URL:

https://vegax.gg

Full analysis: https://app.any.run/tasks/1e6e3739-f211-4f17-935c-eb4220db15c2
Verdict: Malicious activity
Analysis date: October 23, 2023, 18:09:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

29965BD44BACB0DEBC3DAE584AA45488

SHA1:

42DB82C3C77F4B1974FEAFD7BDF38C897ACEF52F

SHA256:

7E4E9B7D8C69DBE80BCD3D155A1092A8268AA50C2E16B568D948CF00C4032F73

SSDEEP:

3:N8h0ln:2h0ln

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Vega_08460953.exe (PID: 292)
      • Vega_08460953.exe (PID: 2356)
      • setup08460953.exe (PID: 3612)
      • setup08460953.exe (PID: 3724)
      • OperaGX.exe (PID: 2940)
      • Vega X.exe (PID: 1880)
      • Vega X.exe (PID: 4088)

    • Drops the executable file immediately after the start

      • Vega_08460953.exe (PID: 2356)
      • setup08460953.exe (PID: 3612)
      • OperaGX.exe (PID: 2940)

    • Actions looks like stealing of personal data

      • setup08460953.exe (PID: 3612)

    • Loads dropped or rewritten executable

      • setup08460953.exe (PID: 3724)
      • setup08460953.exe (PID: 3612)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Vega_08460953.exe (PID: 2356)
      • setup08460953.exe (PID: 3612)
      • setup08460953.exe (PID: 3724)

    • Reads settings of System Certificates

      • Vega_08460953.exe (PID: 2356)
      • setup08460953.exe (PID: 3612)

    • Reads security settings of Internet Explorer

      • Vega_08460953.exe (PID: 2356)
      • setup08460953.exe (PID: 3612)

    • The process drops C-runtime libraries

      • setup08460953.exe (PID: 3612)

    • Process drops legitimate windows executable

      • setup08460953.exe (PID: 3612)

    • Checks Windows Trust Settings

      • Vega_08460953.exe (PID: 2356)
      • setup08460953.exe (PID: 3612)

    • Reads the Windows owner or organization settings

      • setup08460953.exe (PID: 3612)

    • Searches for installed software

      • setup08460953.exe (PID: 3612)

    • Adds/modifies Windows certificates

      • Vega_08460953.exe (PID: 2356)
      • iexplore.exe (PID: 3820)

    • Start notepad (likely ransomware note)

      • Vega_08460953.exe (PID: 2356)

    • Starts CMD.EXE for commands execution

      • setup08460953.exe (PID: 3612)

    • Executing commands from a ".bat" file

      • setup08460953.exe (PID: 3612)

    • Get information on the list of running processes

      • cmd.exe (PID: 1616)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 1616)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3820)
      • chrome.exe (PID: 2552)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 3820)
      • iexplore.exe (PID: 1560)
      • chrome.exe (PID: 3324)
      • WinRAR.exe (PID: 240)

    • The process uses the downloaded file

      • iexplore.exe (PID: 3820)
      • chrome.exe (PID: 3760)
      • chrome.exe (PID: 1336)
      • chrome.exe (PID: 3324)
      • WinRAR.exe (PID: 240)
      • chrome.exe (PID: 3184)

    • Checks supported languages

      • Vega_08460953.exe (PID: 2356)
      • setup08460953.exe (PID: 3612)
      • setup08460953.exe (PID: 3724)
      • OperaGX.exe (PID: 2940)
      • Vega X.exe (PID: 1880)
      • Vega X.exe (PID: 4088)

    • Reads the computer name

      • Vega_08460953.exe (PID: 2356)
      • setup08460953.exe (PID: 3612)
      • setup08460953.exe (PID: 3724)
      • Vega X.exe (PID: 1880)
      • Vega X.exe (PID: 4088)

    • Checks proxy server information

      • Vega_08460953.exe (PID: 2356)

    • Reads the machine GUID from the registry

      • Vega_08460953.exe (PID: 2356)
      • setup08460953.exe (PID: 3612)
      • setup08460953.exe (PID: 3724)
      • Vega X.exe (PID: 1880)
      • Vega X.exe (PID: 4088)

    • Create files in a temporary directory

      • setup08460953.exe (PID: 3612)
      • setup08460953.exe (PID: 3724)
      • OperaGX.exe (PID: 2940)

    • Creates files or folders in the user directory

      • Vega_08460953.exe (PID: 2356)
      • setup08460953.exe (PID: 3612)
      • OperaGX.exe (PID: 2940)

    • Reads product name

      • setup08460953.exe (PID: 3612)

    • Reads Environment values

      • setup08460953.exe (PID: 3612)

    • Manual execution by a user

      • chrome.exe (PID: 2552)
      • notepad.exe (PID: 2888)
      • Vega X.exe (PID: 1880)
      • Vega X.exe (PID: 4088)
      • notepad.exe (PID: 2224)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
99
Monitored processes
49
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start iexplore.exe iexplore.exe vega_08460953.exe no specs vega_08460953.exe setup08460953.exe setup08460953.exe no specs notepad.exe no specs cmd.exe no specs tasklist.exe no specs find.exe no specs timeout.exe no specs operagx.exe no specs chrome.exe chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winrar.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs searchprotocolhost.exe no specs notepad.exe no specs vega x.exe vega x.exe chrome.exe no specs chrome.exe no specs notepad.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
240"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\Vega.zip"C:\Program Files\WinRAR\WinRAR.exe—chrome.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
292"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\Vega_08460953.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\Vega_08460953.exe—iexplore.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Download Manager
Exit code:
3221226540
Version:
1
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\78rfyb7z\vega_08460953.exe
c:\windows\system32\ntdll.dll
948"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=540 --field-trial-handle=1152,i,13955448648296297026,963670922848943005,131072 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
1012"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x6acf8b38,0x6acf8b48,0x6acf8b54C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
1028"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4132 --field-trial-handle=1152,i,13955448648296297026,963670922848943005,131072 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1052"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=4312 --field-trial-handle=1152,i,13955448648296297026,963670922848943005,131072 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
1336"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4196 --field-trial-handle=1152,i,13955448648296297026,963670922848943005,131072 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\chrome.exe
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1396timeout 5C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
1560"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3820 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1616C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\H2OCleanup.bat""C:\Windows\System32\cmd.exe—setup08460953.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
Total events
40 586
Read events
40 272
Write events
308
Delete events
6

