URL:

https://wearedevs.net/d/JJSploit

Full analysis: https://app.any.run/tasks/3a5b901c-6c2e-425d-848e-49d9330c5872
Verdict: Malicious activity
Analysis date: May 03, 2022, 22:44:49
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

AF4F0F3F58AF746C6F1F8983436ACBD9

SHA1:

09E980C8D1D92C3DF8498BD3A725CB83F4314AAB

SHA256:

484ABDB18866BC82426BE62FDF91D5C82FB9C951B25C22B00E1AA3EFC95E4B95

SSDEEP:

3:N8R/BApK83BQ:25BuBq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • iexplore.exe (PID: 3860)
      • JJSploit_Installer.exe (PID: 2700)
      • JJS-UI.exe (PID: 3268)

    • Loads dropped or rewritten executable

      • JJSploit_Installer.exe (PID: 2700)
      • JJS-UI.exe (PID: 3268)
      • JJS-UI.exe (PID: 2492)
      • JJS-UI.exe (PID: 3904)
      • JJS-UI.exe (PID: 2796)
      • JJS-UI.exe (PID: 2432)

    • Application was dropped or rewritten from another process

      • JJSploit_Installer.exe (PID: 2700)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3860)
      • JJSploit_Installer.exe (PID: 2700)
      • JJS-UI.exe (PID: 3268)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3860)
      • iexplore.exe (PID: 3804)
      • iexplore.exe (PID: 3836)

    • Drops a file with a compile date too recent

      • iexplore.exe (PID: 3860)
      • JJSploit_Installer.exe (PID: 2700)
      • JJS-UI.exe (PID: 3268)

    • Reads the computer name

      • JJSploit_Installer.exe (PID: 2700)
      • JJS-UI.exe (PID: 3268)
      • JJS-UI.exe (PID: 2492)
      • JJS-UI.exe (PID: 3904)
      • JJS-UI.exe (PID: 2432)

    • Creates files in the user directory

      • JJSploit_Installer.exe (PID: 2700)
      • JJS-UI.exe (PID: 3268)
      • JJS-UI.exe (PID: 3904)

    • Checks supported languages

      • JJS-UI.exe (PID: 3268)
      • JJSploit_Installer.exe (PID: 2700)
      • JJS-UI.exe (PID: 2492)
      • JJS-UI.exe (PID: 2796)
      • JJS-UI.exe (PID: 3904)
      • JJS-UI.exe (PID: 2432)

    • Creates a software uninstall entry

      • JJSploit_Installer.exe (PID: 2700)

    • Application launched itself

      • JJS-UI.exe (PID: 3268)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 2932)
      • iexplore.exe (PID: 3804)
      • iexplore.exe (PID: 3860)
      • iexplore.exe (PID: 3836)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3804)
      • iexplore.exe (PID: 3860)
      • iexplore.exe (PID: 3836)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3804)
      • iexplore.exe (PID: 2932)
      • iexplore.exe (PID: 3860)
      • JJS-UI.exe (PID: 3904)
      • iexplore.exe (PID: 3836)

    • Checks supported languages

      • iexplore.exe (PID: 3860)
      • iexplore.exe (PID: 3804)
      • iexplore.exe (PID: 2932)
      • iexplore.exe (PID: 3836)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3804)
      • iexplore.exe (PID: 2932)
      • iexplore.exe (PID: 3860)
      • iexplore.exe (PID: 3836)

    • Creates files in the user directory

      • iexplore.exe (PID: 3804)
      • iexplore.exe (PID: 3860)
      • iexplore.exe (PID: 3836)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2932)

    • Manual execution by user

      • JJS-UI.exe (PID: 3268)

    • Changes internet zones settings

      • iexplore.exe (PID: 2932)

    • Application launched itself

      • iexplore.exe (PID: 2932)

    • Reads the hosts file

      • JJS-UI.exe (PID: 3904)
      • JJS-UI.exe (PID: 3268)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
10
Malicious processes
3
Suspicious processes
3

