URL:

http://webdefence.global.blackspider.com/urlwrap/?q=AXicFcqxDoIwFEDRx-TidziYUCwMoAlRY0iMEhcHw2RKW4Gk9DVtUfgrP1EZ7nQuLKBYB1AsA7BqimlDnH2TnnWKo_YWFeHYQ3Isr-3DVJssjbMUHNPCMiEPQlrH5uMftN4bt4sigdyRBrFRcqZo4Hs5GrQ-F_jRCplYdSKnz_slbL0ewluyfdE0OVcsPJlQ1pOthRlLAPjSAH7c3DNb&Z

Full analysis: https://app.any.run/tasks/eeb8b5c8-d5b1-4c24-8cca-99341b39b458
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: November 28, 2023, 16:33:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
remcos
Indicators:
SHA1:

06D97DD2B921877A3D83D4DB650AE9F252FD8E12

SHA256:

219E0552498B812DD2EC822BB3D99B52A0C42152B7058159E5B610F3C59CB081

SSDEEP:

6:COcuCugjiER0cr3KhGenzhmvZbDr1f0ylHmeuPqQTJfQYnAD:xDg3R1r3MGKQZbBdmeuPNJfQu6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts Visual C# compiler

      • B86D95DEDBF3E8812D138BC94FE38559ACF5AEB6679396261240.exe (PID: 880)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 3356)

    • Remcos is detected

      • csc.exe (PID: 2728)

    • REMCOS has been detected (YARA)

      • csc.exe (PID: 2728)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • B86D95DEDBF3E8812D138BC94FE38559ACF5AEB6679396261240.exe (PID: 880)

    • Connects to unusual port

      • csc.exe (PID: 2728)

    • Writes files like Keylogger logs

      • csc.exe (PID: 2728)

  • INFO

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2252)
      • wmpnscfg.exe (PID: 2520)

    • Reads the computer name

      • wmpnscfg.exe (PID: 2252)
      • wmpnscfg.exe (PID: 2520)
      • B86D95DEDBF3E8812D138BC94FE38559ACF5AEB6679396261240.exe (PID: 880)
      • csc.exe (PID: 2728)

    • Application launched itself

      • iexplore.exe (PID: 948)

    • Checks supported languages

      • wmpnscfg.exe (PID: 2252)
      • wmpnscfg.exe (PID: 2520)
      • B86D95DEDBF3E8812D138BC94FE38559ACF5AEB6679396261240.exe (PID: 880)
      • csc.exe (PID: 2728)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 2252)
      • wmpnscfg.exe (PID: 2520)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 3388)
      • iexplore.exe (PID: 948)

    • Reads Environment values

      • csc.exe (PID: 2728)

    • Reads product name

      • csc.exe (PID: 2728)

