore.exe (PID: 948)

    • Reads the computer name

      • wmpnscfg.exe (PID: 2252)
      • wmpnscfg.exe (PID: 2520)
      • B86D95DEDBF3E8812D138BC94FE38559ACF5AEB6679396261240.exe (PID: 880)
      • csc.exe (PID: 2728)

    • Checks supported languages

      • wmpnscfg.exe (PID: 2252)
      • wmpnscfg.exe (PID: 2520)
      • B86D95DEDBF3E8812D138BC94FE38559ACF5AEB6679396261240.exe (PID: 880)
      • csc.exe (PID: 2728)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 2252)
      • wmpnscfg.exe (PID: 2520)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 3388)
      • iexplore.exe (PID: 948)

    • Reads Environment values

      • csc.exe (PID: 2728)

    • Reads product name

      • csc.exe (PID: 2728)

    • Creates files in the program directory

      • csc.exe (PID: 2728)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(2728) csc.exe
C2 (1)farsante9.con-ip.com:7770
BotnetCORONE
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-W9C5KV
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
11
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe wmpnscfg.exe no specs winrar.exe no specs wmpnscfg.exe no specs b86d95dedbf3e8812d138bc94fe38559acf5aeb6679396261240.exe no specs #REMCOS csc.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
880"C:\Users\admin\AppData\Local\Temp\Rar$EXb3388.24821\B86D95DEDBF3E8812D138BC94FE38559ACF5AEB6679396261240.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb3388.24821\B86D95DEDBF3E8812D138BC94FE38559ACF5AEB6679396261240.exe—WinRAR.exe
User:
admin
Company:
Jan Kolarik and Ondrej Vaverka
Integrity Level:
MEDIUM
Description:
InstantStorm Installer
Exit code:
4294967295
Version:
2.0.1
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb3388.24821\b86d95dedbf3e8812d138bc94fe38559acf5aeb6679396261240.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
948"C:\Program Files\Internet Explorer\iexplore.exe" "http://webdefence.global.blackspider.com/urlwrap/?q=AXicFcqxDoIwFEDRx-TidziYUCwMoAlRY0iMEhcHw2RKW4Gk9DVtUfgrP1EZ7nQuLKBYB1AsA7BqimlDnH2TnnWKo_YWFeHYQ3Isr-3DVJssjbMUHNPCMiEPQlrH5uMftN4bt4sigdyRBrFRcqZo4Hs5GrQ-F_jRCplYdSKnz_slbL0ewluyfdE0OVcsPJlQ1pOthRlLAPjSAH7c3DNb&Z"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1992schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\admin\AppData\Roaming\AppData\AppData.exe'" /fC:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2252"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
2496"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:948 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2520"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
2728"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
B86D95DEDBF3E8812D138BC94FE38559ACF5AEB6679396261240.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Remcos
(PID) Process(2728) csc.exe
C2 (1)farsante9.con-ip.com:7770
BotnetCORONE
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-W9C5KV
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
3288"cmd" /c copy "C:\Users\admin\AppData\Local\Temp\Rar$EXb3388.24821\B86D95DEDBF3E8812D138BC94FE38559ACF5AEB6679396261240.exe" "C:\Users\admin\AppData\Roaming\AppData\AppData.exe"C:\Windows\System32\cmd.exe—B86D95DEDBF3E8812D138BC94FE38559ACF5AEB6679396261240.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3332"cmd" /c mkdir "C:\Users\admin\AppData\Roaming\AppData"C:\Windows\System32\cmd.exe—B86D95DEDBF3E8812D138BC94FE38559ACF5AEB6679396261240.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3356"cmd" /c schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\admin\AppData\Roaming\AppData\AppData.exe'" /fC:\Windows\System32\cmd.exe—B86D95DEDBF3E8812D138BC94FE38559ACF5AEB6679396261240.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
21 619
Read events
21 541
Write events
72
Delete events
6

Modification events

(PID) Process:(948) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(948) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(948) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(948) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(948) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(948) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(948) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(948) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(948) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(948) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
24
Text files
16
Unknown types
0