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe iexplore.exe jjsploit_installer.exe jjs-ui.exe jjs-ui.exe no specs jjs-ui.exe jjs-ui.exe no specs jjs-ui.exe no specs iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2432"C:\Users\admin\AppData\Local\Programs\JJS-UI\JJS-UI.exe" --type=gpu-process --field-trial-handle=1076,7099226105656174887,4755176932233472920,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1244 --ignored=" --type=renderer " /prefetch:2C:\Users\admin\AppData\Local\Programs\JJS-UI\JJS-UI.exe—JJS-UI.exe
User:
admin
Company:
GitHub, Inc.
Integrity Level:
LOW
Description:
JJS-UI
Exit code:
0
Version:
6.4.8
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\programs\jjs-ui\jjs-ui.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\users\admin\appdata\local\programs\jjs-ui\ffmpeg.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
2492"C:\Users\admin\AppData\Local\Programs\JJS-UI\JJS-UI.exe" --type=gpu-process --field-trial-handle=1076,7099226105656174887,4755176932233472920,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1072 --ignored=" --type=renderer " /prefetch:2C:\Users\admin\AppData\Local\Programs\JJS-UI\JJS-UI.exe—JJS-UI.exe
User:
admin
Company:
GitHub, Inc.
Integrity Level:
LOW
Description:
JJS-UI
Exit code:
0
Version:
6.4.8
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\programs\jjs-ui\jjs-ui.exe
c:\windows\system32\kernel32.dll
c:\users\admin\appdata\local\programs\jjs-ui\ffmpeg.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shlwapi.dll
2700"C:\Users\admin\Downloads\JJSploit_Installer.exe" C:\Users\admin\Downloads\JJSploit_Installer.exe
iexplore.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.4.8
Modules
Images
c:\users\admin\downloads\jjsploit_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2796"C:\Users\admin\AppData\Local\Programs\JJS-UI\JJS-UI.exe" --type=renderer --field-trial-handle=1076,7099226105656174887,4755176932233472920,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\admin\AppData\Local\Programs\JJS-UI\resources\app.asar" --no-sandbox --no-zygote --preload="C:\Users\admin\AppData\Local\Programs\JJS-UI\resources\app.asar\build\preload.js" --enable-remote-module --background-color=#fff --enable-websql --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1516 /prefetch:1C:\Users\admin\AppData\Local\Programs\JJS-UI\JJS-UI.exe—JJS-UI.exe
User:
admin
Company:
GitHub, Inc.
Integrity Level:
MEDIUM
Description:
JJS-UI
Exit code:
0
Version:
6.4.8
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\programs\jjs-ui\jjs-ui.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\psapi.dll
c:\windows\system32\ole32.dll
c:\windows\system32\rpcrt4.dll
2932"C:\Program Files\Internet Explorer\iexplore.exe" "https://wearedevs.net/d/JJSploit"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3268"C:\Users\admin\AppData\Local\Programs\JJS-UI\JJS-UI.exe" C:\Users\admin\AppData\Local\Programs\JJS-UI\JJS-UI.exe
Explorer.EXE
User:
admin
Company:
GitHub, Inc.
Integrity Level:
MEDIUM
Description:
JJS-UI
Exit code:
0
Version:
6.4.8
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\programs\jjs-ui\jjs-ui.exe
c:\users\admin\appdata\local\programs\jjs-ui\ffmpeg.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3804"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2932 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3836"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2932 CREDAT:2102562 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\gdi32.dll
3860"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2932 CREDAT:988435 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3904"C:\Users\admin\AppData\Local\Programs\JJS-UI\JJS-UI.exe" --type=utility --field-trial-handle=1076,7099226105656174887,4755176932233472920,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1304 /prefetch:8C:\Users\admin\AppData\Local\Programs\JJS-UI\JJS-UI.exe
JJS-UI.exe
User:
admin
Company:
GitHub, Inc.
Integrity Level:
MEDIUM
Description:
JJS-UI
Exit code:
0
Version:
6.4.8
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\programs\jjs-ui\jjs-ui.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\users\admin\appdata\local\programs\jjs-ui\ffmpeg.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
32 868
Read events
32 624
Write events
244
Delete events
0

Modification events

(PID) Process:(2932) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2932) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(2932) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30957375
(PID) Process:(2932) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(2932) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30957375
(PID) Process:(2932) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2932) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2932) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2932) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2932) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
20
Suspicious files
32
Text files
61
Unknown types
97