    • Creates files in the program directory

      • csc.exe (PID: 2728)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(2728) csc.exe
C2 (1)farsante9.con-ip.com:7770
BotnetCORONE
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-W9C5KV
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
11
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe wmpnscfg.exe no specs winrar.exe no specs wmpnscfg.exe no specs b86d95dedbf3e8812d138bc94fe38559acf5aeb6679396261240.exe no specs #REMCOS csc.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
880"C:\Users\admin\AppData\Local\Temp\Rar$EXb3388.24821\B86D95DEDBF3E8812D138BC94FE38559ACF5AEB6679396261240.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb3388.24821\B86D95DEDBF3E8812D138BC94FE38559ACF5AEB6679396261240.exe—WinRAR.exe
User:
admin
Company:
Jan Kolarik and Ondrej Vaverka
Integrity Level:
MEDIUM
Description:
InstantStorm Installer
Exit code:
4294967295
Version:
2.0.1
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb3388.24821\b86d95dedbf3e8812d138bc94fe38559acf5aeb6679396261240.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
948"C:\Program Files\Internet Explorer\iexplore.exe" "http://webdefence.global.blackspider.com/urlwrap/?q=AXicFcqxDoIwFEDRx-TidziYUCwMoAlRY0iMEhcHw2RKW4Gk9DVtUfgrP1EZ7nQuLKBYB1AsA7BqimlDnH2TnnWKo_YWFeHYQ3Isr-3DVJssjbMUHNPCMiEPQlrH5uMftN4bt4sigdyRBrFRcqZo4Hs5GrQ-F_jRCplYdSKnz_slbL0ewluyfdE0OVcsPJlQ1pOthRlLAPjSAH7c3DNb&Z"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1992schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\admin\AppData\Roaming\AppData\AppData.exe'" /fC:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2252"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
2496"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:948 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2520"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
2728"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
B86D95DEDBF3E8812D138BC94FE38559ACF5AEB6679396261240.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Remcos
(PID) Process(2728) csc.exe
C2 (1)farsante9.con-ip.com:7770
BotnetCORONE
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-W9C5KV
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
3288"cmd" /c copy "C:\Users\admin\AppData\Local\Temp\Rar$EXb3388.24821\B86D95DEDBF3E8812D138BC94FE38559ACF5AEB6679396261240.exe" "C:\Users\admin\AppData\Roaming\AppData\AppData.exe"C:\Windows\System32\cmd.exe—B86D95DEDBF3E8812D138BC94FE38559ACF5AEB6679396261240.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3332"cmd" /c mkdir "C:\Users\admin\AppData\Roaming\AppData"C:\Windows\System32\cmd.exe—B86D95DEDBF3E8812D138BC94FE38559ACF5AEB6679396261240.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3356"cmd" /c schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\admin\AppData\Roaming\AppData\AppData.exe'" /fC:\Windows\System32\cmd.exe—B86D95DEDBF3E8812D138BC94FE38559ACF5AEB6679396261240.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
21 619
Read events
21 541
Write events
72
Delete events
6

Modification events

(PID) Process:(948) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(948) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(948) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(948) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(948) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(948) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(948) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(948) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(948) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(948) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
24
Text files
16
Unknown types
0

