URL:

https://download2447.mediafire.com/zm21nnk7aujg2JM70Ikl3C5_Na_jQ1lihcVm28yRVWJaSaEftzg0m3ps-j4bS194hYAx7iVUl1hhSiO3GsvFKIyjE0vD3Nya9WlTCginEvtHRegd5NblkC6gc3ftl8nTn8sj3xNtQNg5y94Ysrk8an6mha8o89ik0GyhDNwyOYRA6Q/2akwfxzvwowoigt/JDownloaderSetup.exe

Full analysis: https://app.any.run/tasks/e5ce86a3-fc98-4cc3-8353-f8a29b0ae0a9
Verdict: Malicious activity
Analysis date: February 17, 2024, 18:19:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
covid19
Indicators:
MD5:

73E261F415A928D23806A99FFCB44434

SHA1:

5896627594D7203B952A52C217EA27F9BAFCB6B2

SHA256:

703027A0AC4F776D2379EBFE63EDF3E7F09D9D7C5FB68A724DF83B15CDBC8A5A

SSDEEP:

6:2SWo2eGddZk2jzceRzB4gMWILPkxFfbrBeJvK7EHLMnzsA:2t3eQdZkgLB4gMWILPkt4K7k8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • JDownloaderSetup.exe (PID: 1972)
      • Carrier.exe (PID: 1892)
      • avira__sptl1___lavasoft.exe (PID: 3484)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • JDownloaderSetup.exe (PID: 1972)
      • avira__sptl1___lavasoft.exe (PID: 3484)

    • Executable content was dropped or overwritten

      • JDownloaderSetup.exe (PID: 1972)
      • Carrier.exe (PID: 1892)
      • avira__sptl1___lavasoft.exe (PID: 3484)

    • Reads the Internet Settings

      • installer.exe (PID: 2960)
      • cmd.exe (PID: 840)
      • Avira.Spotlight.Bootstrapper.exe (PID: 548)
      • GenericSetup.exe (PID: 2644)
      • Carrier.exe (PID: 1892)
      • reg.exe (PID: 3936)
      • reg.exe (PID: 3344)
      • reg.exe (PID: 2292)
      • reg.exe (PID: 2064)

    • Reads security settings of Internet Explorer

      • GenericSetup.exe (PID: 2644)
      • Avira.Spotlight.Bootstrapper.exe (PID: 548)
      • installer.exe (PID: 2960)

    • Searches for installed software

      • GenericSetup.exe (PID: 2644)
      • Avira.Spotlight.Bootstrapper.exe (PID: 548)

    • Checks Windows Trust Settings

      • GenericSetup.exe (PID: 2644)

    • Starts CMD.EXE for commands execution

      • GenericSetup.exe (PID: 2644)

    • Reads settings of System Certificates

      • GenericSetup.exe (PID: 2644)
      • Avira.Spotlight.Bootstrapper.exe (PID: 548)

    • Adds/modifies Windows certificates

      • GenericSetup.exe (PID: 2644)

    • The executable file from the user directory is run by the CMD process

      • Carrier.exe (PID: 1892)
      • avira__sptl1___lavasoft.exe (PID: 3484)

    • Reads the Windows owner or organization settings

      • GenericSetup.exe (PID: 2644)

    • Process drops legitimate windows executable

      • Carrier.exe (PID: 1892)

    • The process drops C-runtime libraries

      • Carrier.exe (PID: 1892)

    • Process requests binary or script from the Internet

      • Carrier.exe (PID: 1892)

  • INFO

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 3952)

    • Application launched itself

      • iexplore.exe (PID: 3864)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3952)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3864)

