download:

download2.php

Full analysis: https://app.any.run/tasks/502352d7-03f6-4a1a-babc-60722f2b39a8
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: September 07, 2020, 13:38:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
adware
sogou
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

A5274644A06E5FB98E06E69C9539D996

SHA1:

D3F89484DDE1813894AC1387739B2D23E1EE1D7D

SHA256:

65F2422BAC25D7DF26602BE4AF378706839F38B4838A3A504D4BC9E546198D93

SSDEEP:

196608:LxTTjqFP2fJGYClAt2IqsrkaDnM06CsmCt:1KFPwGYC2tcsrkaDMqq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • download2.php.exe (PID: 1744)
      • Sky Email Extractor.exe (PID: 3248)
      • Sky Email Extractor.exe (PID: 612)
      • Sky Email Extractor.exe (PID: 1756)

    • Application was dropped or rewritten from another process

      • ns2255.tmp (PID: 1228)
      • ns2A27.tmp (PID: 3988)
      • ns24F6.tmp (PID: 3516)
      • ns2D35.tmp (PID: 1752)
      • Sky Email Extractor.exe (PID: 3248)
      • Sky Email Extractor.exe (PID: 1756)
      • Sky Email Extractor.exe (PID: 612)

    • Adds new firewall rule via NETSH.EXE

      • ns2255.tmp (PID: 1228)
      • ns2A27.tmp (PID: 3988)
      • ns2D35.tmp (PID: 1752)
      • ns24F6.tmp (PID: 3516)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • download2.php.exe (PID: 1744)

    • Creates files in the program directory

      • download2.php.exe (PID: 1744)

    • Creates files in the user directory

      • download2.php.exe (PID: 1744)

    • Starts application with an unusual extension

      • download2.php.exe (PID: 1744)

    • Uses NETSH.EXE for network configuration

      • ns2D35.tmp (PID: 1752)
      • ns24F6.tmp (PID: 3516)
      • ns2255.tmp (PID: 1228)
      • ns2A27.tmp (PID: 3988)

    • Creates a software uninstall entry

      • download2.php.exe (PID: 1744)

    • Starts Internet Explorer

      • Sky Email Extractor.exe (PID: 3248)

  • INFO

    • Manual execution by user

      • Sky Email Extractor.exe (PID: 1756)
      • Sky Email Extractor.exe (PID: 612)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3492)
      • iexplore.exe (PID: 3040)

    • Changes internet zones settings

      • iexplore.exe (PID: 3492)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3040)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 3040)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3040)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3492)
      • iexplore.exe (PID: 3040)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3040)

    • Creates files in the user directory

      • iexplore.exe (PID: 3040)
      • iexplore.exe (PID: 3492)

    • Application launched itself

      • iexplore.exe (PID: 3492)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | NSIS - Nullsoft Scriptable Install System (91.9)
.exe | Win32 Executable MS Visual C++ (generic) (3.3)
.exe | Win64 Executable (generic) (3)
.dll | Win32 Dynamic Link Library (generic) (0.7)
.exe | Win32 Executable (generic) (0.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2009:06:18 23:33:27+02:00
PEType: PE32
LinkerVersion: 6
CodeSize: 23552
InitializedDataSize: 119808
UninitializedDataSize: 1024
EntryPoint: 0x3291
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 8.0.1.2
ProductVersionNumber: 8.0.1.2
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: ASCII
Comments: Sky Email Extractor 8.0.1.2
CompanyName: www.skyextractor.com
FileDescription: Sky Email Extractor Setup
FileVersion: 8.0.1.2
LegalCopyright: Copyright (C) www.skyextractor.com
ProductName: Sky Email Extractor 8.0.1.2
ProductVersion: 8.0.1.2

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 18-Jun-2009 21:33:27
Detected languages:
  • English - United States
Comments: Sky Email Extractor 8.0.1.2
CompanyName: www.skyextractor.com
FileDescription: Sky Email Extractor Setup
FileVersion: 8.0.1.2
LegalCopyright: Copyright (C) www.skyextractor.com
ProductName: Sky Email Extractor 8.0.1.2
ProductVersion: 8.0.1.2

