URL:

https://www.sharestion.com/eur/0804c951-93a0-405d-80e4-fa87c7551d6a/148412db-edd4-488d-b56c-b837778f8445/d1cef85b-37c9-4e57-9082-4f29aae51c8a/login?id=Rkl0Z3pzT1BESjJZQTE4eGljNUVHVUd3Z1ZmNVV2ZkRmN2xndVJITDZyWUxDcVE1ZTFSNVhBUHBmb2RsV0dlQUtMZW9qTFdGWGx6am1wM2VzejdYNnlWdFVnN2dNK0FWc05zUTVJVVc4dEhGaGs5V0J1MlczL2cvcmp4SjVjeThKQnJpVFdBakNSQlRGWVExWlMxWUN1NmhMeXRWK1AzUm1UdjFubGZGb1ZrcGIxVHNVWHpubGtzTkdrVlBITWZ0TmdJdUlOSDNLQ0NjVllrd0FzZGdqNTZXcFFtVS9OMnM2ZzhLNjlkYTYvQmJJdlYrT1V0QmlPeG14d1hGR1RzWmxucUF5Q1Y1QUpoaDMyc1JRanA2ZHplc0d1bVY1d2VSZzdGTWYyL1JkejQ0RUZzek9aWFliL3B5YS9XS21HWDRNMTd2R2o2dU9qL2ZpWjBucURZUmlGK0NUeGlKWWhRR3doK1NXQjdYZlo0PQ

Full analysis: https://app.any.run/tasks/405b937a-acd7-484a-915e-6427e0f2a5f2
Verdict: Malicious activity
Analysis date: February 01, 2022, 15:18:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
phishing
phish-microsoft
Indicators:
MD5:

8B457F9F5E8B0B7066EAE1DDC8C12427

SHA1:

93F04E3154B2F882771386FA97E42A5F99959ED5

SHA256:

42A9461F31B5AB28F5C898C2249C866FF00B554652558DD7CD62C8CB6030A2BC

SSDEEP:

12:2V1UYXgZTj75LxNHP6ntCziJU9wLKGT7593ZGGL1dCc8SZXWqFCJXL:2ZmtFBPmt4ikwuGTvp978oz8L

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Microsoft phishing page detected

      • iexplore.exe (PID: 3444)
      • chrome.exe (PID: 3548)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3444)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 2824)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 3020)
      • iexplore.exe (PID: 3444)
      • chrome.exe (PID: 3548)
      • chrome.exe (PID: 2824)
      • chrome.exe (PID: 2908)
      • chrome.exe (PID: 3608)
      • chrome.exe (PID: 612)
      • chrome.exe (PID: 4056)
      • chrome.exe (PID: 336)
      • chrome.exe (PID: 3744)
      • chrome.exe (PID: 1780)
      • chrome.exe (PID: 2612)
      • chrome.exe (PID: 628)
      • chrome.exe (PID: 4048)
      • chrome.exe (PID: 2744)
      • chrome.exe (PID: 2936)
      • chrome.exe (PID: 3956)
      • chrome.exe (PID: 992)
      • chrome.exe (PID: 2272)
      • chrome.exe (PID: 3800)
      • chrome.exe (PID: 3896)
      • chrome.exe (PID: 1284)
      • chrome.exe (PID: 1924)
      • chrome.exe (PID: 3892)

    • Changes internet zones settings

      • iexplore.exe (PID: 3020)

    • Application launched itself

      • iexplore.exe (PID: 3020)
      • chrome.exe (PID: 2824)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3444)

    • Manual execution by user

      • chrome.exe (PID: 2824)

    • Reads the computer name

      • iexplore.exe (PID: 3020)
      • iexplore.exe (PID: 3444)
      • chrome.exe (PID: 2824)
      • chrome.exe (PID: 3548)
      • chrome.exe (PID: 2744)
      • chrome.exe (PID: 3608)
      • chrome.exe (PID: 2612)
      • chrome.exe (PID: 2272)
      • chrome.exe (PID: 992)
      • chrome.exe (PID: 3896)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3444)
      • iexplore.exe (PID: 3020)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3444)
      • iexplore.exe (PID: 3020)
      • chrome.exe (PID: 3548)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 3444)
      • iexplore.exe (PID: 3020)