    • Checks supported languages

      • JDownloaderSetup.exe (PID: 1972)
      • installer.exe (PID: 2960)
      • GenericSetup.exe (PID: 2644)
      • Carrier.exe (PID: 1892)
      • unpack200.exe (PID: 1608)
      • unpack200.exe (PID: 1840)
      • unpack200.exe (PID: 3036)
      • unpack200.exe (PID: 2808)
      • unpack200.exe (PID: 124)
      • unpack200.exe (PID: 920)
      • unpack200.exe (PID: 3900)
      • unpack200.exe (PID: 1652)
      • unpack200.exe (PID: 2828)
      • unpack200.exe (PID: 948)
      • unpack200.exe (PID: 3232)
      • unpack200.exe (PID: 3292)
      • avira__sptl1___lavasoft.exe (PID: 3484)
      • Avira.Spotlight.Bootstrapper.exe (PID: 548)
      • unpack200.exe (PID: 2032)
      • unpack200.exe (PID: 2104)
      • unpack200.exe (PID: 3436)
      • unpack200.exe (PID: 3572)
      • unpack200.exe (PID: 3756)
      • unpack200.exe (PID: 3360)
      • java.exe (PID: 3388)
      • unpack200.exe (PID: 3428)
      • unpack200.exe (PID: 864)
      • unpack200.exe (PID: 3672)
      • javaw.exe (PID: 2908)

    • Create files in a temporary directory

      • JDownloaderSetup.exe (PID: 1972)
      • GenericSetup.exe (PID: 2644)
      • Carrier.exe (PID: 1892)
      • unpack200.exe (PID: 3036)
      • unpack200.exe (PID: 1608)
      • unpack200.exe (PID: 2808)
      • unpack200.exe (PID: 124)
      • unpack200.exe (PID: 1840)
      • unpack200.exe (PID: 3292)
      • unpack200.exe (PID: 3232)
      • unpack200.exe (PID: 3900)
      • unpack200.exe (PID: 2828)
      • unpack200.exe (PID: 1652)
      • unpack200.exe (PID: 920)
      • unpack200.exe (PID: 948)
      • avira__sptl1___lavasoft.exe (PID: 3484)
      • Avira.Spotlight.Bootstrapper.exe (PID: 548)
      • unpack200.exe (PID: 2104)
      • unpack200.exe (PID: 2032)
      • unpack200.exe (PID: 3436)
      • unpack200.exe (PID: 3572)
      • installer.exe (PID: 2960)
      • unpack200.exe (PID: 3756)
      • unpack200.exe (PID: 3360)
      • java.exe (PID: 3388)
      • unpack200.exe (PID: 3672)
      • unpack200.exe (PID: 3428)
      • unpack200.exe (PID: 864)
      • javaw.exe (PID: 2908)

    • The process uses the downloaded file

      • iexplore.exe (PID: 3864)

    • Reads the computer name

      • installer.exe (PID: 2960)
      • Avira.Spotlight.Bootstrapper.exe (PID: 548)
      • GenericSetup.exe (PID: 2644)
      • Carrier.exe (PID: 1892)

    • Reads the machine GUID from the registry

      • installer.exe (PID: 2960)
      • GenericSetup.exe (PID: 2644)
      • Avira.Spotlight.Bootstrapper.exe (PID: 548)
      • Carrier.exe (PID: 1892)

    • Reads the software policy settings

      • GenericSetup.exe (PID: 2644)
      • Avira.Spotlight.Bootstrapper.exe (PID: 548)

    • Reads Environment values

      • GenericSetup.exe (PID: 2644)
      • Avira.Spotlight.Bootstrapper.exe (PID: 548)

    • Reads product name

      • GenericSetup.exe (PID: 2644)

    • Creates files in the program directory

      • Avira.Spotlight.Bootstrapper.exe (PID: 548)
      • java.exe (PID: 3388)
      • Carrier.exe (PID: 1892)

    • Creates files or folders in the user directory

      • javaw.exe (PID: 2908)
      • Carrier.exe (PID: 1892)

    • Checks proxy server information

      • reg.exe (PID: 3344)
      • reg.exe (PID: 3936)
      • reg.exe (PID: 2292)
      • reg.exe (PID: 2064)

