analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://leakhispano.net/d/2879-wedmegoodcom-database-leaked-may-2021-free-download

Full analysis: https://app.any.run/tasks/ef7f7cf5-6d5d-49dc-a910-d8c847dc4d44
Verdict: Malicious activity
Analysis date: January 24, 2022, 20:22:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

C3E4486A945DC7CD60C0384DA25FA37F

SHA1:

C8E7A7ED1F3F47EE6CE3E1AFC8C187AAF8FB99D0

SHA256:

91E4A243A00D9BA722D1C4BB770DB4B1E3500318D2BE154C6C4A400DFC44258C

SSDEEP:

3:N8AEvS98XJpWEVaABI5J2IWBFz:2AEzXzWhB5JvWj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to CnC server

      • chrome.exe (PID: 3048)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3892)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 1864)

    • Drops a file with a compile date too recent

      • chrome.exe (PID: 1864)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 3012)
      • iexplore.exe (PID: 3892)
      • chrome.exe (PID: 1864)
      • chrome.exe (PID: 3048)
      • chrome.exe (PID: 1792)
      • chrome.exe (PID: 3656)
      • chrome.exe (PID: 3220)
      • chrome.exe (PID: 2756)
      • chrome.exe (PID: 1920)
      • chrome.exe (PID: 3464)
      • chrome.exe (PID: 3588)
      • chrome.exe (PID: 2980)
      • chrome.exe (PID: 2972)

    • Checks supported languages

      • iexplore.exe (PID: 3892)
      • iexplore.exe (PID: 3012)
      • chrome.exe (PID: 1864)
      • chrome.exe (PID: 2788)
      • chrome.exe (PID: 3048)
      • chrome.exe (PID: 1792)
      • chrome.exe (PID: 3944)
      • chrome.exe (PID: 3576)
      • chrome.exe (PID: 484)
      • chrome.exe (PID: 3476)
      • chrome.exe (PID: 4048)
      • chrome.exe (PID: 3656)
      • chrome.exe (PID: 3220)
      • chrome.exe (PID: 756)
      • chrome.exe (PID: 3748)
      • chrome.exe (PID: 3856)
      • chrome.exe (PID: 2756)
      • chrome.exe (PID: 2512)
      • chrome.exe (PID: 2328)
      • chrome.exe (PID: 3832)
      • chrome.exe (PID: 304)
      • chrome.exe (PID: 2004)
      • chrome.exe (PID: 1444)
      • chrome.exe (PID: 3268)
      • chrome.exe (PID: 1920)
      • chrome.exe (PID: 2400)
      • chrome.exe (PID: 3104)
      • chrome.exe (PID: 3184)
      • chrome.exe (PID: 684)
      • chrome.exe (PID: 3464)
      • chrome.exe (PID: 928)
      • chrome.exe (PID: 352)
      • chrome.exe (PID: 3400)
      • chrome.exe (PID: 2600)
      • chrome.exe (PID: 1344)
      • chrome.exe (PID: 860)
      • chrome.exe (PID: 3572)
      • chrome.exe (PID: 1284)
      • chrome.exe (PID: 3716)
      • chrome.exe (PID: 3820)
      • chrome.exe (PID: 2796)
      • chrome.exe (PID: 1984)
      • chrome.exe (PID: 1108)
      • chrome.exe (PID: 2060)
      • chrome.exe (PID: 3588)
      • chrome.exe (PID: 2428)
      • chrome.exe (PID: 2972)
      • chrome.exe (PID: 2980)
      • chrome.exe (PID: 1112)
      • chrome.exe (PID: 4076)
      • chrome.exe (PID: 2480)
      • chrome.exe (PID: 2360)
      • chrome.exe (PID: 572)
      • chrome.exe (PID: 548)
      • chrome.exe (PID: 872)
      • chrome.exe (PID: 2212)
      • chrome.exe (PID: 2792)
      • chrome.exe (PID: 1924)
      • chrome.exe (PID: 2664)
      • chrome.exe (PID: 3388)
      • chrome.exe (PID: 3936)
      • chrome.exe (PID: 3464)
      • chrome.exe (PID: 4048)
      • chrome.exe (PID: 628)
      • chrome.exe (PID: 2276)
      • chrome.exe (PID: 1592)
      • chrome.exe (PID: 2960)
      • chrome.exe (PID: 2032)
      • chrome.exe (PID: 2584)

    • Changes internet zones settings

      • iexplore.exe (PID: 3012)

    • Application launched itself

      • iexplore.exe (PID: 3012)
      • chrome.exe (PID: 1864)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3012)
      • chrome.exe (PID: 3048)
      • iexplore.exe (PID: 3892)

    • Manual execution by user

      • chrome.exe (PID: 1864)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3892)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3012)
      • iexplore.exe (PID: 3892)

    • Reads the hosts file

      • chrome.exe (PID: 3048)
      • chrome.exe (PID: 1864)

    • Creates files in the user directory

      • iexplore.exe (PID: 3892)
      • iexplore.exe (PID: 3012)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3012)

    • Reads the date of Windows installation

      • chrome.exe (PID: 3464)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3012)

