URL:

https://monect.com

Full analysis: https://app.any.run/tasks/69348647-02b4-4b24-b173-3c8db70a1de3
Verdict: Malicious activity
Analysis date: March 21, 2024, 13:16:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

C7F79DAB2E42B3EBD54EA6B48BBAB72E

SHA1:

EFD565C152915D21576BED42C3CA0C5C0D6B4151

SHA256:

357E2F94846528AE9517ED3CA55261DBC356709291CC00A1BE2B79A5F0B30313

SSDEEP:

3:N8ptLK:2e

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • PCRemoteReceiverSetup_7_5_14.exe (PID: 2748)
      • vc_redist.x64.exe (PID: 3600)
      • vc_redist.x64.exe (PID: 2032)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • PCRemoteReceiverSetup_7_5_14.exe (PID: 2748)
      • vc_redist.x64.exe (PID: 2032)

    • Reads the Internet Settings

      • taskmgr.exe (PID: 2804)

    • Drops a system driver (possible attempt to evade defenses)

      • PCRemoteReceiverSetup_7_5_14.exe (PID: 2748)

    • Uses TASKKILL.EXE to kill process

      • PCRemoteReceiverSetup_7_5_14.exe (PID: 2748)

    • Executable content was dropped or overwritten

      • PCRemoteReceiverSetup_7_5_14.exe (PID: 2748)
      • vc_redist.x64.exe (PID: 2032)
      • vc_redist.x64.exe (PID: 3600)

    • Starts a Microsoft application from unusual location

      • vc_redist.x64.exe (PID: 3600)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • PCRemoteReceiverSetup_7_5_14.exe (PID: 2748)

    • Searches for installed software

      • vc_redist.x64.exe (PID: 3600)

    • The process creates files with name similar to system file names

      • PCRemoteReceiverSetup_7_5_14.exe (PID: 2748)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2120)

    • Reads the time zone

      • perfmon.exe (PID: 1544)

    • Reads the computer name

      • PCRemoteReceiverSetup_7_5_14.exe (PID: 2748)
      • vc_redist.x64.exe (PID: 3600)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2120)

    • Creates files or folders in the user directory

      • perfmon.exe (PID: 1544)

    • Create files in a temporary directory

      • PCRemoteReceiverSetup_7_5_14.exe (PID: 2748)
      • vc_redist.x64.exe (PID: 3600)

    • The process uses the downloaded file

      • iexplore.exe (PID: 2120)

    • Creates files in the program directory

      • PCRemoteReceiverSetup_7_5_14.exe (PID: 2748)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 3276)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3276)

    • Manual execution by a user

      • taskmgr.exe (PID: 2804)

    • Reads security settings of Internet Explorer

      • taskmgr.exe (PID: 2804)

    • Checks supported languages

      • PCRemoteReceiverSetup_7_5_14.exe (PID: 2748)
      • vc_redist.x64.exe (PID: 2032)
      • vc_redist.x64.exe (PID: 3600)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
66
Monitored processes
14
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe taskmgr.exe no specs perfmon.exe pcremotereceiversetup_7_5_14.exe no specs pcremotereceiversetup_7_5_14.exe taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs vc_redist.x64.exe vc_redist.x64.exe

Process information

PID
CMD
Path
Indicators
Parent process
552"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\PCRemoteReceiverSetup_7_5_14.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\PCRemoteReceiverSetup_7_5_14.exe—iexplore.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\po2hn1x2\pcremotereceiversetup_7_5_14.exe
c:\windows\system32\ntdll.dll
896TaskKill /IM MonectMediaCenter.exe /F /TC:\Windows\System32\taskkill.exe—PCRemoteReceiverSetup_7_5_14.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
1424TaskKill /IM MonectRuntimeCheck.exe /F /TC:\Windows\System32\taskkill.exe—PCRemoteReceiverSetup_7_5_14.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
1504TaskKill /IM MonectServerService.exe /F /TC:\Windows\System32\taskkill.exe—PCRemoteReceiverSetup_7_5_14.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
1544"C:\Windows\System32\perfmon.exe" /resC:\Windows\System32\perfmon.exe
taskmgr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Resource and Performance Monitor
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\perfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2032"C:\Program Files\PC Remote Receiver\Packages\vc_redist.x64.exe" /install /quiet /norestartC:\Program Files\PC Remote Receiver\Packages\vc_redist.x64.exe
PCRemoteReceiverSetup_7_5_14.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508
Exit code:
1
Version:
14.25.28508.3
Modules
Images
c:\program files\pc remote receiver\packages\vc_redist.x64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2120"C:\Program Files\Internet Explorer\iexplore.exe" "https://monect.com"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2748"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\PCRemoteReceiverSetup_7_5_14.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\PCRemoteReceiverSetup_7_5_14.exe
iexplore.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\po2hn1x2\pcremotereceiversetup_7_5_14.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
2804"C:\Windows\system32\taskmgr.exe" /4C:\Windows\System32\taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3020TaskKill /IM driververifyx64.exe /F /TC:\Windows\System32\taskkill.exe—PCRemoteReceiverSetup_7_5_14.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
Total events
30 703
Read events
30 535
Write events
116
Delete events
52

Modification events

(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31095697
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
204106142
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31095698
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
46
Suspicious files
93
Text files
80
Unknown types
17