    • Drops a (possible) Coronavirus decoy

      • Carrier.exe (PID: 1892)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
113
Monitored processes
42
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe jdownloadersetup.exe no specs jdownloadersetup.exe installer.exe genericsetup.exe cmd.exe no specs carrier.exe cmd.exe no specs msiexec.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs cmd.exe no specs avira__sptl1___lavasoft.exe avira.spotlight.bootstrapper.exe schtasks.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs java.exe no specs icacls.exe no specs unpack200.exe no specs unpack200.exe no specs unpack200.exe no specs reg.exe no specs reg.exe no specs javaw.exe no specs reg.exe no specs reg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
124-r "jre\lib\jsse.jar.pack" "jre\lib\jsse.jar"C:\Users\admin\AppData\Local\Temp\e4j3E76.tmp_dir1708194085\jre\bin\unpack200.exe—Carrier.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
HIGH
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.1620.12
Modules
Images
c:\users\admin\appdata\local\temp\e4j3e76.tmp_dir1708194085\jre\bin\unpack200.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\e4j3e76.tmp_dir1708194085\jre\bin\msvcr100.dll
548"C:\Users\admin\AppData\Local\Temp\.CR.6493\Avira.Spotlight.Bootstrapper.exe" "C:\Users\admin\AppData\Local\Temp\.CR.6493\Avira.Spotlight.Bootstrapper.exe" OriginalFileName=avira__sptl1___lavasoft.exe Silent=true AcceptEula=true LaunchUi=trueC:\Users\admin\AppData\Local\Temp\.CR.6493\Avira.Spotlight.Bootstrapper.exe
avira__sptl1___lavasoft.exe
User:
admin
Company:
Avira Operations GmbH
Integrity Level:
HIGH
Description:
Avira Security
Exit code:
0
Version:
1.0.47.529
Modules
Images
c:\users\admin\appdata\local\temp\.cr.6493\avira.spotlight.bootstrapper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
840"C:\Windows\system32\cmd.exe" /C ""anyPDF-h20-5.msi" /quiet"C:\Windows\System32\cmd.exe—GenericSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1620
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
864-r "C:\Users\admin\AppData\Local\Temp\e4j3E76.tmp_dir1708194085\user\JDownloader.jar.pack" "C:\Users\admin\AppData\Local\Temp\e4j3E76.tmp_dir1708194085\user\JDownloader.jar"C:\Users\admin\AppData\Local\Temp\e4j3E76.tmp_dir1708194085\jre\bin\unpack200.exe—Carrier.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
HIGH
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.1620.12
Modules
Images
c:\users\admin\appdata\local\temp\e4j3e76.tmp_dir1708194085\jre\bin\unpack200.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\e4j3e76.tmp_dir1708194085\jre\bin\msvcr100.dll
920-r "jre\lib\management-agent.jar.pack" "jre\lib\management-agent.jar"C:\Users\admin\AppData\Local\Temp\e4j3E76.tmp_dir1708194085\jre\bin\unpack200.exe—Carrier.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
HIGH
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.1620.12
Modules
Images
c:\users\admin\appdata\local\temp\e4j3e76.tmp_dir1708194085\jre\bin\unpack200.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\e4j3e76.tmp_dir1708194085\jre\bin\msvcr100.dll
948-r "jre\lib\plugin.jar.pack" "jre\lib\plugin.jar"C:\Users\admin\AppData\Local\Temp\e4j3E76.tmp_dir1708194085\jre\bin\unpack200.exe—Carrier.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
HIGH
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.1620.12
Modules
Images
c:\users\admin\appdata\local\temp\e4j3e76.tmp_dir1708194085\jre\bin\unpack200.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\e4j3e76.tmp_dir1708194085\jre\bin\msvcr100.dll
1608-r "jre\lib\charsets.jar.pack" "jre\lib\charsets.jar"C:\Users\admin\AppData\Local\Temp\e4j3E76.tmp_dir1708194085\jre\bin\unpack200.exe—Carrier.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
HIGH
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.1620.12
Modules
Images
c:\users\admin\appdata\local\temp\e4j3e76.tmp_dir1708194085\jre\bin\unpack200.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\e4j3e76.tmp_dir1708194085\jre\bin\msvcr100.dll
1652-r "jre\lib\ext\cldrdata.jar.pack" "jre\lib\ext\cldrdata.jar"C:\Users\admin\AppData\Local\Temp\e4j3E76.tmp_dir1708194085\jre\bin\unpack200.exe—Carrier.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
HIGH
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.1620.12
Modules
Images
c:\users\admin\appdata\local\temp\e4j3e76.tmp_dir1708194085\jre\bin\unpack200.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\e4j3e76.tmp_dir1708194085\jre\bin\msvcr100.dll
1840-r "jre\lib\jfr.jar.pack" "jre\lib\jfr.jar"C:\Users\admin\AppData\Local\Temp\e4j3E76.tmp_dir1708194085\jre\bin\unpack200.exe—Carrier.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
HIGH
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.1620.12
Modules
Images
c:\users\admin\appdata\local\temp\e4j3e76.tmp_dir1708194085\jre\bin\unpack200.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\e4j3e76.tmp_dir1708194085\jre\bin\msvcr100.dll
1892"C:\Users\admin\AppData\Local\Temp\7zS4B7E6C98\Carrier.exe" "-Dregistry=true" -DinstallationDir="C:\Users\admin\AppData\Local\JDownloader 2.0" -q "-Dfilelinks=dlc,jdc,ccf,rsdf" "-Ddesktoplink=true" "-Dquicklaunch=false"C:\Users\admin\AppData\Local\Temp\7zS4B7E6C98\Carrier.exe
cmd.exe
User:
admin
Company:
AppWork GmbH
Integrity Level:
HIGH
Description:
JDownloader
Exit code:
0
Version:
2.0
Modules
Images
c:\users\admin\appdata\local\temp\7zs4b7e6c98\carrier.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
264 133
Read events
204 579
Write events
59 506
Delete events
48