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000C8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 18-Jun-2009 21:33:27
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00005BC0
0x00005C00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.47639
.rdata
0x00007000
0x00001190
0x00001200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.18129
.data
0x00009000
0x0001AF78
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.72275
.ndata
0x00024000
0x0000A000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x0002E000
0x000485D8
0x00048600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.36824

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.21446
958
UNKNOWN
English - United States
RT_MANIFEST
2
5.40633
9640
UNKNOWN
English - United States
RT_ICON
3
5.55559
4264
UNKNOWN
English - United States
RT_ICON
4
6.0482
2440
UNKNOWN
English - United States
RT_ICON
5
0
1640
UNKNOWN
English - United States
RT_ICON
6
0
1384
UNKNOWN
English - United States
RT_ICON
7
0
1128
UNKNOWN
English - United States
RT_ICON
8
0
744
UNKNOWN
English - United States
RT_ICON
9
0
296
UNKNOWN
English - United States
RT_ICON
102
2.71813
180
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
VERSION.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
70
Monitored processes
15
Malicious processes
4
Suspicious processes
4

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start drop and start drop and start start download2.php.exe ns2255.tmp no specs netsh.exe no specs ns24f6.tmp no specs netsh.exe no specs ns2a27.tmp no specs netsh.exe no specs ns2d35.tmp no specs netsh.exe no specs sky email extractor.exe sky email extractor.exe sky email extractor.exe iexplore.exe iexplore.exe download2.php.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
612"C:\Program Files\Sky Email Extractor\Sky Email Extractor.exe" C:\Program Files\Sky Email Extractor\Sky Email Extractor.exe
explorer.exe
User:
admin
Company:
Sky Email Extractor
Integrity Level:
MEDIUM
Description:
Sky Email Extractor
Exit code:
0
Version:
8.0.1.2
Modules
Images
c:\program files\sky email extractor\sky email extractor.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\sky email extractor\libcurl.dll
c:\program files\sky email extractor\libssl-1_1.dll
c:\program files\sky email extractor\libcrypto-1_1.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
1228"C:\Users\admin\AppData\Local\Temp\nsqD33A.tmp\ns2255.tmp" netsh advfirewall firewall add rule name="Sky Email Extractor" dir=in program="C:\Program Files\Sky Email Extractor\Sky Email Extractor.exe" action=allowC:\Users\admin\AppData\Local\Temp\nsqD33A.tmp\ns2255.tmp—download2.php.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsqd33a.tmp\ns2255.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1296netsh advfirewall firewall add rule name="Sky Email Extractor Update" dir=out program="C:\Program Files\Sky Email Extractor\SkyUpdateU.exe" action=allowC:\Windows\system32\netsh.exe—ns2D35.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\gdi32.dll
1744"C:\Users\admin\AppData\Local\Temp\download2.php.exe" C:\Users\admin\AppData\Local\Temp\download2.php.exe
explorer.exe
User:
admin
Company:
www.skyextractor.com
Integrity Level:
HIGH
Description:
Sky Email Extractor Setup
Exit code:
0
Version:
8.0.1.2
Modules
Images
c:\users\admin\appdata\local\temp\download2.php.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1752"C:\Users\admin\AppData\Local\Temp\nsqD33A.tmp\ns2D35.tmp" netsh advfirewall firewall add rule name="Sky Email Extractor Update" dir=out program="C:\Program Files\Sky Email Extractor\SkyUpdateU.exe" action=allowC:\Users\admin\AppData\Local\Temp\nsqD33A.tmp\ns2D35.tmp—download2.php.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsqd33a.tmp\ns2d35.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1756"C:\Program Files\Sky Email Extractor\Sky Email Extractor.exe" C:\Program Files\Sky Email Extractor\Sky Email Extractor.exe
explorer.exe
User:
admin
Company:
Sky Email Extractor
Integrity Level:
MEDIUM
Description:
Sky Email Extractor
Exit code:
0
Version:
8.0.1.2
Modules
Images
c:\program files\sky email extractor\sky email extractor.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\sky email extractor\libcurl.dll
c:\program files\sky email extractor\libssl-1_1.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\program files\sky email extractor\libcrypto-1_1.dll
c:\windows\system32\rpcrt4.dll
1852netsh advfirewall firewall add rule name="Sky Email Extractor" dir=in program="C:\Program Files\Sky Email Extractor\Sky Email Extractor.exe" action=allowC:\Windows\system32\netsh.exe—ns2255.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2056netsh advfirewall firewall add rule name="Sky Email Extractor Update" dir=in program="C:\Program Files\Sky Email Extractor\SkyUpdateU.exe" action=allowC:\Windows\system32\netsh.exe—ns2A27.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
2948"C:\Users\admin\AppData\Local\Temp\download2.php.exe" C:\Users\admin\AppData\Local\Temp\download2.php.exe—explorer.exe
User:
admin
Company:
www.skyextractor.com
Integrity Level:
MEDIUM
Description:
Sky Email Extractor Setup
Exit code:
3221226540
Version:
8.0.1.2
Modules
Images
c:\users\admin\appdata\local\temp\download2.php.exe
c:\systemroot\system32\ntdll.dll
3040"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3492 CREDAT:275457 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
2 008
Read events
1 652
Write events
355
Delete events
1