    • Dropped object may contain Bitcoin addresses

      • chrome.exe (PID: 1864)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
105
Monitored processes
69
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3012"C:\Program Files\Internet Explorer\iexplore.exe" "https://leakhispano.net/d/2879-wedmegoodcom-database-leaked-may-2021-free-download"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
3892"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3012 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
1864"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
Explorer.EXE
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
2788"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=86.0.4240.198 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x6dbcd988,0x6dbcd998,0x6dbcd9a4C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
1792"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1056,3315253830100147579,17746079845989621163,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1072 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
3048"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1056,3315253830100147579,17746079845989621163,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1232 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
3944"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,3315253830100147579,17746079845989621163,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1896 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
86.0.4240.198
4048"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,3315253830100147579,17746079845989621163,131072 --enable-features=PasswordImport --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1876 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
484"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,3315253830100147579,17746079845989621163,131072 --enable-features=PasswordImport --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2252 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
3576"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,3315253830100147579,17746079845989621163,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2508 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Total events
35 095
Read events
34 767
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
426
Text files
330
Unknown types
26

Dropped files

PID
Process
Filename
Type
1864chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-61EF0A9B-748.pma —
MD5:—
SHA256:—
3012iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:9936174021189F76CB2586F8D24D6C63
SHA256:CD7D75FA1EFA8026A221C7FB2578198139C9D4DACB17602DDFF344336AEC43D3
3012iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:C6E093A9391492D63B95B5C896F155B5
SHA256:11EA88B50F9003B97564949169D1F9D649A1C354DCAB37372C9809A679EB0048
3012iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
1864chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\58bbc8c0-5ee6-4ed9-abd5-d9bbad596a4e.tmpbinary
MD5:5058F1AF8388633F609CADB75A75DC9D
SHA256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
1864chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF11a277.TMPtext
MD5:64AD8ED3E666540337BA541C549F72F7
SHA256:BECBDB08B5B37D203A85F2E974407334053BB1D2270F0B3C9A4DB963896F2206
3048chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1vxd
MD5:259E7ED5FB3C6C90533B963DA5B2FC1B
SHA256:35BB2F189C643DCF52ECF037603D104035ECDC490BF059B7736E58EF7D821A09
1864chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG.oldtext
MD5:EF1D5606A483BB6C72C81A3F649BEB18
SHA256:BA083E7585ADA9936944FE56BC0141A544F18A01C3424E5C9F02375B34FE3D45
3048chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cache\indexbinary
MD5:A35FBE66D2D8751A811309B4D156E8FA
SHA256:9E2F22A43E1D5022555F5061D4C5323663B3B355496AD4DF719599846D9617CD
3012iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:FC990EAA7247546FB67C18916A4CAC9B
SHA256:294F5BE9159C87842AD3173FE7CDA168C9F2010C6D428085A8AC30EF436CA993
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
94
TCP/UDP connections
236
DNS requests
169
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3048
chrome.exe
GET
200
172.67.68.51:80
http://gestyy.com/bundles/advertisement/img/tracking.gif?test=49b0535210481c53646be1e8f90d8798b4775f1b
US
—
—
whitelisted
3048
chrome.exe
GET
301
104.21.5.11:80
http://j.gs/19214853/wedmegood-database-leaked-may-2021
US
—
—
malicious
3012
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
3048
chrome.exe
GET
302
142.250.184.238:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx
US
html
555 b
whitelisted
3048
chrome.exe
GET
403
192.243.59.20:80
http://attendedimitationsurrender.com/59/9c/c8/599cc889b672d4d71332545891e4b532.js
US
—
—
malicious
3048
chrome.exe
GET
200
67.27.158.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?36ced50edbf95a56
US
compressed
59.9 Kb
whitelisted
3892
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
3048
chrome.exe
GET
200
172.217.130.72:80
http://r3---sn-2gb7sn7r.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx?cms_redirect=yes&mh=e_&mip=45.86.202.16&mm=28&mn=sn-2gb7sn7r&ms=nvh&mt=1643055382&mv=m&mvi=3&pl=24&shardbypass=yes&smhost=r3---sn-2gb7sn7s.gvt1.com
US
crx
242 Kb
whitelisted
3048
chrome.exe
OPTIONS
403
104.26.5.107:80
http://analytics.shorte.st/displayed
US
html
1.28 Kb
whitelisted
3012
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3012
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
3012
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3012
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
3048
chrome.exe
142.250.185.78:443
clients2.google.com
Google Inc.
US
whitelisted
3892
iexplore.exe
188.114.96.7:443
leakhispano.net
Cloudflare Inc
US
malicious
3048
chrome.exe
216.58.212.131:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
3892
iexplore.exe
188.114.97.7:443
leakhispano.net
Cloudflare Inc
US
malicious
3048
chrome.exe
142.250.185.163:443
fonts.gstatic.com
Google Inc.
US
whitelisted
3048
chrome.exe
142.250.186.142:443
apis.google.com
Google Inc.
US
whitelisted
3048
chrome.exe
142.250.185.68:443
www.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
leakhispano.net
  • 188.114.97.7
  • 188.114.96.7
malicious
api.bing.com
  • 13.107.13.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ctldl.windowsupdate.com
  • 209.197.3.8
  • 67.27.158.126
  • 67.26.73.254
  • 8.253.204.120
  • 67.26.75.254
  • 67.26.137.254
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
clientservices.googleapis.com
  • 216.58.212.131
whitelisted
clients2.google.com
  • 142.250.185.78
whitelisted
accounts.google.com
  • 142.250.185.237
shared
www.google.com
  • 142.250.185.68
  • 142.250.181.228
  • 142.250.185.132
whitelisted
fonts.googleapis.com
  • 142.250.185.202
  • 142.250.185.74
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query for .to TLD
3048
chrome.exe
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Response)
3048
chrome.exe
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Response)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Response)
3048
chrome.exe
Misc Attack
ET Threatview.io High Confidence Cobalt Strike C2 IP group 1
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://leakhispano.net/d/2879-wedmegoodcom-database-leaked-may-2021-free-download