URL:

http://prkrls.info/wprt41?x=Cobalt+strike+license+key

Full analysis: https://app.any.run/tasks/0e0248cd-eb0a-49b5-b002-155f48428a4e
Verdict: Malicious activity
Analysis date: February 15, 2020, 20:41:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

71BF3DB257273AADFA9918DE76C1E1B3

SHA1:

5733DF7F3B633B9198DA5DC084A01F05C618AECD

SHA256:

3664ADF632035D5B645F9B73183B9840F2E5E3B324B5ED1517ED5A0F3CC10DE9

SSDEEP:

3:N1KOX47RgRkwrJH+n:COXnSwrc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • cobalt strike license key_163102.exe (PID: 3140)
      • cobalt strike license key_163102.exe (PID: 3760)
      • cobalt strike license key_163102.exe (PID: 4012)
      • cobalt strike license key_163102.exe (PID: 2640)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • cobalt strike license key_163102.exe (PID: 3760)
      • cobalt strike license key_163102.tmp (PID: 3304)
      • WinRAR.exe (PID: 3720)
      • cobalt strike license key_163102.exe (PID: 3140)
      • cobalt strike license key_163102.exe (PID: 4012)
      • cobalt strike license key_163102.exe (PID: 2640)
      • cobalt strike license key_163102.tmp (PID: 3536)

    • Reads the Windows organization settings

      • cobalt strike license key_163102.tmp (PID: 3304)
      • cobalt strike license key_163102.tmp (PID: 3536)

    • Reads Windows owner or organization settings

      • cobalt strike license key_163102.tmp (PID: 3304)
      • cobalt strike license key_163102.tmp (PID: 3536)

  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3824)
      • iexplore.exe (PID: 780)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3824)

    • Changes internet zones settings

      • iexplore.exe (PID: 780)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 780)

    • Manual execution by user

      • cobalt strike license key_163102.exe (PID: 3140)

    • Application was dropped or rewritten from another process

      • cobalt strike license key_163102.tmp (PID: 3972)
      • cobalt strike license key_163102.tmp (PID: 3304)
      • Suscipit.exe (PID: 2820)
      • cobalt strike license key_163102.tmp (PID: 2364)
      • cobalt strike license key_163102.tmp (PID: 3536)
      • Suscipit.exe (PID: 3764)

    • Creates files in the user directory

      • iexplore.exe (PID: 3824)
      • iexplore.exe (PID: 780)

    • Loads dropped or rewritten executable

      • cobalt strike license key_163102.tmp (PID: 3536)
      • cobalt strike license key_163102.tmp (PID: 3304)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3824)
      • iexplore.exe (PID: 780)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 780)

    • Changes settings of System certificates

      • iexplore.exe (PID: 780)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
55
Monitored processes
13
Malicious processes
1
Suspicious processes
4

