URL:

pushnami-api.ngrok.io

Full analysis: https://app.any.run/tasks/302ad27f-e054-4acb-8a9d-b3a25de2473a
Verdict: Malicious activity
Analysis date: October 05, 2023, 09:49:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

2A2D37E6D9834969B8B051633B65B858

SHA1:

CEF5A9FFBA10856C05C31D1C81F554368AF967D8

SHA256:

555EFD6810D024B9255372A9FD862A164573BCEA890BDE0A2A2D538635134CB3

SSDEEP:

3:vLhOXFH:vLhOXFH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Checks supported languages

      • wmpnscfg.exe (PID: 2980)

    • Reads the computer name

      • wmpnscfg.exe (PID: 2980)

    • Application launched itself

      • iexplore.exe (PID: 3460)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 2980)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
3
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2980"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\ole32.dll
3088"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3460 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3460"C:\Program Files\Internet Explorer\iexplore.exe" "pushnami-api.ngrok.io"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\iertutil.dll
Total events
12 935
Read events
12 874
Write events
61
Delete events
0

Modification events

(PID) Process:(3460) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(3460) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(3460) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(3460) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3460) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3460) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3460) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3460) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3460) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3460) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
17
Text files
9
Unknown types
0

Dropped files

PID
Process
Filename
Type
3088iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
3088iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751binary
MD5:60FE01DF86BE2E5331B0CDBE86165686
SHA256:C08CCBC876CD5A7CDFA9670F9637DA57F6A1282198A9BC71FC7D7247A6E5B7A8
3088iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\TarDB6.tmpbinary
MD5:9441737383D21192400ECA82FDA910EC
SHA256:BC3A6E84E41FAEB57E7C21AA3B60C2A64777107009727C5B7C0ED8FE658909E5
3088iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\59DC7A30E68EF77E3F9ED42DBA112C2Bbinary
MD5:650201266F8F7E4209D03DE99AA49819
SHA256:FC463DBEC4A0B27CAE96EA1D3B5AE0B249CBCF25A7A6211801847E8C747B774F
3088iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\92A0FAD14191F3B35FC94977838C5010binary
MD5:3692CE4C71BEED14CE30675E60601F14
SHA256:564A58D33DBEE4C59469280D90E91A656254C92F6EE6BD74077C1E6E71D8B8AA
3088iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\CabDB5.tmpcompressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
3088iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\59DC7A30E68EF77E3F9ED42DBA112C2Bbinary
MD5:F4C6271EE9BA69962B6B849434C16B02
SHA256:B620654476CE4F26425B23DBC15FB02DD32244DF9C7CE76031ED06BBE363D22D
3088iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\92A0FAD14191F3B35FC94977838C5010binary
MD5:9ECB9FDBD4131409599DA7C73803E194
SHA256:8F946F5E4361E903414981AB2EE69FE6A7FE7319E1167462E85CCDFC3F1D492C
3088iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
3088iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:4F8594549454244F4352FD1A858A6149
SHA256:9A5B530F3747C4EF0A558E858268882373210F114821632A87C54F33F2067BAD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
17
DNS requests
13
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3088
iexplore.exe
GET
200
184.24.77.73:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgNeBZt996pqRqGhHBG1OMxyBg%3D%3D
unknown
binary
503 b
unknown
3088
iexplore.exe
GET
200
8.248.139.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?cea21e78ec9e1ca9
unknown
compressed
61.6 Kb
unknown
3460
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
3088
iexplore.exe
GET
200
184.24.77.73:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgTnBY6wBZQJFMUctigkanOymA%3D%3D
unknown
der
503 b
unknown
3460
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
unknown
binary
1.47 Kb
unknown
3088
iexplore.exe
GET
200
8.248.139.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0268d712ea054da0
unknown
compressed
4.66 Kb
unknown
3088
iexplore.exe
GET
307
3.125.102.39:80
http://pushnami-api.ngrok.io/
unknown
html
66 b
unknown
3088
iexplore.exe
GET
200
23.212.210.158:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3088
iexplore.exe
3.125.102.39:80
pushnami-api.ngrok.io
AMAZON-02
DE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
3088
iexplore.exe
3.125.102.39:443
pushnami-api.ngrok.io
AMAZON-02
DE
unknown
3088
iexplore.exe
8.248.139.254:80
ctldl.windowsupdate.com
LEVEL3
US
unknown
3088
iexplore.exe
23.212.210.158:80
x1.c.lencr.org
AKAMAI-AS
AU
unknown
2656
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3088
iexplore.exe
184.24.77.73:80
r3.o.lencr.org
Akamai International B.V.
DE
unknown
3088
iexplore.exe
3.125.223.134:443
pushnami-api.ngrok.io
AMAZON-02
DE
malicious
3460
iexplore.exe
104.126.37.163:443
www.bing.com
Akamai International B.V.
DE
unknown
3460
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
pushnami-api.ngrok.io
  • 3.125.102.39
  • 3.125.209.94
  • 3.124.142.205
  • 18.192.31.165
  • 3.125.223.134
  • 18.158.249.75
unknown
ctldl.windowsupdate.com
  • 8.248.139.254
  • 8.241.11.126
  • 8.248.117.254
  • 8.238.29.254
  • 8.248.145.254
whitelisted
x1.c.lencr.org
  • 23.212.210.158
whitelisted
r3.o.lencr.org
  • 184.24.77.73
  • 184.24.77.78
  • 184.24.77.76
  • 184.24.77.63
  • 184.24.77.67
  • 184.24.77.60
  • 184.24.77.72
  • 184.24.77.69
  • 184.24.77.61
shared
cdn.ngrok.com
  • 3.125.223.134
  • 3.125.102.39
  • 3.125.209.94
  • 18.158.249.75
  • 18.192.31.165
  • 3.124.142.205
malicious
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.163
  • 104.126.37.128
  • 104.126.37.171
  • 104.126.37.184
  • 104.126.37.160
  • 104.126.37.130
  • 104.126.37.162
  • 104.126.37.161
  • 104.126.37.155
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted

Threats

PID
Process
Class
Message
1088
svchost.exe
Misc activity
ET INFO DNS Query to a *.ngrok domain (ngrok.io)
1088
svchost.exe
Potential Corporate Privacy Violation
ET POLICY DNS Query to a *.ngrok domain (ngrok.com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
pushnami-api.ngrok.io