analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

BPS_Questionnaire.html

Full analysis: https://app.any.run/tasks/ce508759-c8b1-4d01-84a8-3982c3cbc9f0
Verdict: Malicious activity
Analysis date: January 24, 2022, 18:58:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/html
File info: HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
MD5:

09BFEC2FF940DEAC8CDFC0EFE2EFAC9B

SHA1:

02E3DA2A9683F0CD13F404B775C16A6CF87B83DE

SHA256:

3179F925294771977304BCB7936C03EC31C38A9FBAE8CD80A59150702C06B11F

SSDEEP:

1536:WsFv6eBoRbjQHuhw+E3mazA/PWrF7qvEAFiQcpm8tpHzyJRT9UEpdm3BPdBF:UxpQBDbyJ3UEpdmRN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2080)
      • iexplore.exe (PID: 2684)
  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 2164)
      • iexplore.exe (PID: 2080)
      • iexplore.exe (PID: 2684)
      • iexplore.exe (PID: 2152)
      • chrome.exe (PID: 3748)
      • chrome.exe (PID: 1944)
      • chrome.exe (PID: 3568)
      • chrome.exe (PID: 2544)
      • chrome.exe (PID: 3684)
      • chrome.exe (PID: 3912)
      • chrome.exe (PID: 392)
      • chrome.exe (PID: 4020)
      • chrome.exe (PID: 3316)
      • chrome.exe (PID: 2280)
      • chrome.exe (PID: 2832)
      • chrome.exe (PID: 572)
      • chrome.exe (PID: 1908)
      • chrome.exe (PID: 272)
      • chrome.exe (PID: 1356)
      • chrome.exe (PID: 3172)
      • chrome.exe (PID: 4040)
      • chrome.exe (PID: 3072)
    • Reads the computer name

      • iexplore.exe (PID: 2080)
      • iexplore.exe (PID: 2164)
      • iexplore.exe (PID: 2684)
      • iexplore.exe (PID: 2152)
      • chrome.exe (PID: 3748)
      • chrome.exe (PID: 3684)
      • chrome.exe (PID: 3568)
      • chrome.exe (PID: 2832)
      • chrome.exe (PID: 3316)
      • chrome.exe (PID: 572)
      • chrome.exe (PID: 4040)
      • chrome.exe (PID: 272)
    • Changes internet zones settings

      • iexplore.exe (PID: 2164)
    • Application launched itself

      • iexplore.exe (PID: 2164)
      • iexplore.exe (PID: 2080)
      • chrome.exe (PID: 3748)
    • Reads settings of System Certificates

      • iexplore.exe (PID: 2080)
      • iexplore.exe (PID: 2164)
      • iexplore.exe (PID: 2684)
      • chrome.exe (PID: 3684)
    • Reads internet explorer settings

      • iexplore.exe (PID: 2080)
      • iexplore.exe (PID: 2684)
    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2684)
      • iexplore.exe (PID: 2080)
      • iexplore.exe (PID: 2164)
    • Manual execution by user

      • chrome.exe (PID: 3748)
    • Reads the date of Windows installation

      • iexplore.exe (PID: 2164)
      • chrome.exe (PID: 272)
    • Reads the hosts file

      • chrome.exe (PID: 3684)
      • chrome.exe (PID: 3748)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.htm/html | HyperText Markup Language with DOCTYPE (80.6)
.html | HyperText Markup Language (19.3)

EXIF

HTML

Robots: noindex, nofollow
Pragma: no-cache
viewport: width=device-width, initial-scale=1.0, maximum-scale=2.0, user-scalable=yes
HTTPEquivXUACompatible: IE=edge
ContentType: text/html; charset=UTF-8
Title: Sign in to Outlook
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
59
Monitored processes
22
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe iexplore.exe iexplore.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2164"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\admin\Desktop\BPS_Questionnaire.html.htm"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2080"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2164 CREDAT:144385 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2684"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2164 CREDAT:472067 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2152"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2164 CREDAT:398593 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exeiexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3748"C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\admin\Desktop\BPS_Questionnaire.html.htmC:\Program Files\Google\Chrome\Application\chrome.exe
Explorer.EXE
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\winmm.dll
c:\windows\system32\user32.dll
1944"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=86.0.4240.198 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x6e69d988,0x6e69d998,0x6e69d9a4C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
3568"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1048,12924473439598006625,7862315712220082556,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1056 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
3684"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1048,12924473439598006625,7862315712220082556,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1408 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
2544"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1048,12924473439598006625,7862315712220082556,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1800 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\gdi32.dll
2280"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1048,12924473439598006625,7862315712220082556,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1968 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
Total events
71 712
Read events
71 460
Write events
101
Delete events
0

Modification events

(PID) Process:(2164) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2164) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(2164) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30937428
(PID) Process:(2164) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(2164) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30937428
(PID) Process:(2164) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2164) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2164) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2164) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2164) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
27
Text files
84
Unknown types
10

