analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://secure.adnxs.com/seg?redir=https://s.id/F1oaj#f98sd6fg5qs2gf23sdg2d23fg32df

Full analysis: https://app.any.run/tasks/7b66ada3-03ec-467d-b08b-f5d58061fb56
Verdict: Malicious activity
Analysis date: August 30, 2021, 15:33:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

65592FEAF9A60EC8EA2714AB796CB5E8

SHA1:

AD511BBCEC852C00EFC15DC99F977C8C0A885F04

SHA256:

39B74014095C7BEC73CD2D5743DB4C056D53B04E213179E5E1EE46B08A319674

SSDEEP:

3:N8N3udLwACaVID6f7WlDYQCirWZ1:2Zudk/47WAiCZ1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2944)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 2772)

  • INFO

    • Checks supported languages

      • chrome.exe (PID: 3256)
      • chrome.exe (PID: 3204)
      • chrome.exe (PID: 272)
      • chrome.exe (PID: 3820)
      • iexplore.exe (PID: 2944)
      • chrome.exe (PID: 3320)
      • chrome.exe (PID: 1036)
      • chrome.exe (PID: 2772)
      • iexplore.exe (PID: 3092)
      • chrome.exe (PID: 3700)
      • chrome.exe (PID: 564)
      • chrome.exe (PID: 408)
      • chrome.exe (PID: 3216)
      • chrome.exe (PID: 832)
      • chrome.exe (PID: 2284)
      • chrome.exe (PID: 3752)
      • chrome.exe (PID: 460)
      • chrome.exe (PID: 2784)
      • chrome.exe (PID: 1260)
      • chrome.exe (PID: 3840)
      • chrome.exe (PID: 376)
      • chrome.exe (PID: 2328)
      • chrome.exe (PID: 900)
      • chrome.exe (PID: 832)
      • chrome.exe (PID: 3040)
      • chrome.exe (PID: 3656)
      • chrome.exe (PID: 3052)

    • Reads the computer name

      • chrome.exe (PID: 3320)
      • iexplore.exe (PID: 3092)
      • iexplore.exe (PID: 2944)
      • chrome.exe (PID: 2772)
      • chrome.exe (PID: 272)
      • chrome.exe (PID: 564)
      • chrome.exe (PID: 460)
      • chrome.exe (PID: 3840)
      • chrome.exe (PID: 3052)
      • chrome.exe (PID: 3040)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 3092)
      • chrome.exe (PID: 3052)

    • Manual execution by user

      • chrome.exe (PID: 2772)

    • Changes internet zones settings

      • iexplore.exe (PID: 3092)

    • Application launched itself

      • iexplore.exe (PID: 3092)
      • chrome.exe (PID: 2772)

    • Reads the hosts file

      • chrome.exe (PID: 2772)
      • chrome.exe (PID: 272)

    • Reads settings of System Certificates

      • chrome.exe (PID: 272)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
63
Monitored processes
27
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe no specs iexplore.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3092"C:\Program Files\Internet Explorer\iexplore.exe" "https://secure.adnxs.com/seg?redir=https://s.id/F1oaj#f98sd6fg5qs2gf23sdg2d23fg32df"C:\Program Files\Internet Explorer\iexplore.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2944"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3092 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2772"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
Explorer.EXE
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\winmm.dll
c:\windows\system32\user32.dll
3256"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=86.0.4240.198 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x7172d988,0x7172d998,0x7172d9a4C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
3320"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1044,2129034471660111267,7126772195967889646,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1048 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
272"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1044,2129034471660111267,7126772195967889646,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1428 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
3820"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,2129034471660111267,7126772195967889646,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1928 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
3204"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,2129034471660111267,7126772195967889646,131072 --enable-features=PasswordImport --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1936 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
1036"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,2129034471660111267,7126772195967889646,131072 --enable-features=PasswordImport --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2296 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
3700"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1044,2129034471660111267,7126772195967889646,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
Total events
13 525
Read events
13 362
Write events
160
Delete events
3

Modification events

(PID) Process:(3092) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3092) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3092) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30907828
(PID) Process:(3092) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3092) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30907828
(PID) Process:(3092) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3092) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3092) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3092) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3092) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
94
Text files
228
Unknown types
26

