URL:

https://www.mediafire.com/file/c75i9epyym0zzx6/Ödeme+onaylama.tgz/file

Full analysis: https://app.any.run/tasks/71102462-f003-41b8-b08c-1ba2b3efa8e1
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Malware Trends Tracker     >>>
Analysis date: April 19, 2024, 10:53:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
exfiltration
stealer
agenttesla
ransomware
Indicators:
MD5:

92396AA76245EEA7594A9A3FEA4B4211

SHA1:

D229B5EA2A599C48990862A0B1CD20A3C6808674

SHA256:

35F24A5704DBC766E38CD1EE779F8A87587D8A76F2E047CAD40020087E7F1C42

SSDEEP:

3:N8DSLw3eGUoFwV5dUtAOKwxMO:2OLw3eGKV56IwKO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Steals credentials from Web Browsers

      • Ödeme onaylama.exe (PID: 864)
      • Ödeme onaylama.exe (PID: 2112)

    • Actions looks like stealing of personal data

      • Ödeme onaylama.exe (PID: 864)
      • Ödeme onaylama.exe (PID: 2112)

    • AGENTTESLA has been detected (YARA)

      • Ödeme onaylama.exe (PID: 864)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 2868)
      • Ödeme onaylama.exe (PID: 3468)
      • Ödeme onaylama.exe (PID: 2364)

    • Reads the Internet Settings

      • Ödeme onaylama.exe (PID: 3468)
      • Ödeme onaylama.exe (PID: 864)
      • Ödeme onaylama.exe (PID: 2364)

    • Application launched itself

      • Ödeme onaylama.exe (PID: 3468)
      • Ödeme onaylama.exe (PID: 2364)

    • Accesses Microsoft Outlook profiles

      • Ödeme onaylama.exe (PID: 864)
      • Ödeme onaylama.exe (PID: 2112)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • Ödeme onaylama.exe (PID: 864)

    • Non-standard symbols in registry

      • WINWORD.EXE (PID: 332)
      • WINWORD.EXE (PID: 2044)
      • WINWORD.EXE (PID: 1484)
      • WINWORD.EXE (PID: 1696)
      • WINWORD.EXE (PID: 3948)
      • WINWORD.EXE (PID: 2964)

    • Creates files like ransomware instruction

      • WINWORD.EXE (PID: 3948)

    • Reads settings of System Certificates

      • Ödeme onaylama.exe (PID: 864)

  • INFO

    • Checks supported languages

      • Ödeme onaylama.exe (PID: 3468)
      • Ödeme onaylama.exe (PID: 864)
      • Ödeme onaylama.exe (PID: 2364)
      • Ödeme onaylama.exe (PID: 2112)

    • The process uses the downloaded file

      • iexplore.exe (PID: 668)
      • WinRAR.exe (PID: 2868)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 668)

    • Application launched itself

      • iexplore.exe (PID: 668)

    • Reads the computer name

      • Ödeme onaylama.exe (PID: 3468)
      • Ödeme onaylama.exe (PID: 864)
      • Ödeme onaylama.exe (PID: 2364)
      • Ödeme onaylama.exe (PID: 2112)

    • Reads the machine GUID from the registry

      • Ödeme onaylama.exe (PID: 3468)
      • Ödeme onaylama.exe (PID: 864)
      • Ödeme onaylama.exe (PID: 2364)
      • Ödeme onaylama.exe (PID: 2112)

    • Reads Environment values

      • Ödeme onaylama.exe (PID: 864)
      • Ödeme onaylama.exe (PID: 2112)

    • Reads the software policy settings

      • Ödeme onaylama.exe (PID: 864)

    • Manual execution by a user

      • WINWORD.EXE (PID: 332)
      • WINWORD.EXE (PID: 2044)
      • WINWORD.EXE (PID: 3948)
      • WINWORD.EXE (PID: 1484)
      • WINWORD.EXE (PID: 1696)
      • WINWORD.EXE (PID: 2964)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
57
Monitored processes
14
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe winrar.exe no specs ödeme onaylama.exe no specs #AGENTTESLA ödeme onaylama.exe winword.exe no specs winword.exe no specs PhotoViewer.dll no specs winword.exe no specs winword.exe no specs winword.exe no specs ödeme onaylama.exe no specs winword.exe no specs ödeme onaylama.exe

Process information

PID
CMD
Path
Indicators
Parent process
332"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\structurehtml.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
668"C:\Program Files\Internet Explorer\iexplore.exe" "https://www.mediafire.com/file/c75i9epyym0zzx6/Ödeme+onaylama.tgz/file"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
864"C:\Users\admin\AppData\Local\Temp\Rar$EXa2868.34437\Ödeme onaylama.exe"C:\Users\admin\AppData\Local\Temp\Rar$EXa2868.34437\Ödeme onaylama.exe
Ödeme onaylama.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
Sync Settings
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2868.34437\ödeme onaylama.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1484"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\osterms.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
1696"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\incsources.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
2044"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\structurehtml.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
2112"C:\Users\admin\AppData\Local\Temp\Rar$EXa2868.42727\Ödeme onaylama.exe"C:\Users\admin\AppData\Local\Temp\Rar$EXa2868.42727\Ödeme onaylama.exe
Ödeme onaylama.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
Sync Settings
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2868.42727\ödeme onaylama.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2364"C:\Users\admin\AppData\Local\Temp\Rar$EXa2868.42727\Ödeme onaylama.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2868.42727\Ödeme onaylama.exe—WinRAR.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
Sync Settings
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2868.42727\ödeme onaylama.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2868"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\Ödeme onaylama.tgz"C:\Program Files\WinRAR\WinRAR.exe—iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2964"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\eventstue.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
Total events
62 840
Read events
59 750
Write events
1 171
Delete events
1 919