    • Reads the hosts file

      • chrome.exe (PID: 2824)
      • chrome.exe (PID: 3548)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3020)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3020)

    • Reads the date of Windows installation

      • chrome.exe (PID: 992)

    • Creates files in the user directory

      • iexplore.exe (PID: 3020)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
60
Monitored processes
24
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe chrome.exe chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
336"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1032,15491089159224339295,1140059539874969556,131072 --enable-features=PasswordImport --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1976 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
612"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1032,15491089159224339295,1140059539874969556,131072 --enable-features=PasswordImport --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2276 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
628"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1032,15491089159224339295,1140059539874969556,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3552 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
992"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1032,15491089159224339295,1140059539874969556,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1836 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
1284"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1032,15491089159224339295,1140059539874969556,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1712 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
1780"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1032,15491089159224339295,1140059539874969556,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2992 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
1924"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1032,15491089159224339295,1140059539874969556,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=700 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
2272"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1032,15491089159224339295,1140059539874969556,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1728 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
2612"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1032,15491089159224339295,1140059539874969556,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3484 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
2744"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1032,15491089159224339295,1140059539874969556,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1036 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
Total events
23 138
Read events
22 894
Write events
234
Delete events
10

Modification events

(PID) Process:(3020) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3020) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3020) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30939006
(PID) Process:(3020) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
249803444
(PID) Process:(3020) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30939007
(PID) Process:(3020) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3020) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3020) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3020) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3020) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
155
Text files
181
Unknown types
15

Dropped files

PID
Process
Filename
Type
2824chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-61F94F56-B08.pma —
MD5:—
SHA256:—
3444iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DE0D974FB4DC3536B9035FD604565AB7_DDC8A463BFDA621F6910329FB20C8D5Cder
MD5:970E13900DA8EEF7E8C84686E004F28B
SHA256:CF8ECA90345451DDED1566B3AB825E610CAB9AC0E24F6B571BFA82C65CCB6B4D
3444iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177binary
MD5:95FFF598906073AA7266CB8475C4276C
SHA256:7E1ECA0E16C998CBE3A44C1EA1BAD7E68EF3201D43AFA01A5B17CAB249F38DCA
3444iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:357CFA42C23C6C2BC79C209E7E70A743
SHA256:A7377E3EF6BFDE348943642C165C16BE1CC7306FE76D7990D09C263FEC265DFE
3444iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DE0D974FB4DC3536B9035FD604565AB7_DDC8A463BFDA621F6910329FB20C8D5Cbinary
MD5:9A5940A37E42998087EF4C7F2F0D83EB
SHA256:53C6603F26B6065AAE28621A9F5B1743DA1BA7D8B9AA668955F8447B1AF20BDE
3444iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
3444iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\firstScript[1].jstext
MD5:DA5D678CFA62AB32B62A8123E923F822
SHA256:9FABE69E40BBFF565755BBC408BA923E8D05867969C34E5448D334C8914D2BA0
3444iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\morescript[1].jstext
MD5:8BC03F0ED1D4EC8B123ABC818F236EC9
SHA256:58FA1F189953F9C0B6209827F64E8CE65318374E075C30F74CAD566ED733FE69
3444iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\login[1].htmhtml
MD5:676696650CAD2578353AF56C167456BA
SHA256:F06729F6C6EB5F1BC4E4719773375D58E86364DB4D5EE966FA72473B4000774D
3444iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177der
MD5:A605D7A04BCD83BBE45646A996AA6868
SHA256:76D0A07FF126DD4EE01C597789C6B289496C80E6797669B51168AD062E048838
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
87
DNS requests
35
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3444
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D
US
der
471 b
whitelisted
3444
iexplore.exe
GET
200
131.253.33.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRS%2FsoQjbTlq1Jokw0nyC%2FyFeJLtQQUAKuR%2FCFiJpeaqHkbYUGQYKliZ%2F0CEzMAJWkY2qVJji13zEUAAAAlaRg%3D
US
der
1.69 Kb
whitelisted
3444
iexplore.exe
GET
200
67.27.235.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?ca9efc03a24bf25f
US
compressed
4.70 Kb
whitelisted
3444
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
3444
iexplore.exe
GET
200
67.27.235.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8b3fe237dafbaa54
US
compressed
4.70 Kb
whitelisted
3020
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
3444
iexplore.exe
GET
200
104.18.24.243:80
http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSjA8CoiHvUecQnjrXXWH08EsBNpAQU%2Fy9%2F4Qb0OPMt7SWNmML%2BDvZs%2FPoCE38AIDfLvRE4agVL6JIAAAAgN8s%3D
US
der
1.70 Kb
whitelisted
3020
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
3020
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
US
der
471 b
whitelisted
3548
chrome.exe
GET
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx
US
crx
242 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3548
chrome.exe
142.250.185.67:443
fonts.gstatic.com
Google Inc.
US
whitelisted
3548
chrome.exe
216.58.212.142:443
apis.google.com
Google Inc.
US
whitelisted
3548
chrome.exe
13.107.213.44:443
www.sharestion.com
Microsoft Corporation
US
suspicious
3444
iexplore.exe
67.27.235.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
3444
iexplore.exe
13.107.246.44:443
www.sharestion.com
Microsoft Corporation
US
suspicious
3444
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3444
iexplore.exe
131.253.33.203:80
oneocsp.microsoft.com
Microsoft Corporation
US
malicious
3020
iexplore.exe
131.253.33.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
3020
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
—
—
13.107.246.44:443
www.sharestion.com
Microsoft Corporation
US
suspicious

