URL:

https://startxp.blogspot.com/2011/12/transform-windows-xp-to-windows-xp.html

Full analysis: https://app.any.run/tasks/752c8f4a-857e-401e-83ac-c1dbc998c522
Verdict: Malicious activity
Analysis date: January 14, 2024, 13:21:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

FBDFC5F24AC3EC82F423B06571B91755

SHA1:

76983AB9F2ADD916C60303023CDF86DB9BDF615A

SHA256:

2204EF703CF9D338249705AA0A535BD46310BC59649352A8ED0D07CF40768070

SSDEEP:

3:N8cWCSKMjMJMYkLM1JhuJ:2c+KJ+VAhuJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WMCSetup.exe (PID: 3544)
      • WMCSetup.exe (PID: 532)

    • Creates a writable file in the system directory

      • WMCSetup.exe (PID: 3544)
      • WMCSetup.exe (PID: 532)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 3072)
      • WMCSetup.exe (PID: 3544)
      • WMCSetup.exe (PID: 532)

    • Executable content was dropped or overwritten

      • WMCSetup.exe (PID: 3544)
      • WMCSetup.exe (PID: 532)

    • Uses TASKKILL.EXE to kill process

      • WMCSetup.exe (PID: 3544)
      • WMCSetup.exe (PID: 532)

    • Reads the Internet Settings

      • WMCSetup.exe (PID: 3544)
      • WMCSetup.exe (PID: 532)

    • The process drops C-runtime libraries

      • WMCSetup.exe (PID: 3544)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 116)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3072)

    • Manual execution by a user

      • explorer.exe (PID: 2824)
      • WMCSetup.exe (PID: 3544)
      • WMCSetup.exe (PID: 3352)
      • WMCSetup.exe (PID: 3316)
      • WMCSetup.exe (PID: 2836)
      • WMCSetup.exe (PID: 3948)
      • WMCSetup.exe (PID: 532)

    • Reads the computer name

      • WMCSetup.exe (PID: 3544)
      • WMCSetup.exe (PID: 532)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3072)

    • Create files in a temporary directory

      • WMCSetup.exe (PID: 3544)
      • WMCSetup.exe (PID: 532)
      • WMCSetup.exe (PID: 3948)

    • Checks supported languages

      • WMCSetup.exe (PID: 3544)
      • WMCSetup.exe (PID: 3948)
      • WMCSetup.exe (PID: 532)

    • Creates files in the program directory

      • WMCSetup.exe (PID: 3544)
      • WMCSetup.exe (PID: 532)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 3072)
      • iexplore.exe (PID: 116)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
123
Monitored processes
45
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe iexplore.exe notepad.exe no specs iexplore.exe winrar.exe explorer.exe no specs wmcsetup.exe no specs wmcsetup.exe taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs wmcsetup.exe no specs wmcsetup.exe wmcsetup.exe no specs wmcsetup.exe taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Program Files\Internet Explorer\iexplore.exe" "https://startxp.blogspot.com/2011/12/transform-windows-xp-to-windows-xp.html"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
532"C:\Users\admin\Downloads\WMC\WMCSetup.exe" C:\Users\admin\Downloads\WMC\WMCSetup.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Media Center 5.1.2715.2883 Installation
Exit code:
0
Version:
5.1.2715.2883
Modules
Images
c:\users\admin\downloads\wmc\wmcsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
548"C:\Windows\system32\taskkill.exe" /IM PlaylistEditor2.EXE /FC:\Windows\System32\taskkill.exe—WMCSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
604"C:\Windows\system32\taskkill.exe" /IM ehmsas.exe /FC:\Windows\System32\taskkill.exe—WMCSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
632"C:\Windows\system32\taskkill.exe" /IM ehSched.exe /FC:\Windows\System32\taskkill.exe—WMCSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
876"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\password.txtC:\Windows\System32\notepad.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1020"C:\Windows\system32\taskkill.exe" /IM ehRecvr.exe /FC:\Windows\System32\taskkill.exe—WMCSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
1124"C:\Windows\system32\taskkill.exe" /IM ehtray.exe /FC:\Windows\System32\taskkill.exe—WMCSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
1192"C:\Windows\system32\taskkill.exe" /IM MCAlarmClock2.EXE /FC:\Windows\System32\taskkill.exe—WMCSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
1344"C:\Windows\system32\taskkill.exe" /IM ehtray.exe /FC:\Windows\System32\taskkill.exe—WMCSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
Total events
41 036
Read events
40 891
Write events
139
Delete events
6

Modification events

(PID) Process:(116) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(116) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(116) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(116) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(116) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(116) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(116) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(116) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(116) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(116) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
43
Suspicious files
128
Text files
192
Unknown types
1