Dropped files

PID
Process
Filename
Type
3276iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_99430B8B5F4E113F6193E2BF9312EF16binary
MD5:131FF71A06F3E4EF33CE4D31B6BD7B0B
SHA256:9844BDD279DF8751624939F88CA3A88B7EBCAB6699F7AF7FBBA68934FD824598
3276iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:AC89A852C2AAA3D389B2D2DD312AD367
SHA256:0B720E19270C672F9B6E0EC40B468AC49376807DE08A814573FE038779534F45
3276iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\B4IJF2UR.txttext
MD5:6D27F7B9584D80A7113FBAFA17E3CAB5
SHA256:250DA78EA98CE39AEC7DCC26FF39094976E7947CCD141CCB82BB85C74C1F1F6F
3276iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\4LVPXIH0.htmhtml
MD5:3B01CDB0C75C4C0D35E567303C18B52D
SHA256:4AAD5B8DBE5DB5435789F3BB037AAFCBD21B066A0EF32E8D6DCBFE47D370AC2F
3276iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:5E045F61CA5B9FF8F8207AC0B2231366
SHA256:EF6FB5E270BEFCF0E4FED2EFDFED9FFA006BE798F66729344466669CEDAE5E71
3276iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\js[1].jstext
MD5:96E0C6180F75145ADF825728C8B1700D
SHA256:F561BCB64EAE03A1AE5806C79191833B698951232268585FFB4F947B8DCF078E
3276iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\js[1].jstext
MD5:5FC7B80160F48C98AA7689394D74FB19
SHA256:725142B61A4AEB1FD4D51028DD2AF09F45265FBC2E97EDF08961A0D0CA5157F1
3276iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:7202528E67C3B5557F0979684F0F6D7F
SHA256:4EA485782A3B34E0D5FD3B27D8B414371AD3FBF7DD2E6D9960D45492B0DAE92E
3276iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\analytics[1].jstext
MD5:575B5480531DA4D14E7453E2016FE0BC
SHA256:DE36E50194320A7D3EF1ACE9BD34A875A8BD458B253C061979DD628E9BF49AFD
3276iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\HVC7NCML.txttext
MD5:F7B309BEECAE51AAD0B5A64BEA6C566D
SHA256:D072DE1F608BDE6832C3E8DDB18BD5B3E4814B8CD97920962E60E311648FD30F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
26
TCP/UDP connections
65
DNS requests
35
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3276
iexplore.exe
GET
304
23.32.238.179:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5259f1aa84763c8c
unknown
—
—
unknown
3276
iexplore.exe
GET
200
142.250.181.227:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQD6BeWhIbleexId20FpK0af
unknown
binary
472 b
unknown
3276
iexplore.exe
GET
200
18.245.39.64:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkzUBtJnwJkc3SmanzgxeYU%3D
unknown
binary
1.37 Kb
unknown
2120
iexplore.exe
GET
304
23.32.238.179:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?dca56d26e7d9ce15
unknown
—
—
unknown
3276
iexplore.exe
GET
200
18.173.208.27:80
http://ocsp.r2m03.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEAxq4xEG3d0NvPVQimdGKqQ%3D
unknown
binary
471 b
unknown
3276
iexplore.exe
GET
200
142.250.181.227:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFCjJ1PwkYAi7fE%3D
unknown
binary
724 b
unknown
3276
iexplore.exe
GET
200
142.250.181.227:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDvxruPIA7HMxBTUJjmrhMX
unknown
binary
472 b
unknown
3276
iexplore.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd
unknown
binary
979 b
unknown
3276
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
binary
471 b
unknown
2120
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3276
iexplore.exe
20.119.8.26:443
monect.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3276
iexplore.exe
23.32.238.179:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
2120
iexplore.exe
104.126.37.139:443
www.bing.com
Akamai International B.V.
DE
unknown
3276
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3276
iexplore.exe
142.250.185.72:443
www.googletagmanager.com
GOOGLE
US
unknown
3276
iexplore.exe
18.66.112.73:443
cloudfront.monect.com
AMAZON-02
US
unknown

DNS requests

Domain
IP
Reputation
monect.com
  • 20.119.8.26
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.137
  • 104.126.37.138
  • 104.126.37.136
  • 104.126.37.144
  • 104.126.37.147
  • 104.126.37.131
  • 104.126.37.130
  • 104.126.37.139
  • 104.126.37.146
whitelisted
ctldl.windowsupdate.com
  • 23.32.238.179
  • 23.32.238.185
  • 23.32.238.201
  • 23.32.238.195
  • 23.32.238.192
  • 23.32.238.171
  • 23.32.238.178
  • 23.32.238.169
  • 23.32.238.176
  • 23.32.238.240
  • 23.32.238.234
  • 23.32.238.224
  • 23.32.238.219
  • 23.32.238.216
  • 23.32.238.208
  • 23.32.238.203
  • 23.32.238.210
  • 23.32.238.209
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.googletagmanager.com
  • 142.250.185.72
whitelisted
cloudfront.monect.com
  • 18.66.112.73
  • 18.66.112.77
  • 18.66.112.100
  • 18.66.112.28
unknown
o.ss2.us
  • 108.138.2.173
  • 108.138.2.10
  • 108.138.2.107
  • 108.138.2.195
whitelisted
ocsp.pki.goog
  • 142.250.181.227
whitelisted
ocsp.rootg2.amazontrust.com
  • 18.245.39.64
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://monect.com