Modification events

(PID) Process:(1852) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\139\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1852) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\139\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dhcpqec.dll,-100
Value:
DHCP Quarantine Enforcement Client
(PID) Process:(1852) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\139\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dhcpqec.dll,-101
Value:
Provides DHCP based enforcement for NAP
(PID) Process:(1852) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\139\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dhcpqec.dll,-103
Value:
1.0
(PID) Process:(1852) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\139\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dhcpqec.dll,-102
Value:
Microsoft Corporation
(PID) Process:(1852) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\139\52C64B7E
Operation:writeName:@%SystemRoot%\system32\napipsec.dll,-1
Value:
IPsec Relying Party
(PID) Process:(1852) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\139\52C64B7E
Operation:writeName:@%SystemRoot%\system32\napipsec.dll,-2
Value:
Provides IPsec based enforcement for Network Access Protection
(PID) Process:(1852) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\139\52C64B7E
Operation:writeName:@%SystemRoot%\system32\napipsec.dll,-4
Value:
1.0
(PID) Process:(1852) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\139\52C64B7E
Operation:writeName:@%SystemRoot%\system32\napipsec.dll,-3
Value:
Microsoft Corporation
(PID) Process:(1852) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\139\52C64B7E
Operation:writeName:@%SystemRoot%\system32\tsgqec.dll,-100
Value:
RD Gateway Quarantine Enforcement Client
Executable files
20
Suspicious files
84
Text files
260
Unknown types
65

