analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://metin2mod.tk/?page_id=6

Full analysis: https://app.any.run/tasks/0d606fa9-0ad6-4e94-b3ee-0b75d72c2ce6
Verdict: Malicious activity
Analysis date: June 27, 2022, 07:24:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

281B247C14B7EA1D5C2FD4CC75A73D1A

SHA1:

6B528C29F1FF990A18D98D466205763BC67FAD06

SHA256:

4F00D44A2BB433653E6A67B77CF5A49FA15BFFC71ABE0CF44AEB4D3D042ECA53

SSDEEP:

3:N1KT1Lt6MB+:CZLtnB+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • chrome.exe (PID: 2812)
      • chrome.exe (PID: 2896)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 912)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 2812)

    • Drops a file with a compile date too recent

      • chrome.exe (PID: 2812)
      • chrome.exe (PID: 2896)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 2896)
      • chrome.exe (PID: 2812)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 2684)
      • iexplore.exe (PID: 912)
      • opera.exe (PID: 2608)
      • chrome.exe (PID: 2812)
      • chrome.exe (PID: 3256)
      • chrome.exe (PID: 3648)
      • chrome.exe (PID: 3072)
      • chrome.exe (PID: 740)
      • chrome.exe (PID: 1872)
      • chrome.exe (PID: 1280)
      • chrome.exe (PID: 3520)
      • chrome.exe (PID: 2752)
      • chrome.exe (PID: 3940)
      • chrome.exe (PID: 3980)
      • chrome.exe (PID: 3148)
      • chrome.exe (PID: 708)
      • chrome.exe (PID: 2944)
      • chrome.exe (PID: 2820)
      • chrome.exe (PID: 3000)
      • chrome.exe (PID: 980)
      • chrome.exe (PID: 3132)
      • chrome.exe (PID: 3392)
      • chrome.exe (PID: 2172)
      • chrome.exe (PID: 2364)
      • chrome.exe (PID: 3200)
      • chrome.exe (PID: 3480)
      • chrome.exe (PID: 3796)
      • chrome.exe (PID: 3932)
      • chrome.exe (PID: 2068)
      • chrome.exe (PID: 3204)
      • chrome.exe (PID: 2040)
      • chrome.exe (PID: 1080)
      • chrome.exe (PID: 540)
      • chrome.exe (PID: 2244)
      • chrome.exe (PID: 4068)
      • chrome.exe (PID: 780)
      • chrome.exe (PID: 3796)
      • chrome.exe (PID: 2924)
      • chrome.exe (PID: 3344)
      • chrome.exe (PID: 3576)
      • chrome.exe (PID: 3788)
      • chrome.exe (PID: 3988)
      • chrome.exe (PID: 528)
      • chrome.exe (PID: 3736)
      • chrome.exe (PID: 4068)
      • chrome.exe (PID: 1648)
      • chrome.exe (PID: 1736)
      • chrome.exe (PID: 564)
      • chrome.exe (PID: 3864)
      • chrome.exe (PID: 3232)
      • chrome.exe (PID: 3344)
      • chrome.exe (PID: 2316)
      • chrome.exe (PID: 3696)
      • chrome.exe (PID: 2060)
      • chrome.exe (PID: 1588)
      • chrome.exe (PID: 1032)
      • chrome.exe (PID: 3968)
      • chrome.exe (PID: 2596)
      • chrome.exe (PID: 3852)
      • chrome.exe (PID: 2800)
      • chrome.exe (PID: 2112)
      • chrome.exe (PID: 1792)
      • chrome.exe (PID: 2896)
      • chrome.exe (PID: 2752)
      • chrome.exe (PID: 2724)
      • chrome.exe (PID: 600)
      • chrome.exe (PID: 1776)
      • chrome.exe (PID: 2392)

    • Reads the computer name

      • iexplore.exe (PID: 2684)
      • iexplore.exe (PID: 912)
      • opera.exe (PID: 2608)
      • chrome.exe (PID: 2812)
      • chrome.exe (PID: 3648)
      • chrome.exe (PID: 3256)
      • chrome.exe (PID: 1280)
      • chrome.exe (PID: 2820)
      • chrome.exe (PID: 3864)
      • chrome.exe (PID: 4068)
      • chrome.exe (PID: 3344)
      • chrome.exe (PID: 3968)

    • Changes internet zones settings

      • iexplore.exe (PID: 2684)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2684)