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe winrar.exe cobalt strike license key_163102.exe cobalt strike license key_163102.tmp no specs cobalt strike license key_163102.exe cobalt strike license key_163102.tmp suscipit.exe cobalt strike license key_163102.exe cobalt strike license key_163102.tmp no specs cobalt strike license key_163102.exe cobalt strike license key_163102.tmp suscipit.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
780"C:\Program Files\Internet Explorer\iexplore.exe" "http://prkrls.info/wprt41?x=Cobalt+strike+license+key"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2364"C:\Users\admin\AppData\Local\Temp\is-1N8O1.tmp\cobalt strike license key_163102.tmp" /SL5="$701F2,5138411,119296,C:\Users\admin\AppData\Local\Temp\Rar$EXa3720.42777\cobalt strike license key_163102.exe" C:\Users\admin\AppData\Local\Temp\is-1N8O1.tmp\cobalt strike license key_163102.tmp—cobalt strike license key_163102.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
1
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-1n8o1.tmp\cobalt strike license key_163102.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2640"C:\Users\admin\AppData\Local\Temp\Rar$EXa3720.42777\cobalt strike license key_163102.exe" /SPAWNWND=$901DC /NOTIFYWND=$701F2 C:\Users\admin\AppData\Local\Temp\Rar$EXa3720.42777\cobalt strike license key_163102.exe
cobalt strike license key_163102.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
Magni ipsam 644bd10f09e78140c6fd43c8748de0e5 vero quam
Exit code:
1
Version:
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3720.42777\cobalt strike license key_163102.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2820"C:\Users\admin\AppData\Local\Temp\is-OL3SV.tmp\Suscipit.exe" 644bd10f09e78140c6fd43c8748de0e5C:\Users\admin\AppData\Local\Temp\is-OL3SV.tmp\Suscipit.exe
cobalt strike license key_163102.tmp
User:
admin
Company:
Nanogi Upalo
Integrity Level:
HIGH
Description:
Holierty
Exit code:
0
Version:
2.25.6.41
Modules
Images
c:\users\admin\appdata\local\temp\is-ol3sv.tmp\suscipit.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
3140"C:\Users\admin\Desktop\cobalt strike license key_163102.exe" C:\Users\admin\Desktop\cobalt strike license key_163102.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Magni ipsam 644bd10f09e78140c6fd43c8748de0e5 vero quam
Exit code:
0
Version:
Modules
Images
c:\users\admin\desktop\cobalt strike license key_163102.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3304"C:\Users\admin\AppData\Local\Temp\is-8AE6C.tmp\cobalt strike license key_163102.tmp" /SL5="$901AE,5138411,119296,C:\Users\admin\Desktop\cobalt strike license key_163102.exe" /SPAWNWND=$801FC /NOTIFYWND=$50292 C:\Users\admin\AppData\Local\Temp\is-8AE6C.tmp\cobalt strike license key_163102.tmp
cobalt strike license key_163102.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-8ae6c.tmp\cobalt strike license key_163102.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3536"C:\Users\admin\AppData\Local\Temp\is-5FP5K.tmp\cobalt strike license key_163102.tmp" /SL5="$14025A,5138411,119296,C:\Users\admin\AppData\Local\Temp\Rar$EXa3720.42777\cobalt strike license key_163102.exe" /SPAWNWND=$901DC /NOTIFYWND=$701F2 C:\Users\admin\AppData\Local\Temp\is-5FP5K.tmp\cobalt strike license key_163102.tmp
cobalt strike license key_163102.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
1
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-5fp5k.tmp\cobalt strike license key_163102.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3720"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\cobalt strike license key_163102.zip"C:\Program Files\WinRAR\WinRAR.exe
iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3760"C:\Users\admin\Desktop\cobalt strike license key_163102.exe" /SPAWNWND=$801FC /NOTIFYWND=$50292 C:\Users\admin\Desktop\cobalt strike license key_163102.exe
cobalt strike license key_163102.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
Magni ipsam 644bd10f09e78140c6fd43c8748de0e5 vero quam
Exit code:
0
Version:
Modules
Images
c:\users\admin\desktop\cobalt strike license key_163102.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3764"C:\Users\admin\AppData\Local\Temp\is-5UKDD.tmp\Suscipit.exe" 644bd10f09e78140c6fd43c8748de0e5C:\Users\admin\AppData\Local\Temp\is-5UKDD.tmp\Suscipit.exe—cobalt strike license key_163102.tmp
User:
admin
Company:
Nanogi Upalo
Integrity Level:
HIGH
Description:
Holierty
Exit code:
0
Version:
2.25.6.41
Modules
Images
c:\users\admin\appdata\local\temp\is-5ukdd.tmp\suscipit.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
Total events
6 727
Read events
1 979
Write events
3 184
Delete events
1 564

Modification events

(PID) Process:(780) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
1753447464
(PID) Process:(780) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30794816
(PID) Process:(780) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(780) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(780) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(780) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(780) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(780) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A1000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(780) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(780) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
9
Suspicious files
23
Text files
13
Unknown types
8