Modification events

(PID) Process:(668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31101511
(PID) Process:(668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31101511
(PID) Process:(668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(668) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
Executable files
0
Suspicious files
43
Text files
3
Unknown types
9

Dropped files

PID
Process
Filename
Type
2868WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2868.34437\Ödeme onaylama.exe —
MD5:—
SHA256:—
332WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR79BB.tmp.cvr —
MD5:—
SHA256:—
3248iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:6FCAAEA82BFBFD86EE72DB4062398D70
SHA256:D9738D634311F24FD058A40ADCC77F0D139226067B60029ADF9F9B3D08C6F656
3248iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\JPGK8V47.txttext
MD5:2B671ABF9EBD5E19F3D7712DD2369A63
SHA256:9AC28C46BFF8DE3E8F6BA2B0449EC1809624BC15767E68C6A97291E4D345002A
3248iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:BF6E15B60D117EB127910B9AFE67EE37
SHA256:904B354233252C89DF8227462F379C0D12935E3C368C27DD735744EC051BECFF
3248iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\8XDQC3Y6.txttext
MD5:39F5FA256FCEF7114A687876039809C8
SHA256:0E8F4673FFAECEBA3792103F3476A7109ADD0B239829B1F9387B7564A6D98501
3248iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833Bder
MD5:DE5E3E962273C537E694280BC1A70BE0
SHA256:B0384D1A041385A7295AC4791C4F613BD8C3FA2BA5FFD57C461A43A56CD14098
3248iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Eder
MD5:B99EAC298DFA3B38B4A15EED0281A110
SHA256:CBD1DF8269DCFFCC61FC0ABC2D14CF4CD231A9246EED4A5C7E9CBBF553D1CC20
3248iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833Bbinary
MD5:A48C32D0C42E5A529B61053D6463E19F
SHA256:922843F7C72C1410C4A630F7EBD974B4A92C5F30A1205A8A584093301EFAC1F4
2044WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVRB33A.tmp.cvr —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
19
DNS requests
14
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3248
iexplore.exe
GET
304
173.222.108.210:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?7f68a02ba6df2d36
unknown
—
—
unknown
3248
iexplore.exe
GET
304
173.222.108.226:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?501143bdbf2f2bd6
unknown
—
—
unknown
3248
iexplore.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
—
—
unknown
3248
iexplore.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEBN9U5yqfDGppDNwGWiEeo0%3D
unknown
—
—
unknown
3248
iexplore.exe
GET
200
172.64.149.23:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQh80WaEMqmyEvaHjlisSfVM4p8SAQUF9nWJSdn%2BTHCSUPZMDZEjGypT%2BsCED%2B0KeRQ8NP60VP53TIby3A%3D
unknown
—
—
unknown
1080
svchost.exe
GET
304
2.16.100.168:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3296167e77a9461d
unknown
—
—
unknown
668
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
1080
svchost.exe
GET
200
2.16.100.168:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?2c6b76ad7be093c1
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3248
iexplore.exe
104.16.114.74:443
www.mediafire.com
CLOUDFLARENET
—
unknown
3248
iexplore.exe
173.222.108.226:80
ctldl.windowsupdate.com
Akamai International B.V.
CH
unknown
3248
iexplore.exe
173.222.108.210:80
ctldl.windowsupdate.com
Akamai International B.V.
CH
unknown
3248
iexplore.exe
172.64.149.23:80
ocsp.comodoca.com
CLOUDFLARENET
US
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3248
iexplore.exe
199.91.155.176:443
download2435.mediafire.com
MEDIAFIRE
US
unknown
1080
svchost.exe
2.16.100.168:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
www.mediafire.com
  • 104.16.114.74
  • 104.16.113.74
shared
ctldl.windowsupdate.com
  • 173.222.108.226
  • 173.222.108.210
  • 2.16.100.168
  • 88.221.110.91
whitelisted
ocsp.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
ocsp.usertrust.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
download2435.mediafire.com
  • 199.91.155.176
unknown
ocsp.sectigo.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
api.telegram.org
  • 149.154.167.220
shared
ocsp.digicert.com
  • 192.229.221.95
whitelisted

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
1080
svchost.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain in DNS Lookup (download .mediafire .com)
1080
svchost.exe
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
864
Ödeme onaylama.exe
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
864
Ödeme onaylama.exe
Misc activity
ET HUNTING Telegram API Certificate Observed
—
—
Successful Credential Theft Detected
STEALER [ANY.RUN] Attempt to exfiltrate via Telegram
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.mediafire.com/file/c75i9epyym0zzx6/Ödeme+onaylama.tgz/file