    • Application launched itself

      • iexplore.exe (PID: 2684)
      • chrome.exe (PID: 2812)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 2684)
      • opera.exe (PID: 2608)
      • chrome.exe (PID: 3864)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2684)
      • chrome.exe (PID: 3256)

    • Manual execution by user

      • opera.exe (PID: 2608)
      • chrome.exe (PID: 2812)

    • Check for Java to be installed

      • opera.exe (PID: 2608)

    • Dropped object may contain Bitcoin addresses

      • opera.exe (PID: 2608)

    • Creates files in the user directory

      • opera.exe (PID: 2608)

    • Reads the hosts file

      • chrome.exe (PID: 3256)
      • chrome.exe (PID: 2812)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
105
Monitored processes
68
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe opera.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2684"C:\Program Files\Internet Explorer\iexplore.exe" "http://metin2mod.tk/?page_id=6"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
912"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2684 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2608"C:\Program Files\Opera\opera.exe" C:\Program Files\Opera\opera.exe
Explorer.EXE
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera Internet Browser
Exit code:
0
Version:
1748
Modules
Images
c:\program files\opera\opera.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\psapi.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\rpcrt4.dll
2812"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
Explorer.EXE
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\winmm.dll
c:\windows\system32\user32.dll
3072"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=86.0.4240.198 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x6f19d988,0x6f19d998,0x6f19d9a4C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\gdi32.dll
3648"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1052,14096856180708568554,14834952099704867000,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1056 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
3256"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1052,14096856180708568554,14834952099704867000,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1336 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
3940"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1052,14096856180708568554,14834952099704867000,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1900 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
3980"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1052,14096856180708568554,14834952099704867000,131072 --enable-features=PasswordImport --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1940 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
3520"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1052,14096856180708568554,14834952099704867000,131072 --enable-features=PasswordImport --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2324 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winmm.dll
Total events
26 777
Read events
26 420
Write events
348
Delete events
9

Modification events

(PID) Process:(2684) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2684) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(2684) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30968310
(PID) Process:(2684) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
52735444
(PID) Process:(2684) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30968311
(PID) Process:(2684) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2684) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2684) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2684) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2684) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
3
Suspicious files
390
Text files
355
Unknown types
72