Dropped files

PID
Process
Filename
Type
2496iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\bootstrap-responsive[1].csstext
MD5:F9DEE47322D809A5B97EFB10FF9E45E7
SHA256:E738183A60E8CF19E763729B96C19D0CCEE30F225E75AD61B8648A3CC7BFA969
2496iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\notification_page_logo_145x35[1].pngimage
MD5:22E1C1E59B39AAC2F6940CCD293018FD
SHA256:E8327C3DB89A35D3F9902126BFB4400C5AF64E30C70201724153377DC83B4638
2496iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\notification[1].csstext
MD5:D91B68ED1C96410948DEF0401E0E57D4
SHA256:2811D0858F7FD1BFE56B09E48364F36AEEF4783BD2A47E17B9F6BBC54D3F0F37
2496iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\warning[1].pngimage
MD5:77A3A0B185162C69866163A6EEB0E943
SHA256:322F28A6CD99566089B035E83C4F580504FC5142F62B8C758ECD896121D032ED
2496iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_5B1817C873771E7928FB0BB0A329932Bbinary
MD5:E8940CB6C5B8E6C5E846ABAC34C48495
SHA256:E490FAD3E9F62D6270A4D4AED67CE76017A732A1A800FAA3A26A33105172E363
2496iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:AC89A852C2AAA3D389B2D2DD312AD367
SHA256:0B720E19270C672F9B6E0EC40B468AC49376807DE08A814573FE038779534F45
3388WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3388.24821\B86D95DEDBF3E8812D138BC94FE38559ACF5AEB6679396261240.exe —
MD5:—
SHA256:—
2496iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:1589E7CFFD213B174295699D5E7744F9
SHA256:BFA94B5A9B4B62CA9D54C90FAD661DB6EADE4E4327253BA851285349380EAF15
948iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\versionlist.xmlxml
MD5:CBD0581678FA40F0EDCBC7C59E0CAD10
SHA256:159BD4343F344A08F6AF3B716B6FA679859C1BD1D7030D26FF5EF0255B86E1D9
2496iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:B31FB6DB81F98DCE137268C23E1E4D56
SHA256:783086623D85EE0416AF647D9F267612EA627F36CDB5135A55ED85C1C72C1186
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
29
DNS requests
18
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2496
iexplore.exe
GET
200
85.115.52.220:80
http://www.mailcontrol.com/http-resources/notification-pages/notification.css
unknown
text
5.06 Kb
unknown
2496
iexplore.exe
GET
403
85.115.58.180:80
http://webdefence.global.blackspider.com/urlwrap/?q=AXicFcqxDoIwFEDRx-TidziYUCwMoAlRY0iMEhcHw2RKW4Gk9DVtUfgrP1EZ7nQuLKBYB1AsA7BqimlDnH2TnnWKo_YWFeHYQ3Isr-3DVJssjbMUHNPCMiEPQlrH5uMftN4bt4sigdyRBrFRcqZo4Hs5GrQ-F_jRCplYdSKnz_slbL0ewluyfdE0OVcsPJlQ1pOthRlLAPjSAH7c3DNb&Z
unknown
html
5.23 Kb
unknown
2496
iexplore.exe
GET
200
85.115.52.220:80
http://www.mailcontrol.com/http-resources/notification-pages/2020/notification_page_logo_145x35.png
unknown
image
4.24 Kb
unknown
2496
iexplore.exe
GET
200
85.115.52.220:80
http://www.mailcontrol.com/http-resources/notification-pages/empty.js
unknown
—
—
unknown
2496
iexplore.exe
GET
200
85.115.52.220:80
http://www.mailcontrol.com/http-resources/bootstrap/css/bootstrap.css
unknown
text
14.2 Kb
unknown
2496
iexplore.exe
GET
200
85.115.52.220:80