Dropped files

PID
Process
Filename
Type
3748chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-61EEF6F1-EA4.pma
MD5:
SHA256:
2164iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF930BE57117C38282.TMPgmc
MD5:291AFB0B8D3A99E6DBFFAED92F9BC451
SHA256:71218564B9AA7FCEDAE72D23B2D835CBEA224947BCE435A27443C533AE3BEE35
2164iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF9409541C3F25F6B1.TMPgmc
MD5:B671D47D894069926B52E1051A19EA58
SHA256:AFE13D8C5BBC33370CAF659A2B353854E5F17BF432366588713F4805B6A348E0
2164iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF23A2108DB5D88A01.TMPgmc
MD5:88DDAB7AA25D89DDE67DEF21258ACF53
SHA256:CF407A55CFBC44D936E9EF13CDC4CF715B6C3FF8956DB0DAB5DDEB33016D872A
2164iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF0CC2BF315427941B.TMPgmc
MD5:6AC24FCC107D32BCABE9A8C0F81FB090
SHA256:6B4C722740838048EEDA06E8C541714B9B6CDF6692E54179D9883886B1AD0E67
2164iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\RecoveryStore.{42C873D0-1D90-11EB-BA2C-12A9866C77DE}.datbinary
MD5:897E053B9AC2E36150A95419E3F4A48D
SHA256:232EFB6429621172353EADD3FD3B857E2FCD7D25480F15F95EC3C4F04EBE2829
2164iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{A3404B18-7D47-11EC-A45D-12A9866C77DE}.datbinary
MD5:E877943669C8F0BE09F2086E4166FB38
SHA256:EFFF423D194E93CFB1EDECC5CD5802DE1EE6815312F1202915F95FB318C992A9
2164iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\{A3404B19-7D47-11EC-A45D-12A9866C77DE}.datbinary
MD5:67139719FC05E501815DF4CEE603EB6B
SHA256:061ABFB83B3250BC3CD47B38EF66F39D935026C214E40CB728D33FF8E21C8EB3
2164iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFD7DA683B9775A413.TMPgmc
MD5:F7BE3F513B29A7A406A0E8585AA927B3
SHA256:7EC6D0C314F78B655F97556F48F16339AD96FDF2D7A4F542F2051F878C78D00D
2164iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\{A3404B1A-7D47-11EC-A45D-12A9866C77DE}.datbinary
MD5:DE8DAA033CB96E3C2851BB044AE359D4
SHA256:63B135745EB81D8B0D4425CBF8AA63FFB7B7B4AA07FC2C190786D51ED0EAFDAA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
92
DNS requests
35
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2080
iexplore.exe
GET
404
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?25222f7879693b01
US
xml
341 b
whitelisted
2080
iexplore.exe
GET
404
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?947d32a7b9376366
US
xml
341 b
whitelisted
2080
iexplore.exe
GET
404
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?27601d183b3e5060
US
xml
341 b
whitelisted
2080
iexplore.exe
GET
404
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?341d40dd9ba389c0
US
xml
341 b
whitelisted
2080
iexplore.exe
GET
404
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0a01374e6e0a8a32
US
xml
341 b
whitelisted
2080
iexplore.exe
GET
404
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d621dc28be75dcd2
US
xml
341 b
whitelisted
2080
iexplore.exe
GET
404
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0d1bdb96a60dc4c4
US
xml
341 b
whitelisted
2080
iexplore.exe
GET
404
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4d35c7a8d574e1ed
US
xml
341 b
whitelisted
2684
iexplore.exe
GET
404
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?cf2cebbc1367b887
US
xml
341 b
whitelisted
2080
iexplore.exe
GET
404
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b48d66bc5942eece
US
xml
341 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2080
iexplore.exe
152.199.23.37:443
aadcdn.msftauth.net
MCI Communications Services, Inc. d/b/a Verizon Business
US
suspicious
2080
iexplore.exe
142.250.185.202:443
ajax.googleapis.com
Google Inc.
US
whitelisted
2684
iexplore.exe
142.250.185.202:443
ajax.googleapis.com
Google Inc.
US
whitelisted
2080
iexplore.exe
104.16.18.94:443
cdnjs.cloudflare.com
Cloudflare Inc
US
unknown
2684
iexplore.exe
104.16.18.94:443
cdnjs.cloudflare.com
Cloudflare Inc
US
unknown
2080
iexplore.exe
104.16.85.20:443
cdn.jsdelivr.net
Cloudflare Inc
US
shared
2684
iexplore.exe
152.199.23.37:443
aadcdn.msftauth.net
MCI Communications Services, Inc. d/b/a Verizon Business
US
suspicious
2164
iexplore.exe
13.107.21.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
3684
chrome.exe
142.250.185.110:443
clients2.google.com
Google Inc.
US
whitelisted
2080
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
cdn.jsdelivr.net
  • 104.16.85.20
  • 104.16.87.20
  • 104.16.86.20
  • 104.16.89.20
  • 104.16.88.20
whitelisted
cdnjs.cloudflare.com
  • 104.16.18.94
  • 104.16.19.94
whitelisted
ajax.googleapis.com
  • 142.250.185.202
whitelisted
aadcdn.msftauth.net
  • 152.199.23.37
whitelisted
ctldl.windowsupdate.com
  • 209.197.3.8
  • 67.27.157.126
  • 67.27.158.126
  • 67.26.73.254
  • 8.248.135.254
  • 67.26.75.254
  • 8.253.207.121
  • 8.248.143.254
  • 8.248.149.254
  • 8.253.204.249
whitelisted
api.bing.com
  • 13.107.13.80
whitelisted
www.bing.com
  • 13.107.21.200
  • 204.79.197.200
whitelisted
clientservices.googleapis.com
  • 142.250.186.163
whitelisted
accounts.google.com
  • 216.58.212.173
shared
clients2.google.com
  • 142.250.185.110
whitelisted

Threats

Found threats are available for the paid subscriptions
25 ETPRO signatures available at the full report
No debug info