Dropped files

PID
Process
Filename
Type
3824iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab7150.tmp —
MD5:—
SHA256:—
3824iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar7151.tmp —
MD5:—
SHA256:—
3824iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\WQ37RWQU.txt —
MD5:—
SHA256:—
780iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3824iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\ER989HF8.htm —
MD5:—
SHA256:—
3824iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\B22DG3N0.htm —
MD5:—
SHA256:—
3824iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\cobalt strike license key_163102[1].zip —
MD5:—
SHA256:—
780iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\cobalt strike license key_163102.zip.bhbvdjo.partial:Zone.Identifier —
MD5:—
SHA256:—
3824iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\PGXAICWX.txttext
MD5:—
SHA256:—
3824iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\mmd[1].htmhtml
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
27
DNS requests
15
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
780
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
3824
iexplore.exe
GET
200
2.16.186.35:80
http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D
unknown
der
1.37 Kb
whitelisted
3824
iexplore.exe
GET
200
2.16.186.27:80
http://ocsp.int-x3.letsencrypt.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgOkv4FlA8k2KsOr6Tra9uWvPg%3D%3D
unknown
der
527 b
whitelisted
3824
iexplore.exe
GET
200
104.18.37.141:80
http://reudowntinghe.gq/?i8AsggTYtA=vNhN8nYvRpCE2ROvDLm4eKGWf8T79yxTLty2yMpNxHKDWN5emvvU3KMHJXgsDxToSHyUYjyLkg&c88a5962a4d331e5c3b3ad22967=Vmu6JDhc_HeBvvem1ZTkEtauRc2GLd97cb66c898b9a8c79d2fec97f3a98f03eq341HoYvOkZO3lxi5Sj3q_03mZiUTUA&xei9ZexhcwRWdt=cobalt+strike+license+key_163102.zip
US
compressed
5.20 Mb
suspicious
2820
Suscipit.exe
POST
—
104.18.45.18:80
http://giliafundation.life/v2/events
US
—
—
malicious
2820
Suscipit.exe
POST
—
104.18.45.18:80
http://giliafundation.life/v2/events
US
—
—
malicious
3824
iexplore.exe
GET
302
100.24.195.233:80
http://prkrls.info/wprt41?x=Cobalt+strike+license+key
US
html
431 b
unknown
3824
iexplore.exe
GET
200
2.16.186.11:80
http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D
unknown
der
1.37 Kb
whitelisted
3824
iexplore.exe
GET
200
2.16.186.27:80
http://ocsp.int-x3.letsencrypt.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgOkv4FlA8k2KsOr6Tra9uWvPg%3D%3D
unknown
der
527 b
whitelisted
780
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3824
iexplore.exe
100.24.195.233:80
prkrls.info
—
US
unknown
3824
iexplore.exe
2.16.186.11:80
isrg.trustid.ocsp.identrust.com
Akamai International B.V.
—
whitelisted
3824
iexplore.exe
2.16.186.27:80
ocsp.int-x3.letsencrypt.org
Akamai International B.V.
—
whitelisted
3824
iexplore.exe
104.18.37.141:443
reudowntinghe.gq
Cloudflare Inc
US
shared
3824
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
780
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
780
iexplore.exe
104.18.37.141:443
reudowntinghe.gq
Cloudflare Inc
US
shared
3824
iexplore.exe
104.18.37.141:80
reudowntinghe.gq
Cloudflare Inc
US
shared
780
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
780
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
prkrls.info
  • 100.24.195.233
unknown
bestlout1on.space
  • 78.140.165.14
suspicious
isrg.trustid.ocsp.identrust.com
  • 2.16.186.11
  • 2.16.186.35
whitelisted
ocsp.int-x3.letsencrypt.org
  • 2.16.186.27
  • 2.16.186.11
whitelisted
1getbestf1le3.xyz
  • 88.85.69.166
suspicious
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
reudowntinghe.gq
  • 104.18.37.141
  • 104.18.36.141
suspicious
ocsp.digicert.com
  • 93.184.220.29
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted

Threats

PID
Process
Class
Message
3824
iexplore.exe
Potentially Bad Traffic
ET INFO Observed Let's Encrypt Certificate for Suspicious TLD (.xyz)
1052
svchost.exe
Potentially Bad Traffic
ET INFO DNS Query for Suspicious .gq Domain
3824
iexplore.exe
Potentially Bad Traffic
ET INFO Suspicious Domain (*.gq) in TLS SNI
1052
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .life TLD
2820
Suscipit.exe
Potentially Bad Traffic
ET INFO HTTP Request to Suspicious *.life Domain
2820
Suscipit.exe
Potentially Bad Traffic
ET INFO HTTP Request to Suspicious *.life Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://prkrls.info/wprt41?x=Cobalt+strike+license+key