URL:

https://www.freedownloadmanager.org/de/

Full analysis: https://app.any.run/tasks/e4d32b57-f8d3-4010-801f-6b47ddda423a
Verdict: Malicious activity
Analysis date: January 20, 2024, 21:15:32
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

EE839B8EA23D7C07EAD7A4AD7BC383C5

SHA1:

A95C9CAD3C71771E9E4B443BFD7AC9E82513A983

SHA256:

3403EB1CAECD8A64C91CF8FB561141690AF0DB6762EB29941EA3BD01AED21C81

SSDEEP:

3:N8DSLLHKVELUXoCKBv:2OLHwXiBv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • fdm_x86_setup.exe (PID: 2300)
      • fdm_x86_setup.tmp (PID: 1560)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • fdm_x86_setup.exe (PID: 2300)
      • fdm_x86_setup.tmp (PID: 1560)

    • Reads the Windows owner or organization settings

      • fdm_x86_setup.tmp (PID: 1560)

    • Process drops legitimate windows executable

      • fdm_x86_setup.tmp (PID: 1560)

    • The process drops C-runtime libraries

      • fdm_x86_setup.tmp (PID: 1560)

    • Searches for installed software

      • fdm5rhwin.exe (PID: 1904)
      • fdm5rhwin.exe (PID: 2452)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • fdm_x86_setup.tmp (PID: 1560)

    • Reads settings of System Certificates

      • fdm.exe (PID: 3860)

    • Reads the Internet Settings

      • fdm.exe (PID: 3860)

    • Detected use of alternative data streams (AltDS)

      • fdm.exe (PID: 3860)

  • INFO

    • Checks supported languages

      • fdm_x86_setup.exe (PID: 2300)
      • fdm_x86_setup.tmp (PID: 1560)
      • fdm.exe (PID: 2468)
      • importwizard.exe (PID: 2472)
      • importwizard.exe (PID: 1696)
      • fdm5rhwin.exe (PID: 1904)
      • fdm5rhwin.exe (PID: 2452)
      • fdm.exe (PID: 3860)

    • Application launched itself

      • iexplore.exe (PID: 128)
      • msedge.exe (PID: 2396)
      • msedge.exe (PID: 712)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 128)
      • iexplore.exe (PID: 324)

    • Create files in a temporary directory

      • fdm_x86_setup.exe (PID: 2300)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 128)
      • iexplore.exe (PID: 324)

    • Reads the computer name

      • fdm_x86_setup.tmp (PID: 1560)
      • fdm.exe (PID: 3860)

    • Creates files or folders in the user directory

      • fdm_x86_setup.tmp (PID: 1560)
      • fdm.exe (PID: 2468)
      • importwizard.exe (PID: 2472)
      • fdm.exe (PID: 3860)

    • The process uses the downloaded file

      • iexplore.exe (PID: 128)

    • Reads the machine GUID from the registry

      • importwizard.exe (PID: 2472)
      • fdm.exe (PID: 2468)
      • fdm.exe (PID: 3860)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
82
Monitored processes
38
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe fdm_x86_setup.exe fdm_x86_setup.tmp fdm.exe no specs importwizard.exe no specs msedge.exe msedge.exe no specs fdm5rhwin.exe no specs netsh.exe no specs fdm5rhwin.exe no specs netsh.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs fdm.exe importwizard.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
128"C:\Program Files\Internet Explorer\iexplore.exe" "https://www.freedownloadmanager.org/de/"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
324"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:128 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
552"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=4128 --field-trial-handle=1352,i,6657598182320903922,16807188393336457443,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
568"netsh.exe" firewall add allowedprogram program="C:\Users\admin\AppData\Local\Softdeluxe\Free Download Manager\fdm.exe" name="Free Download Manager" ENABLE scope=ALL profile=ALLC:\Windows\System32\netsh.exe—fdm_x86_setup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
712"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument https://up.freedownloadmanager.org/fdm6/js_stat.php?navigate_to_mosaic=1C:\Program Files\Microsoft\Edge\Application\msedge.exe—fdm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
900"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1656 --field-trial-handle=1352,i,6657598182320903922,16807188393336457443,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
984"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd8,0x67a2f598,0x67a2f5a8,0x67a2f5b4C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1348"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3612 --field-trial-handle=1352,i,6657598182320903922,16807188393336457443,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1560"C:\Users\admin\AppData\Local\Temp\is-3MK9I.tmp\fdm_x86_setup.tmp" /SL5="$5012E,30407919,832512,C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\fdm_x86_setup.exe" C:\Users\admin\AppData\Local\Temp\is-3MK9I.tmp\fdm_x86_setup.tmp
fdm_x86_setup.exe
User:
admin
Company:
Softdeluxe
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-3mk9i.tmp\fdm_x86_setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1696"C:\Users\admin\AppData\Local\Softdeluxe\Free Download Manager\importwizard" 3FE02402165644D986B63DE6638495E4 --printFdm5Setting=ExpectingUpdateToVersionC:\Users\admin\AppData\Local\Softdeluxe\Free Download Manager\importwizard.exe—fdm.exe
User:
admin
Company:
Softdeluxe
Integrity Level:
MEDIUM
Description:
Free Download Manager
Exit code:
0
Version:
6.20.0.5470
Modules
Images
c:\users\admin\appdata\local\softdeluxe\free download manager\importwizard.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\softdeluxe\free download manager\downloadsbt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
Total events
21 813
Read events
21 598
Write events
206
Delete events
9