Dropped files

PID
Process
Filename
Type
1744download2.php.exeC:\Program Files\Sky Email Extractor\Sky Email Extractor.exeexecutable
MD5:—
SHA256:—
1744download2.php.exeC:\Users\admin\AppData\Local\Temp\nsqD33A.tmp\ioSpecial.initext
MD5:—
SHA256:—
1744download2.php.exeC:\Program Files\Sky Email Extractor\SkyUpdateU.exeexecutable
MD5:—
SHA256:—
1744download2.php.exeC:\Users\admin\AppData\Local\Temp\nsqD33A.tmp\modern-wizard.bmpimage
MD5:9E4CD80A60DB6947642677BF31A10906
SHA256:A7B2F12E01CBEA88D4F645F797F2CA6107D76AE13CD1BE6DC532B759BFE0D925
1744download2.php.exeC:\Program Files\Sky Email Extractor\u.initext
MD5:—
SHA256:—
1744download2.php.exeC:\Users\admin\Desktop\Sky Email Extractor.lnklnk
MD5:—
SHA256:—
1744download2.php.exeC:\Program Files\Sky Email Extractor\uninst.exeexecutable
MD5:—
SHA256:—
1744download2.php.exeC:\Users\admin\AppData\Local\Temp\nsqD33A.tmp\modern-header.bmpimage
MD5:852B07C25E75B8A5356931C91C834EFC
SHA256:BD146E39AF28CEC251D63DA453CB8F04B74904A643F4C3DAB52EF2B5BCB4BB3A
1744download2.php.exeC:\Users\admin\AppData\Local\Temp\nsqD33A.tmp\InstallOptions.dllexecutable
MD5:0DC0CC7A6D9DB685BF05A7E5F3EA4781
SHA256:8E287326F1CDD5EF2DCD7A72537C68CBE4299CEB1F820707C5820F3AA6D8206C
1744download2.php.exeC:\Program Files\Sky Email Extractor\libcurl.dllexecutable
MD5:9F34EFF5830568EEA0B474BA79312041
SHA256:77B82A2442F801680BC87D6407F7B38FD2A257FE7049B18E5B505F9FD5235C09
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
405
TCP/UDP connections
757
DNS requests
195
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
612
Sky Email Extractor.exe
GET
301
104.24.101.130:80
http://srkhost.eu/index
US
html
232 b
shared
612
Sky Email Extractor.exe
GET
301
104.24.101.130:80
http://srkhost.eu/
US
html
227 b
shared
612
Sky Email Extractor.exe
GET
301
104.24.101.130:80
http://srkhost.eu/contacts
US
html
235 b
shared
612
Sky Email Extractor.exe
GET
301
104.24.101.130:80
http://srkhost.eu/mta
US
html
230 b
shared
612
Sky Email Extractor.exe
GET
301
104.24.101.130:80
http://srkhost.eu/ts3
US
html
230 b
shared
612
Sky Email Extractor.exe
GET
301
104.24.101.130:80
http://srkhost.eu/vintage
US
html
234 b
shared
612
Sky Email Extractor.exe
GET
301
104.24.101.130:80
http://srkhost.eu/services
US
html
235 b
shared
612
Sky Email Extractor.exe
GET
301
104.24.101.130:80
http://srkhost.eu/gallery
US
html
234 b
shared
612
Sky Email Extractor.exe
GET
301
104.24.101.130:80
http://srkhost.eu/mumble
US
html
233 b
shared
612
Sky Email Extractor.exe
GET
301
104.24.101.130:80
http://srkhost.eu/musicbot
US
html
235 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3248
Sky Email Extractor.exe
52.88.121.199:443
www.skyextractor.com
Amazon.com, Inc.
US
unknown
1756
Sky Email Extractor.exe
52.88.121.199:443
www.skyextractor.com
Amazon.com, Inc.
US
unknown
612
Sky Email Extractor.exe
52.88.121.199:443
www.skyextractor.com
Amazon.com, Inc.
US
unknown
612
Sky Email Extractor.exe
51.210.44.203:443
ugyfelkapu.srkhost.eu
—
GB
unknown
612
Sky Email Extractor.exe
217.144.54.196:443
game.srkhost.eu
Deninet KFT
HU
unknown
—
—
172.67.193.238:443
srkhost.eu
—
US
suspicious
—
—
104.24.101.130:443
srkhost.eu
Cloudflare Inc
US
shared
612
Sky Email Extractor.exe
162.159.130.233:443
discordapp.com
Cloudflare Inc
—
shared
3248
Sky Email Extractor.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
612
Sky Email Extractor.exe
162.159.138.232:443
discord.com
Cloudflare Inc
—
malicious

DNS requests

Domain
IP
Reputation
www.skyextractor.com
  • 52.88.121.199
unknown
srkhost.eu
  • 104.24.101.130
  • 104.24.100.130
  • 172.67.193.238
unknown
www.srkhost.eu
  • 172.67.193.238
  • 104.24.101.130
  • 104.24.100.130
unknown
ugyfelkapu.srkhost.eu
  • 51.210.44.203
unknown
game.srkhost.eu
  • 217.144.54.196
unknown
dc.srkhost.eu
  • 104.24.101.130
  • 104.24.100.130
  • 172.67.193.238
unknown
discordapp.com
  • 162.159.130.233
  • 162.159.129.233
  • 162.159.133.233
  • 162.159.134.233
  • 162.159.135.233
whitelisted
discord.com
  • 162.159.138.232
  • 162.159.136.232
  • 162.159.128.233
  • 162.159.135.232
  • 162.159.137.232
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.baidu.com
  • 103.235.46.39
whitelisted

Threats

PID
Process
Class
Message
3040
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY Outdated Flash Version M1
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
download2.php