Dropped files

PID
Process
Filename
Type
3804iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:—
SHA256:—
3804iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\download[1].csstext
MD5:—
SHA256:—
3804iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:—
SHA256:—
3804iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAder
MD5:—
SHA256:—
3804iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27der
MD5:—
SHA256:—
3804iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:—
SHA256:—
3804iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\dM3ipLu7q0SolgbDApkhduCYXKU[1].jstext
MD5:E25AA44CE193238EB43038178EEE15F0
SHA256:E041697F6DCA33396CA095C8CDFC6BE764176CF4950EE907A299C5E60463425C
3804iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\unc[1].pngimage
MD5:F6894336D02AC0DF49A635B361AFC49E
SHA256:14948B0FF3C5EFD65925438A21F35DDA121097E3AC235B0069197E6D62F6EC4D
3804iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\main[1].csstext
MD5:7DBDA57D44B1736D49144D71741B95DF
SHA256:A104485F98B3B248FBCD9E4AFF551035C75B5874C86BB6EE30DE0B6B4166C86A
3804iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\youtube[1].pngimage
MD5:60BAAC6710BAB4CEC08E6637E91F9DCC
SHA256:6E4E6A241640C18B38030162307F41CE8372748E4EF9E57002A1B13A3C6C8D59
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
19
TCP/UDP connections
93
DNS requests
36
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3804
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
3804
iexplore.exe
GET
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGw1Yik%2BBw9wCsFmPcXqpzQ%3D
US
der
471 b
whitelisted
3804
iexplore.exe
GET
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDZVQ0c3n%2F16xKL4oJJTrDj
US
der
472 b
whitelisted
3804
iexplore.exe
GET
200
142.250.185.163:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
3804
iexplore.exe
GET
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDhmOeGwgbrsxIlyFxpp0C8
US
der
472 b
whitelisted
3804
iexplore.exe
GET
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDPHOYdSk1KPwrBCsCAw3KJ
US
der
472 b
whitelisted
3804
iexplore.exe
GET
200
142.250.185.163:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
3804
iexplore.exe
GET
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDPHOYdSk1KPwrBCsCAw3KJ
US
der
472 b
whitelisted
3804
iexplore.exe
GET
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEA8SVMKPsnFcEm%2FVYIITs7I%3D
US
der
471 b
whitelisted
3804
iexplore.exe
GET
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEHquXS%2BaUA73EnirQKFr398%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3804
iexplore.exe
142.250.186.98:443
pagead2.googlesyndication.com
Google Inc.
US
suspicious
3804
iexplore.exe
142.250.185.163:80
ocsp.pki.goog
Google Inc.
US
whitelisted
3804
iexplore.exe
142.250.185.227:443
fonts.gstatic.com
Google Inc.
US
whitelisted
3804
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3804
iexplore.exe
216.58.212.162:443
partner.googleadservices.com
Google Inc.
US
whitelisted
3804
iexplore.exe
142.250.185.200:443
www.googletagmanager.com
Google Inc.
US
suspicious
3804
iexplore.exe
104.26.7.147:443
wearedevs.net
Cloudflare Inc
US
suspicious
3804
iexplore.exe
142.250.181.228:443
www.google.com
Google Inc.
US
whitelisted
3804
iexplore.exe
216.58.212.161:443
tpc.googlesyndication.com
Google Inc.
US
whitelisted
2932
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
wearedevs.net
  • 104.26.7.147
  • 104.26.6.147
  • 172.67.71.2
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
pagead2.googlesyndication.com
  • 142.250.186.98
whitelisted
cdn.wearedevs.net
  • 104.26.6.147
  • 172.67.71.2
  • 104.26.7.147
whitelisted
fonts.googleapis.com
  • 172.217.16.138
whitelisted
ocsp.pki.goog
  • 142.250.185.163
whitelisted
www.googletagmanager.com
  • 142.250.185.200
whitelisted
www.google-analytics.com
  • 142.250.186.142
whitelisted
fonts.gstatic.com
  • 142.250.185.227
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://wearedevs.net/d/JJSploit