Modification events

(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31089101
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31089101
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
544
Suspicious files
2 041
Text files
387
Unknown types
86

Dropped files

PID
Process
Filename
Type
3952iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\JDownloaderSetup.exe.uednp5o.partial —
MD5:—
SHA256:—
3864iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\JDownloaderSetup.exe —
MD5:—
SHA256:—
3864iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\JDownloaderSetup.exe.uednp5o.partial:Zone.Identifiertext
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
3952iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:DBF565618B82F979C417E8B582DBA856
SHA256:2D96D4B6E5BA12FAC19B790132D069F49716A5D228E995AF4054F02123ED50E6
3952iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833Bbinary
MD5:B8AFEC44772040692071A1A9DD0320F7
SHA256:8D73CDE76EABF51FF9199F0FE9EDD8B92B7D9A8D1B0526AEA9238BA7223B4ED2
1972JDownloaderSetup.exeC:\Users\admin\AppData\Local\Temp\7zS4B7E6C98\BundleConfig.jsonbinary
MD5:F7FAD34FF06230D2A6613786C10C6290
SHA256:85B76ED9D5A824587DED19DDECD82FB3595AC3B935E53D8BE777192B65D129A3
3864iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:A2D26ECD425E801E13609DE524E4CDA2
SHA256:EA59863F24DFCD52B6412A4FF61997438B212DB6BE807AEC7EF818B4B9E2E9EE
3952iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\JDownloaderSetup[1].exeexecutable
MD5:BFA028BBFB6CDCF3240BC2BF14FDF1BE
SHA256:D78417B5E36A69B3670BC2AD9EFDE1247475AF1CDAB4338C411C8D603F90E549
3864iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:E4877DBE9F7E0ED1752F023913F0A3B6
SHA256:23F3F01C529C28C066F42CA9D99EA015FA981E5DAB96DBA004B34E3DAB4CA2EF
3952iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833Bbinary
MD5:C3D3DAC113DF3B4072E4935C159F7E2C
SHA256:8B720BABEC7332A69A4ED320AAE2CD6D0D9D3DE078BE33DA771E3B2E678AD438
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
26
TCP/UDP connections
48
DNS requests
23
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3952
iexplore.exe
GET
304
173.222.108.243:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?545e1839169dd0e6
unknown
—
—
unknown
3952
iexplore.exe
GET
304
173.222.108.243:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f78d505714a595e3
unknown
—
—
unknown
3952
iexplore.exe
GET
200
172.64.149.23:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQh80WaEMqmyEvaHjlisSfVM4p8SAQUF9nWJSdn%2BTHCSUPZMDZEjGypT%2BsCED%2B0KeRQ8NP60VP53TIby3A%3D
unknown
binary
471 b
unknown
3952
iexplore.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEBN9U5yqfDGppDNwGWiEeo0%3D
unknown
binary
2.18 Kb
unknown
3864
iexplore.exe
GET
304
2.19.198.41:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?18014fff35250a83
unknown
—
—
unknown
3864
iexplore.exe
GET
304
2.19.198.41:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?76ad697231f9b13b