Dropped files

PID
Process
Filename
Type
2204iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:20CE1CBD35EB79A2357DC2B632E64CED
SHA256:CEAE62B00544ED92D4A3B5C2B15B181EBFC8AF1030B2E55FDAE5204FB341B762
2204iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:AC89A852C2AAA3D389B2D2DD312AD367
SHA256:0B720E19270C672F9B6E0EC40B468AC49376807DE08A814573FE038779534F45
2204iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:7E91BEB29775F35A61E605D0D8020E26
SHA256:E1A09596A526835DBF915761E39B9CD514CF91A6BECAB6AACEF237C734C8C0AA
2204iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\57646_orig[1].gifimage
MD5:9FE227C4190C4E1C4ACBB7F1043F5CAB
SHA256:4166E0BE497B1B3CEDAC45616E94E21A01C2AD5E7563E449BE72A4645D993EC6
2204iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:8875F2AE6B79E9FE4345B51B979C2EE4
SHA256:BA7148E8B4B723405FF820C1821A654AD9644AF72D030511A00D771C2C7FA6E4
2204iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\C4XYTWOR.txttext
MD5:45A7F0EC405AB3EEEE31FA02CDD50B23
SHA256:8C77AAB1F529180338DAEE3952CEF24C3ABE99AE24FF3450642C261CEFA6D44D
2204iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:D54F8FE4A2AF7A244A87165235149D1E
SHA256:033A7CC897501229031A840916C83E209AA5C284463D65F31717E3AC3C5B5554
2204iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_1A6A086B46FB1AFB553FBDB33100231Abinary
MD5:6F0A97C03FEF2DF81FE0C181C52761E9
SHA256:69BF19DA237C833ECE686B2D98E31C19C99414BDF15F1E9EDDA2E5117E87B5CC
2204iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_1A6A086B46FB1AFB553FBDB33100231Abinary
MD5:9CC3838D10F33B3D34BDC624D678B2F0
SHA256:54A51F9DE2C917711055A9D920A0F92BC2D099425AB35F6322F16E8214ECB62D
2204iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\Windows XP MCE Logon Screen[1].jpgimage
MD5:D7F8FF6CFEF4AED9A9AA00284D1BEF03
SHA256:3C92D66A995001852B076CC06045806DAEEF609EBE63A132E2B41E7C5BAA9CB2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
50
TCP/UDP connections
162
DNS requests
73
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2204
iexplore.exe
GET
200
184.24.77.182:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?53bfb7cf8a6cf97e
unknown
compressed
4.66 Kb
unknown
2204
iexplore.exe
GET
200
184.24.77.182:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?129d20c84d8c4223
unknown
compressed
4.66 Kb
unknown
2204
iexplore.exe
GET
200
142.250.186.163:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
2204
iexplore.exe
GET
200
142.250.186.163:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
binary
724 b
unknown
2204
iexplore.exe
GET
200
142.250.186.163:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDKQsBn6nCGUBDp%2FB3PG718
unknown
binary
472 b
unknown
2204
iexplore.exe
GET
200
142.250.186.163:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDG7Gp%2BrTCD1hArSp%2FkcvFM
unknown
binary
472 b
unknown
2204
iexplore.exe
GET
200
108.138.2.173:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
unknown
binary
2.02 Kb
unknown
2204
iexplore.exe
GET
200
142.250.186.163:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC5%2FhCRnQlmBhDwKO62wv3c
unknown
binary
472 b
unknown
2204
iexplore.exe
GET
200
142.250.186.163:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQD2CljflQhiLwnqCuPAdwck
unknown
binary
472 b
unknown
2204
iexplore.exe
GET
200
18.245.39.64:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
unknown
binary
1.49 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
2204
iexplore.exe
142.250.184.193:443
startxp.blogspot.com
GOOGLE
US
whitelisted
2204
iexplore.exe
184.24.77.182:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2204
iexplore.exe
142.250.186.163:80
ocsp.pki.goog
GOOGLE
US
whitelisted
2204
iexplore.exe
172.217.18.105:443
www.blogger.com
GOOGLE
US
unknown
2204
iexplore.exe
143.204.215.89:443
i897.photobucket.com
AMAZON-02
US
unknown
2204
iexplore.exe
142.250.184.238:443
apis.google.com
GOOGLE
US
whitelisted
2204
iexplore.exe
216.58.206.33:443
1.bp.blogspot.com
GOOGLE
US
unknown

DNS requests

Domain
IP
Reputation
startxp.blogspot.com
  • 142.250.184.193
unknown
ctldl.windowsupdate.com
  • 184.24.77.182
  • 184.24.77.192
  • 184.24.77.176
  • 184.24.77.211
  • 184.24.77.174
  • 184.24.77.187
  • 184.24.77.186
  • 184.24.77.206
  • 184.24.77.172
  • 184.24.77.194
  • 184.24.77.196
  • 184.24.77.193
  • 178.79.208.1
whitelisted
ocsp.pki.goog
  • 142.250.186.163
  • 172.217.18.3
whitelisted
www.blogger.com
  • 172.217.18.105
shared
apis.google.com
  • 142.250.184.238
whitelisted
i897.photobucket.com
  • 143.204.215.89
  • 143.204.215.54
  • 143.204.215.71
  • 143.204.215.78
unknown
1.bp.blogspot.com
  • 216.58.206.33
whitelisted
2.bp.blogspot.com
  • 216.58.206.33
whitelisted
resources.blogblog.com
  • 172.217.18.105
whitelisted
blogger.googleusercontent.com
  • 142.250.181.225
whitelisted

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
1080
svchost.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain in DNS Lookup (download .mediafire .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://startxp.blogspot.com/2011/12/transform-windows-xp-to-windows-xp.html