DNS requests

Domain
IP
Reputation
www.sharestion.com
  • 13.107.246.44
  • 13.107.213.44
malicious
ctldl.windowsupdate.com
  • 67.27.235.254
  • 8.253.207.121
  • 8.241.78.254
  • 67.27.234.126
  • 67.26.83.254
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
www.bing.com
  • 131.253.33.200
  • 13.107.22.200
whitelisted
oneocsp.microsoft.com
  • 131.253.33.203
whitelisted
secure.aadcdn.microsoftonline-p.com
  • 104.94.242.63
whitelisted
clientservices.googleapis.com
  • 142.250.186.99
whitelisted
accounts.google.com
  • 142.250.186.77
shared
clients2.google.com
  • 142.250.186.142
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.sharestion.com/eur/0804c951-93a0-405d-80e4-fa87c7551d6a/148412db-edd4-488d-b56c-b837778f8445/d1cef85b-37c9-4e57-9082-4f29aae51c8a/login?id=Rkl0Z3pzT1BESjJZQTE4eGljNUVHVUd3Z1ZmNVV2ZkRmN2xndVJITDZyWUxDcVE1ZTFSNVhBUHBmb2RsV0dlQUtMZW9qTFdGWGx6am1wM2VzejdYNnlWdFVnN2dNK0FWc05zUTVJVVc4dEhGaGs5V0J1MlczL2cvcmp4SjVjeThKQnJpVFdBakNSQlRGWVExWlMxWUN1NmhMeXRWK1AzUm1UdjFubGZGb1ZrcGIxVHNVWHpubGtzTkdrVlBITWZ0TmdJdUlOSDNLQ0NjVllrd0FzZGdqNTZXcFFtVS9OMnM2ZzhLNjlkYTYvQmJJdlYrT1V0QmlPeG14d1hGR1RzWmxucUF5Q1Y1QUpoaDMyc1JRanA2ZHplc0d1bVY1d2VSZzdGTWYyL1JkejQ0RUZzek9aWFliL3B5YS9XS21HWDRNMTd2R2o2dU9qL2ZpWjBucURZUmlGK0NUeGlKWWhRR3doK1NXQjdYZlo0PQ