Dropped files

PID
Process
Filename
Type
2772chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-612CFA6E-AD4.pma —
MD5:—
SHA256:—
3092iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFD4DA9D6BEE879515.TMPgmc
MD5:E22AB163F1440500BF4C8911B06C7EE2
SHA256:75263F86700E49E6AB85FDD14F8924BC0DF63C96F492DBE113EE4B7AB6D4AF69
3092iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFFA5CFDD830A97CD5.TMPgmc
MD5:F026CB82720CCB482C480CEA77F1D734
SHA256:CC884E9363EB3751D54F9B2F093E0DCAF6874F125AA04D45AF2395EBC7C95F9C
3092iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{B22454E2-09A7-11EC-A146-12A9866C77DE}.datbinary
MD5:64280B6CDFC86E8541C4638D6A58045A
SHA256:16D1F1029D97BD59EF2266DD82701440898C257952124C18704D760117A2BF6B
3092iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF6582C87D77B6BEB2.TMPgmc
MD5:3D06A531DBE3742032F39FD4912A2D78
SHA256:C9EA3FC5A9B43F0D150942F40212EA297BB7AC0201FC28BE910D553B421BFCB8
3092iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFF56ED748D8FDE170.TMPgmc
MD5:C72107E66E9CFA69AFD7DC71FA66F01A
SHA256:27A51F4CD23274185E49FE51DEE9D6D8CCE68FFF7200AF45B0E30F7C63252D43
3092iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{B22454E4-09A7-11EC-A146-12A9866C77DE}.datbinary
MD5:20D8F9E820A4B0E249FE371180CC339B
SHA256:817D950DF23CB8E58269C58AC69CAABEEB169BCACE92477C92CCD1D955911047
3092iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\{B22454E6-09A7-11EC-A146-12A9866C77DE}.datbinary
MD5:C00275993F23C4C3A87DA997E42C0E03
SHA256:092FF7AF4BE6F7AE7354B9B3ECA909DCD2DC2B6883E7981F2EB1AFB293646F8A
2772chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\indexbinary
MD5:F135FD5C7233327338E919AA91DC19D4
SHA256:80C622C27125AE38167609AD302CE763B449188A3F76ABE2EA6B8ED68F7EA65F
3092iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\RecoveryStore.{B22454E5-09A7-11EC-A146-12A9866C77DE}.datbinary
MD5:8B7851E8CA1904E0723A180AFE3D3F95
SHA256:59BF82FE63438E06BFD2F45DF34D4ED18A25A4C9D4A77859CFE6F740359FAE6B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
90
TCP/UDP connections
58
DNS requests
61
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
272
chrome.exe
GET
200
206.132.224.93:80
http://www.rocknpop.com.pa/wp-content/themes/Rocknpop/js/jquery.nivo.slider.js
US
text
4.69 Kb
unknown
272
chrome.exe
GET
200
206.132.224.93:80
http://www.rocknpop.com.pa/wp-content/themes/Rocknpop/css/skeleton.css?ver=5.5.3
US
text
1.68 Kb
unknown
272
chrome.exe
GET
200
206.132.224.93:80
http://www.rocknpop.com.pa/wp-content/themes/Rocknpop/css/nivo-slider.css?ver=5.5.3
US
text
1015 b
unknown
272
chrome.exe
GET
200
206.132.224.93:80
http://www.rocknpop.com.pa/wp-content/themes/Rocknpop/light.css?ver=5.5.3
US
text
12.6 Kb
unknown
272
chrome.exe
GET
200
206.132.224.93:80
http://www.rocknpop.com.pa/wp-content/themes/Rocknpop/css/options.css?ver=5.5.3
US
text
627 b
unknown
272
chrome.exe
GET
200
206.132.224.93:80
http://www.rocknpop.com.pa/wp-content/themes/Rocknpop/css/layout.css?ver=5.5.3
US
text
1.55 Kb
unknown
272
chrome.exe
GET
200
206.132.224.93:80
http://www.rocknpop.com.pa/wp-content/themes/Rocknpop/css/prettyphoto.css?ver=5.5.3
US
text
2.15 Kb
unknown
272
chrome.exe
GET
200
206.132.224.93:80
http://www.rocknpop.com.pa/wp-content/themes/Rocknpop/css/flexslider.css?ver=5.5.3
US
text
1.26 Kb
unknown
272
chrome.exe
GET
200
206.132.224.93:80
http://www.rocknpop.com.pa/wp-content/plugins/banner-slider-for-advertisement/includes/css/swiper.min.css?ver=5.5.3
US
text
3.15 Kb
unknown
272
chrome.exe
GET
200
206.132.224.93:80
http://www.rocknpop.com.pa/wp-content/themes/Rocknpop/css/reset.css?ver=5.5.3
US
text
666 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
272
chrome.exe
142.250.186.142:443
clients2.google.com
Google Inc.
US
whitelisted
2944
iexplore.exe
185.33.221.89:443
secure.adnxs.com
AppNexus, Inc
—
unknown
272
chrome.exe
142.250.186.100:443
www.google.com
Google Inc.
US
whitelisted
272
chrome.exe
142.250.185.131:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
272
chrome.exe
142.250.181.234:443
fonts.googleapis.com
Google Inc.
US
whitelisted
272
chrome.exe
142.250.185.206:443
apis.google.com
Google Inc.
US
whitelisted
272
chrome.exe
142.250.186.163:443
www.gstatic.com
Google Inc.
US
whitelisted
272
chrome.exe
185.33.221.13:443
secure.adnxs.com
AppNexus, Inc
—
unknown
272
chrome.exe
45.126.59.196:443
s.id
Pengelola Nama Domain Internet Indonesia
ID
suspicious
—
—
142.250.74.205:443
accounts.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
secure.adnxs.com
  • 185.33.221.89
  • 185.33.220.241
  • 185.33.221.15
  • 185.33.220.244
  • 185.33.221.91
  • 185.33.220.243
  • 185.33.221.14
  • 185.33.221.13
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
clientservices.googleapis.com
  • 142.250.185.131
whitelisted
accounts.google.com
  • 142.250.74.205
shared
clients2.google.com
  • 142.250.186.142
whitelisted
www.google.com
  • 142.250.186.100
whitelisted
fonts.googleapis.com
  • 142.250.181.234
whitelisted
www.gstatic.com
  • 142.250.186.163
whitelisted
fonts.gstatic.com
  • 142.250.185.227
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.serveminecraft .net
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://secure.adnxs.com/seg?redir=https://s.id/F1oaj#f98sd6fg5qs2gf23sdg2d23fg32df