Dropped files

PID
Process
Filename
Type
2684iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFEDFE31ACD3474E66.TMPgmc
MD5:D32C1D993C872791FE687D254BF35413
SHA256:006C2279A6DA680F2808A3DBC3AA8AFC15AED8F744AEF94C311DC03C9D3F93F7
2684iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF5FA1099D1D4B8A8F.TMPgmc
MD5:4CB8F116A9E56D9AC803C41979185F4B
SHA256:C702F380E60DBFE826D63E4D970C208CE13D467BBEE00C1A16A9614275EF5AD9
2608opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opssl6.datbinary
MD5:73BF9617C5FB4356C3C25A8B0A1A6BD1
SHA256:C2EDCC1E04988FE54C1615C51197FEF999C420F0FC0B3F18F73D2A58A7FC7175
2608opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\operaprefs.initext
MD5:F0DE56E6CCB98D5660403B4B11005556
SHA256:542D709637434291B81BB00E0C47670F7E4DFB53B75FD372232C11DA3C564C0A
2608opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\tasks.xmlxml
MD5:D30B4FB9EC40F795FA3814323401C130
SHA256:A385E0C8F5691D380C2C9D11CB2DD55114AF4F9E1C98771ECC41B46C6D78A3FA
2608opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opcert6.datbinary
MD5:1AA8644C9261DC10F7247F6A145C1DD2
SHA256:58A8933F65361633C6AB194000D312DC9D566F717B1A16814A0DBEE24A60EBE3
2608opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opicacrt6.datbinary
MD5:82F1A2B1176A5ECC457D32301E2AD833
SHA256:A783052804DD4C232BE2ED3DC00C430CB67A20370890E235562ED2B27B5A602E
2608opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\sessions\autosave.win.baktext
MD5:46A734B275C8C258D9D6F508E73B36AD
SHA256:B80192EDC377DD212C9E488E1983FBCD68CF83330576EFD7579B7AB30FA3672B
2608opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\oprC64F.tmptext
MD5:F0DE56E6CCB98D5660403B4B11005556
SHA256:542D709637434291B81BB00E0C47670F7E4DFB53B75FD372232C11DA3C564C0A
2684iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF8CAE6D3B298883DF.TMPgmc
MD5:C9FC4E7D74A203A38E59AF217D3931F2
SHA256:C75A10213EFD19D22D7FDCEE5264FB19E1F9927A5BDC9752635356BF0608B3F1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
192
TCP/UDP connections
319
DNS requests
153
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2608
opera.exe
GET
—
46.105.98.67:80
http://metin2mod.tk/wp-content/themes/simone/js/navigation.js?ver=20120206
FR
—
—
suspicious
2608
opera.exe
GET
200
93.184.220.29:80
http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl
US
der
592 b
whitelisted
2608
opera.exe
GET
—
46.105.98.67:80
http://metin2mod.tk/wp-content/themes/simone/images/pattern.svg
FR
—
—
suspicious
2608
opera.exe
GET
—
46.105.98.67:80
http://metin2mod.tk/wp-content/themes/simone/js/superfish.min.js?ver=20140328
FR
—
—
suspicious
2608
opera.exe
GET
—
46.105.98.67:80
http://metin2mod.tk/wp-content/plugins/popups/public/assets/css/public.css?ver=1.9.3.8
FR
—
—
suspicious
2608
opera.exe
GET
200
46.105.98.67:80
http://metin2mod.tk/?page_id=6
FR
html
5.24 Kb
suspicious
2608
opera.exe
GET
—
46.105.98.67:80
http://metin2mod.tk/wp-includes/js/jquery/jquery.js?ver=1.12.4
FR
—
—
suspicious
2608
opera.exe
GET
—
46.105.98.67:80
http://metin2mod.tk/images/new2.gif
FR
—
—
suspicious
2608
opera.exe
GET
—
46.105.98.67:80
http://metin2mod.tk/wp-content/themes/simone/fonts/font-awesome/css/font-awesome.min.css?ver=5.1.13
FR
—
—
suspicious
2608
opera.exe
GET
—
46.105.98.67:80
http://metin2mod.tk/wp-content/themes/simone/js/hide-search.js?ver=20120206
FR
—
—
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2684
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
2608
opera.exe
142.250.185.234:80
fonts.googleapis.com
Google Inc.
US
whitelisted
2684
iexplore.exe
13.107.22.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
2608
opera.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2684
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2608
opera.exe
185.26.182.94:443
certs.opera.com
Opera Software AS
—
whitelisted
2608
opera.exe
82.145.216.15:80
sitecheck2.opera.com
Opera Software AS
—
suspicious
2608
opera.exe
185.26.182.93:443
certs.opera.com
Opera Software AS
—
whitelisted
912
iexplore.exe
46.105.98.67:80
metin2mod.tk
OVH SAS
FR
suspicious
2608
opera.exe
46.105.98.67:80
metin2mod.tk
OVH SAS
FR
suspicious

DNS requests

Domain
IP
Reputation
metin2mod.tk
  • 46.105.98.67
suspicious
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 13.107.22.200
  • 131.253.33.200
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ctldl.windowsupdate.com
  • 209.197.3.8
  • 178.79.242.128
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
certs.opera.com
  • 185.26.182.93
  • 185.26.182.94
whitelisted
crl3.digicert.com
  • 93.184.220.29
whitelisted
sitecheck2.opera.com
  • 82.145.216.15
  • 82.145.216.16
whitelisted
fonts.googleapis.com
  • 142.250.185.234
  • 172.217.23.106
whitelisted
pagead2.googlesyndication.com
  • 172.217.16.194
  • 142.250.186.98
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query to a .tk domain - Likely Hostile
2608
opera.exe
Potentially Bad Traffic
ET POLICY HTTP Request to a *.tk domain
2608
opera.exe
Potentially Bad Traffic
ET POLICY HTTP Request to a *.tk domain
2608
opera.exe
Potentially Bad Traffic
ET POLICY HTTP Request to a *.tk domain
2608
opera.exe
Potentially Bad Traffic
ET POLICY HTTP Request to a *.tk domain
2608
opera.exe
Potentially Bad Traffic
ET POLICY HTTP Request to a *.tk domain
2608
opera.exe
Potentially Bad Traffic
ET POLICY HTTP Request to a *.tk domain
2608
opera.exe
Potentially Bad Traffic
ET POLICY HTTP Request to a *.tk domain
2608
opera.exe
Potentially Bad Traffic
ET POLICY HTTP Request to a *.tk domain
2608
opera.exe
Potentially Bad Traffic
ET POLICY HTTP Request to a *.tk domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://metin2mod.tk/?page_id=6