Dropped files

PID
Process
Filename
Type
2496iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\notification[1].csstext
MD5:D91B68ED1C96410948DEF0401E0E57D4
SHA256:2811D0858F7FD1BFE56B09E48364F36AEEF4783BD2A47E17B9F6BBC54D3F0F37
2496iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\notification_page_logo_145x35[1].pngimage
MD5:22E1C1E59B39AAC2F6940CCD293018FD
SHA256:E8327C3DB89A35D3F9902126BFB4400C5AF64E30C70201724153377DC83B4638
2496iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\warning[1].pngimage
MD5:77A3A0B185162C69866163A6EEB0E943
SHA256:322F28A6CD99566089B035E83C4F580504FC5142F62B8C758ECD896121D032ED
2496iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:AC89A852C2AAA3D389B2D2DD312AD367
SHA256:0B720E19270C672F9B6E0EC40B468AC49376807DE08A814573FE038779534F45
2496iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\bootstrap[1].csstext
MD5:AB3117DE176756AE49FE66166F1DBE72
SHA256:0A879254A8059FFCA5F46C30DA040F603B9A08EC9CF769B923294DA9E6669943
2496iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
3388WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3388.24821\B86D95DEDBF3E8812D138BC94FE38559ACF5AEB6679396261240.exe —
MD5:—
SHA256:—
2496iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:9167FB93ED753428877748BF394238BE
SHA256:3010C9B00619DE29ABB29CB5E1E26608A707A88FB93A8FF711BE52584E54F9AE
2496iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\bootstrap-responsive[1].csstext
MD5:F9DEE47322D809A5B97EFB10FF9E45E7
SHA256:E738183A60E8CF19E763729B96C19D0CCEE30F225E75AD61B8648A3CC7BFA969
2496iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\B86D95DEDBF3E8812D138BC94FE38559ACF5AEB6679396261240[1].tarcompressed
MD5:7235F496FF251E5BC6F6A0329275ED17
SHA256:5B98D1FF249A0F5C7958C8A79581E2E90ACFFA3BF5CE13580442681146BD0703
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
29
DNS requests
18
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1080
svchost.exe
GET
304
46.228.146.128:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?20da42ca9bb40799
unknown
—
—
unknown
2496
iexplore.exe
GET
200
172.217.18.3:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCJ5DpX%2ByioKAn%2FFc65x4nA
unknown
binary
472 b
unknown
948
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
2496
iexplore.exe
GET
403
85.115.58.180:80
http://webdefence.global.blackspider.com/urlwrap/?q=AXicFcqxDoIwFEDRx-TidziYUCwMoAlRY0iMEhcHw2RKW4Gk9DVtUfgrP1EZ7nQuLKBYB1AsA7BqimlDnH2TnnWKo_YWFeHYQ3Isr-3DVJssjbMUHNPCMiEPQlrH5uMftN4bt4sigdyRBrFRcqZo4Hs5GrQ-F_jRCplYdSKnz_slbL0ewluyfdE0OVcsPJlQ1pOthRlLAPjSAH7c3DNb&Z
unknown
html
5.23 Kb
unknown
2496
iexplore.exe
GET
200
85.115.52.220:80
http://www.mailcontrol.com/http-resources/notification-pages/notification.css
unknown
text
5.06 Kb
unknown
2496
iexplore.exe
GET
200
85.115.52.220:80
http://www.mailcontrol.com/http-resources/bootstrap/css/bootstrap-responsive.css
unknown
text
2.74 Kb
unknown
2496
iexplore.exe
GET
200
85.115.52.220:80
http://www.mailcontrol.com/http-resources/notification-pages/empty.js
unknown
—
—
unknown
2496
iexplore.exe
GET
200
85.115.52.220:80
http://www.mailcontrol.com/http-resources/notification-pages/2020/notification_page_logo_145x35.png
unknown
image
4.24 Kb
unknown
2496
iexplore.exe
GET
200
85.115.52.220:80
http://www.mailcontrol.com/http-resources/bootstrap/css/bootstrap.css
unknown
text
14.2 Kb
unknown
2496
iexplore.exe
GET
200
85.115.52.220:80
http://www.mailcontrol.com/http-resources/notification-pages/icons60/warning.png
unknown
image
5.02 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
2496
iexplore.exe
85.115.58.180:80
webdefence.global.blackspider.com
Forcepoint Cloud Ltd
DE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
948
iexplore.exe
204.79.197.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2496
iexplore.exe
85.115.52.220:80
www.mailcontrol.com
Forcepoint Cloud Ltd
GB
unknown
2496
iexplore.exe
142.250.181.225:443
doc-04-74-docs.googleusercontent.com
GOOGLE
US
unknown
2496
iexplore.exe
46.228.146.128:80
ctldl.windowsupdate.com
LLNW
US
unknown
2496
iexplore.exe
172.217.18.3:80
ocsp.pki.goog
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
webdefence.global.blackspider.com
  • 85.115.58.180
whitelisted
api.bing.com
  • 13.107.5.80
  • 13.107.13.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.mailcontrol.com
  • 85.115.52.220
whitelisted
doc-04-74-docs.googleusercontent.com
  • 142.250.181.225
unknown
ctldl.windowsupdate.com
  • 46.228.146.128
whitelisted
ocsp.pki.goog
  • 172.217.18.3
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted

Threats

PID
Process
Class
Message
2496
iexplore.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Downloading from a file sharing service is observed
1080
svchost.exe
Potentially Bad Traffic
ET INFO DNS Redirection Service Domain in DNS Lookup (con-ip .com)
1080
svchost.exe
Potentially Bad Traffic
ET INFO DNS Redirection Service Domain in DNS Lookup (con-ip .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://webdefence.global.blackspider.com/urlwrap/?q=AXicFcqxDoIwFEDRx-TidziYUCwMoAlRY0iMEhcHw2RKW4Gk9DVtUfgrP1EZ7nQuLKBYB1AsA7BqimlDnH2TnnWKo_YWFeHYQ3Isr-3DVJssjbMUHNPCMiEPQlrH5uMftN4bt4sigdyRBrFRcqZo4Hs5GrQ-F_jRCplYdSKnz_slbL0ewluyfdE0OVcsPJlQ1pOthRlLAPjSAH7c3DNb&Z