http://www.mailcontrol.com/http-resources/bootstrap/css/bootstrap-responsive.css
unknown
text
2.74 Kb
unknown
2496
iexplore.exe
GET
200
85.115.52.220:80
http://www.mailcontrol.com/http-resources/notification-pages/icons60/warning.png
unknown
image
5.02 Kb
unknown
2496
iexplore.exe
GET
303
85.115.58.180:80
http://webdefence.global.blackspider.com/urlwrap/?q=AXicFcrNCoJAFEDh66pNz9EiUNMpNEH6h6gIooW4itGZ1Bi9w8yY9lY9Yrk4q-_ACA5TCw5jC5T4-F7haPV2alqJHBujUDg51kA2l3OZyHQWBn4YgKYNU5TxNeNK0-H4B6UxUkeuyzDXToFYCD6Q2-Yr3ktUJmbYNQIpm1Qs9h73k12aprWvZPn0AnJMqb2TNs8-KmOyv0C3VfvbK1qckyTyAzIPCcDXs-AHvQQ4Yg&action=scan
unknown
html
5.23 Kb
unknown
2496
iexplore.exe
GET
403
85.115.58.180:80
http://webdefence.global.blackspider.com/urlwrap/?q=AXicFczLagIxGAXguOqmz9GFkMl1_BNBehVKlULpQlyVTJKZaMfJmMzU-lZ9xOriwOHwcdANWk4naHk7Qak9c9YUOf0UB7NrbeyGFNvCxgMSj-tV2PRbqoArQNl0LhnnH5xP2VzFJSgMQ5_nhLhoMZUYJL60XDQxNq0fs0_XR98NV39FmWRvx-SzJcHQFLWAxo4WWnC-rr_z2IamDHCoekZC3JtQDsx5qU32tO57yi2nR77L1VHNCAPKmNKcl5RSQrXiZSklqJkGyiUTJZApYV-fbzgM3Yjfha4ZiNetwc899tU5Va7_Xd_7hYunro3G3Y3jzi38TPBSV4CVNRxLoyyu6tpjRcFeJg2V8ej0lF4-9vNytdnMOQipBEJ_bIL-AdhKavw&action=scan
unknown
html
5.00 Kb
unknown
2496
iexplore.exe
GET
200
85.115.52.220:80
http://www.mailcontrol.com/http-resources/notification-pages/icons60/success.png
unknown
image
6.40 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
2496
iexplore.exe
85.115.58.180:80
webdefence.global.blackspider.com
Forcepoint Cloud Ltd
DE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
948
iexplore.exe
204.79.197.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2496
iexplore.exe
85.115.52.220:80
www.mailcontrol.com
Forcepoint Cloud Ltd
GB
unknown
2496
iexplore.exe
142.250.181.225:443
doc-04-74-docs.googleusercontent.com
GOOGLE
US
unknown
2496
iexplore.exe
46.228.146.128:80
ctldl.windowsupdate.com
LLNW
US
unknown
2496
iexplore.exe
172.217.18.3:80
ocsp.pki.goog
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
webdefence.global.blackspider.com
  • 85.115.58.180
whitelisted
api.bing.com
  • 13.107.5.80
  • 13.107.13.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.mailcontrol.com
  • 85.115.52.220
whitelisted
doc-04-74-docs.googleusercontent.com
  • 142.250.181.225
unknown
ctldl.windowsupdate.com
  • 46.228.146.128
whitelisted
ocsp.pki.goog
  • 172.217.18.3
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted

Threats

PID
Process
Class
Message
2496
iexplore.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Downloading from a file sharing service is observed
1080
svchost.exe
Potentially Bad Traffic
ET INFO DNS Redirection Service Domain in DNS Lookup (con-ip .com)
1080
svchost.exe
Potentially Bad Traffic
ET INFO DNS Redirection Service Domain in DNS Lookup (con-ip .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://webdefence.global.blackspider.com/urlwrap/?q=AXicFcqxDoIwFEDRx-TidziYUCwMoAlRY0iMEhcHw2RKW4Gk9DVtUfgrP1EZ7nQuLKBYB1AsA7BqimlDnH2TnnWKo_YWFeHYQ3Isr-3DVJssjbMUHNPCMiEPQlrH5uMftN4bt4sigdyRBrFRcqZo4Hs5GrQ-F_jRCplYdSKnz_slbL0ewluyfdE0OVcsPJlQ1pOthRlLAPjSAH7c3DNb&Z