Modification events

(PID) Process:(3820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(3820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(3820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(3820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
39
Suspicious files
455
Text files
98
Unknown types
0

Dropped files

PID
Process
Filename
Type
1560iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
1560iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\CabC13A.tmpcompressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
1560iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
1560iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:B8C31D72AF32E4E3FF91A7372FC019BC
SHA256:E0358635739500B929436B90B3C145A651FAAAB3902105172A2077BC2A69EC77
1560iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\TarC13B.tmpbinary
MD5:9441737383D21192400ECA82FDA910EC
SHA256:BC3A6E84E41FAEB57E7C21AA3B60C2A64777107009727C5B7C0ED8FE658909E5
1560iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\TarC15D.tmpbinary
MD5:9441737383D21192400ECA82FDA910EC
SHA256:BC3A6E84E41FAEB57E7C21AA3B60C2A64777107009727C5B7C0ED8FE658909E5
1560iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\CabC15C.tmpcompressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
1560iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6688704DF53F38A6D7FEE74E6C9BEEA9binary
MD5:305711FB38905DE6A17167911595A2C8
SHA256:48D09BA8CAF602DAFDB565797947C08B19D87E555246964FA3329596D6620E3F
1560iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751binary
MD5:60FE01DF86BE2E5331B0CDBE86165686
SHA256:C08CCBC876CD5A7CDFA9670F9637DA57F6A1282198A9BC71FC7D7247A6E5B7A8
1560iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\fontawesome-all.min[1].csstext
MD5:E0076D9B1984448E1B530D5B1A419C7A
SHA256:19BC4712BCA32DB280000F294E2D0C1DC178063A9DD4278FC22D30A39C068846
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
42
TCP/UDP connections
118
DNS requests
95
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1560
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?ab6c62e3d2bbc5b0
unknown
compressed
4.66 Kb
unknown
1560
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?7147a541e8aecbd1
unknown
compressed
61.6 Kb
unknown
1560
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?060020e49c501eb3
unknown
compressed
4.66 Kb
unknown
1560
iexplore.exe
GET
200
142.251.141.35:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
binary
724 b
unknown
1560
iexplore.exe
GET
200
2.19.198.179:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgTMYVt80scUTq7%2FjMZCNFW%2BRA%3D%3D
unknown
der
503 b
unknown
1560
iexplore.exe
GET
200
142.251.141.35:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQD50q2MxTvdnxLfPCm8%2F51a
unknown
binary
472 b
unknown
1560
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?5a9de4fb6882b969
unknown
compressed
61.6 Kb
unknown
1560
iexplore.exe
GET
200
23.212.210.158:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
1560
iexplore.exe
GET
200
142.251.141.35:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
1560
iexplore.exe
GET
200
23.212.210.158:80
http://x2.c.lencr.org/
unknown
binary
300 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2656
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1560
iexplore.exe
194.233.168.129:443
—
Linode, LLC
DE
unknown
1560
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted
1560
iexplore.exe
23.212.210.158:80
x1.c.lencr.org
AKAMAI-AS
AU
unknown
1560
iexplore.exe
2.19.198.179:80
r3.o.lencr.org
Akamai International B.V.
DE
unknown
1560
iexplore.exe
216.58.213.106:443
fonts.googleapis.com
GOOGLE
US
unknown
1560
iexplore.exe
142.251.141.35:80
ocsp.pki.goog
GOOGLE
US
unknown
1560
iexplore.exe
172.217.20.67:443
fonts.gstatic.com
GOOGLE
US
whitelisted
3820
iexplore.exe
194.233.168.129:443
—
Linode, LLC
DE
unknown

DNS requests

Domain
IP
Reputation
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
x1.c.lencr.org
  • 23.212.210.158
whitelisted
r3.o.lencr.org
  • 2.19.198.179
  • 2.19.198.131
shared
fonts.googleapis.com
  • 216.58.213.106
  • 142.250.186.106
whitelisted
ocsp.pki.goog
  • 142.251.141.35
whitelisted
fonts.gstatic.com
  • 172.217.20.67
  • 216.58.206.35
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 13.107.21.200
  • 204.79.197.200
whitelisted
filedm.com
  • 188.114.97.3
  • 188.114.96.3
malicious
x2.c.lencr.org
  • 23.212.210.158
whitelisted

Threats

Found threats are available for the paid subscriptions
9 ETPRO signatures available at the full report
Process
Message
setup08460953.exe
setup08460953.exe
file:resources/tis/TranslateOfferTemplate.tis(82) : warning :'async' does not contain any 'await'
setup08460953.exe
at sciter:init-script.tis
setup08460953.exe
Error: File not found - sciterwrapper:console.tis
setup08460953.exe
setup08460953.exe
setup08460953.exe
setup08460953.exe
Error: File not found - sciterwrapper:console.tis
setup08460953.exe
at sciter:init-script.tis
setup08460953.exe
file:resources/tis/TranslateOfferTemplate.tis(82) : warning :'async' does not contain any 'await'
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://vegax.gg