Modification events

(PID) Process:(128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
328
Suspicious files
1 170
Text files
1 188
Unknown types
1

Dropped files

PID
Process
Filename
Type
324iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\69A2B743B21A661E2D8481F6714631F5binary
MD5:2CD391DA4DE5A0DA964BC7891036D9EB
SHA256:805CCB9171B08F3D21BBD59C34642BE4FA0B084DC3B18F7CF3A9E9D919449B68
324iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:00A79041157BFEB9FD2628ACD8A7C4FC
SHA256:9EB423E8217E7CD7B2CE9BD04FD836CB7FE032B648CD9C7A4E51310F7F35C742
324iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:6E01D6FBC25A3766F311EF6C52E62AE2
SHA256:67326F22FBD67C81F817D126414F68C04DB9A88F6D3760D1C2BE49AB1BF3A0D6
324iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dbinary
MD5:EFECD7703517F67B82F7D9A0328ED24C
SHA256:FB44A2CB05939272924EF67E8AEB2BE9FA64BE25CE784DBF4FAC1D344E557B57
324iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\HSW3ANKI.txttext
MD5:B67DC7A3067B3AB917DE4F5E25B3C4E8
SHA256:8B552D4A83F30A66A9B125E85393B8FC720208B3F288E6CA523B8BFEDAB11CF8
324iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\QQDHICYI.htmhtml
MD5:EAE204E4D247932CEEFFEF88C931B46B
SHA256:244A945095CE0A3193041A5D74EDB562FAC553E3CE4C662E6A2F82131138954E
324iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:762D00211C776F90396D39D0A6D4610E
SHA256:1FC9DC1AF8733AF9CBF9A8853C57EC34E32697B706631244D91E400FF78A62CB
128iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Ader
MD5:DC773EB5215DD40A9F2C4010EA4EEA5A
SHA256:817E8124BD7A58457256526950D6E9007D560AE36671DF32063E569959E2684D
324iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:15D22736539E2E520B46FFB64890E01D
SHA256:DEE40678A0B9786F1BC61464CD07C3C21252FFC714FB8DA7490008B80844B70C
324iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
94
DNS requests
76
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
324
iexplore.exe
GET
200
23.48.23.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?53bfb7cf8a6cf97e
unknown
compressed
4.66 Kb
—
324
iexplore.exe
GET
200
23.48.23.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?129d20c84d8c4223
unknown
compressed
4.66 Kb
—
324
iexplore.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
binary
1.42 Kb
—
324
iexplore.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
unknown
binary
2.18 Kb
—
324
iexplore.exe
GET
200
172.64.149.23:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEBcgMFNs1IxELXRLakhmVrg%3D
unknown
binary
471 b
—
324
iexplore.exe
GET
200
142.250.185.163:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
—
324
iexplore.exe
GET
200
142.250.185.163:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
binary
724 b
—
324
iexplore.exe
GET
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQD7vSzSbK8Z0QnHSrEZ7mPf
unknown
binary
472 b
—
128
iexplore.exe
GET
304
23.48.23.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?08d91df001b427ad
unknown
—
—
—
128
iexplore.exe
GET
304
23.48.23.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?ca04fd3518ca5bb7
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
324
iexplore.exe
74.117.181.203:443
www.freedownloadmanager.org
WZCOM
US
unknown
324
iexplore.exe
23.48.23.8:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
324
iexplore.exe
172.64.149.23:80
ocsp.comodoca.com
CLOUDFLARENET
US
unknown
324
iexplore.exe
104.18.38.233:80
ocsp.comodoca.com
CLOUDFLARENET
—
unknown
324
iexplore.exe
142.250.184.200:443
www.googletagmanager.com
GOOGLE
US
unknown
324
iexplore.exe
142.250.185.163:80
ocsp.pki.goog
GOOGLE
US
unknown
128
iexplore.exe
104.126.37.153:443
www.bing.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
www.freedownloadmanager.org
  • 74.117.181.203
unknown
api.bing.com
  • 13.107.5.80
unknown
www.bing.com
  • 104.126.37.153
  • 104.126.37.186
  • 104.126.37.163
  • 104.126.37.131
  • 104.126.37.145
  • 104.126.37.128
  • 104.126.37.139
  • 104.126.37.161
  • 104.126.37.130
  • 104.126.37.123
  • 104.126.37.177
  • 104.126.37.137
unknown
ctldl.windowsupdate.com
  • 23.48.23.8
  • 23.48.23.67
  • 23.48.23.34
  • 23.48.23.7
unknown
ocsp.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
unknown
ocsp.usertrust.com
  • 104.18.38.233
  • 172.64.149.23
unknown
ocsp.sectigo.com
  • 172.64.149.23
  • 104.18.38.233
unknown
www.googletagmanager.com
  • 142.250.184.200
unknown
ocsp.pki.goog
  • 142.250.185.163
unknown
ocsp.digicert.com
  • 192.229.221.95
unknown

Threats

No threats detected
Process
Message
msedge.exe
[0120/211949.516:ERROR:exception_handler_server.cc(527)] ConnectNamedPipe: The pipe is being closed. (0xE8)
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.freedownloadmanager.org/de/