unknown
—
—
unknown
1080
svchost.exe
GET
200
2.19.198.41:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?3e412f7b4eff0943
unknown
compressed
65.2 Kb
unknown
3864
iexplore.exe
GET
304
2.19.198.41:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?9aee5c2adfb08fdb
unknown
—
—
unknown
3864
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
1080
svchost.exe
GET
304
2.19.198.41:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e2ddf83a2417bb20
unknown
compressed
65.2 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3952
iexplore.exe
199.91.155.188:443
download2447.mediafire.com
MEDIAFIRE
US
unknown
3952
iexplore.exe
173.222.108.243:80
ctldl.windowsupdate.com
Akamai International B.V.
CH
unknown
3952
iexplore.exe
104.18.38.233:80
ocsp.usertrust.com
CLOUDFLARENET
—
shared
3952
iexplore.exe
172.64.149.23:80
ocsp.usertrust.com
CLOUDFLARENET
US
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3864
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted
1080
svchost.exe
2.19.198.41:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3864
iexplore.exe
2.19.198.41:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
download2447.mediafire.com
  • 199.91.155.188
unknown
ctldl.windowsupdate.com
  • 173.222.108.243
  • 173.222.108.227
  • 173.222.108.219
  • 173.222.108.179
  • 2.19.198.41
  • 2.19.198.65
  • 23.32.238.155
  • 23.32.238.113
  • 23.32.238.161
  • 23.32.238.129
  • 23.32.238.120
  • 23.32.238.114
  • 2.19.198.75
whitelisted
ocsp.usertrust.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.sectigo.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
flow.lavasoft.com
  • 104.17.8.52
  • 104.17.9.52
whitelisted
sos.adaware.com
  • 104.18.67.73
  • 104.18.68.73
whitelisted
ieonline.microsoft.com
  • 204.79.197.200
whitelisted

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain in DNS Lookup (download .mediafire .com)
2960
installer.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Lavasoft PUA/Adware Client Install
12 ETPRO signatures available at the full report
Process
Message
GenericSetup.exe
Error: File not found - h2osciter:console.tis
GenericSetup.exe
at sciter:init-script.tis
GenericSetup.exe
GenericSetup.exe
GenericSetup.exe
file:resources/tis/TranslateOfferTemplate.tis(82) : warning :'async' does not contain any 'await'
GenericSetup.exe
Error: File not found - h2osciter:console.tis
GenericSetup.exe
at sciter:init-script.tis
GenericSetup.exe
GenericSetup.exe
GenericSetup.exe
file:resources/tis/TranslateOfferTemplate.tis(82) : warning :'async' does not contain any 'await'
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://download2447.mediafire.com/zm21nnk7aujg2JM70Ikl3C5_Na_jQ1lihcVm28yRVWJaSaEftzg0m3ps-j4bS194hYAx7iVUl1hhSiO3GsvFKIyjE0vD3Nya9WlTCginEvtHRegd5NblkC6gc3ftl8nTn8sj3xNtQNg5y94Ysrk8an6mha8o89ik0GyhDNwyOYRA6Q/2akwfxzvwowoigt/JDownloaderSetup.exe