analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://app.any.run/tasks/3c66ffc6-92e5-4f4a-8d82-d18e555d5e98/

Full analysis: https://app.any.run/tasks/5dd71602-01bf-4303-8bc5-c5e5e2638380
Verdict: Malicious activity
Analysis date: January 15, 2022, 00:59:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

9411C1409B1CACEE47C423017E131F99

SHA1:

1F17530B91846307A63C48767E67C5F18688AC72

SHA256:

942106CC0FB33F6184AF11A5D267D043631F522102310B9AC36780F14FBDFBE9

SSDEEP:

3:N8a3XQtnchAiEds+QzdK:2aQKhAPds7dK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • reg.exe (PID: 3316)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2708)
      • iexplore.exe (PID: 3004)
      • iexplore.exe (PID: 3856)

    • Checks supported languages

      • Skype.exe (PID: 836)
      • Skype.exe (PID: 3888)
      • Skype.exe (PID: 1088)
      • Skype.exe (PID: 2072)
      • Skype.exe (PID: 2216)
      • Skype.exe (PID: 4536)

    • Reads the computer name

      • Skype.exe (PID: 836)
      • Skype.exe (PID: 3888)
      • Skype.exe (PID: 2072)
      • Skype.exe (PID: 1088)
      • Skype.exe (PID: 2216)
      • Skype.exe (PID: 4536)

    • Application launched itself

      • Skype.exe (PID: 836)
      • Skype.exe (PID: 2072)
      • Skype.exe (PID: 2216)

    • Reads CPU info

      • Skype.exe (PID: 836)

    • Uses REG.EXE to modify Windows registry

      • Skype.exe (PID: 836)

    • Changes default file association

      • Skype.exe (PID: 836)

    • Creates files in the user directory

      • Skype.exe (PID: 836)
      • Skype.exe (PID: 2072)
      • Skype.exe (PID: 2216)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 3708)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 2708)
      • iexplore.exe (PID: 3004)
      • iexplore.exe (PID: 3856)
      • chrome.exe (PID: 2716)
      • chrome.exe (PID: 3228)
      • chrome.exe (PID: 3708)
      • opera.exe (PID: 1588)
      • chrome.exe (PID: 2076)
      • firefox.exe (PID: 712)
      • firefox.exe (PID: 2440)
      • firefox.exe (PID: 4040)
      • firefox.exe (PID: 3260)
      • firefox.exe (PID: 564)
      • chrome.exe (PID: 5480)

    • Checks supported languages

      • iexplore.exe (PID: 3004)
      • iexplore.exe (PID: 2708)
      • iexplore.exe (PID: 3856)
      • chrome.exe (PID: 3708)
      • chrome.exe (PID: 2412)
      • chrome.exe (PID: 2716)
      • chrome.exe (PID: 3228)
      • chrome.exe (PID: 3640)
      • opera.exe (PID: 1588)
      • chrome.exe (PID: 3576)
      • chrome.exe (PID: 3644)
      • reg.exe (PID: 3316)
      • reg.exe (PID: 2052)
      • chrome.exe (PID: 2076)
      • firefox.exe (PID: 2816)
      • firefox.exe (PID: 712)
      • firefox.exe (PID: 4040)
      • chrome.exe (PID: 872)
      • chrome.exe (PID: 1148)
      • firefox.exe (PID: 3260)
      • firefox.exe (PID: 2440)
      • firefox.exe (PID: 564)
      • chrome.exe (PID: 4456)
      • chrome.exe (PID: 3748)
      • chrome.exe (PID: 5820)
      • chrome.exe (PID: 5480)

    • Application launched itself

      • iexplore.exe (PID: 3004)
      • chrome.exe (PID: 3708)
      • firefox.exe (PID: 712)
      • firefox.exe (PID: 2816)

    • Changes internet zones settings

      • iexplore.exe (PID: 3004)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2708)
      • chrome.exe (PID: 2716)
      • Skype.exe (PID: 836)
      • iexplore.exe (PID: 3004)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3856)
      • iexplore.exe (PID: 2708)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2708)
      • iexplore.exe (PID: 3004)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 3004)
      • opera.exe (PID: 1588)
      • firefox.exe (PID: 712)

    • Manual execution by user

      • Skype.exe (PID: 836)
      • chrome.exe (PID: 3708)
      • opera.exe (PID: 1588)
      • firefox.exe (PID: 2816)

    • Reads the hosts file

      • chrome.exe (PID: 2716)
      • chrome.exe (PID: 3708)
      • Skype.exe (PID: 836)

    • Check for Java to be installed

      • opera.exe (PID: 1588)

    • Creates files in the user directory

      • opera.exe (PID: 1588)
      • firefox.exe (PID: 712)

    • Reads CPU info

      • firefox.exe (PID: 712)

    • Creates files in the program directory

      • firefox.exe (PID: 712)

    • Dropped object may contain Bitcoin addresses

      • opera.exe (PID: 1588)
      • Skype.exe (PID: 836)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
69
Monitored processes
32
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe iexplore.exe no specs skype.exe skype.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs opera.exe reg.exe skype.exe no specs reg.exe no specs chrome.exe no specs skype.exe firefox.exe no specs firefox.exe chrome.exe no specs firefox.exe no specs firefox.exe no specs chrome.exe no specs firefox.exe no specs firefox.exe no specs skype.exe no specs skype.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3004"C:\Program Files\Internet Explorer\iexplore.exe" "https://app.any.run/tasks/3c66ffc6-92e5-4f4a-8d82-d18e555d5e98/"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2708"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3004 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3856"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3004 CREDAT:267546 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
836"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" C:\Program Files\Microsoft\Skype for Desktop\Skype.exe
Explorer.EXE
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Version:
8.29.0.50
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft\skype for desktop\skype.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\skype for desktop\node.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\nsi.dll
c:\windows\system32\rpcrt4.dll
c:\program files\microsoft\skype for desktop\msvcp140.dll
3888"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" --reporter-url=https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload --application-name=skype-preview "--crashes-directory=C:\Users\admin\AppData\Local\Temp\skype-preview Crashes" --v=1C:\Program Files\Microsoft\Skype for Desktop\Skype.exe
Skype.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Version:
8.29.0.50
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft\skype for desktop\skype.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\skype for desktop\node.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\program files\microsoft\skype for desktop\vcruntime140.dll
3708"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
Explorer.EXE
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\winmm.dll
c:\windows\system32\gdi32.dll
2412"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=86.0.4240.198 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x6e08d988,0x6e08d998,0x6e08d9a4C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
3228"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=888,4674536508396183132,1108856029134970513,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1036 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
2716"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=888,4674536508396183132,1108856029134970513,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1264 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
3640"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=888,4674536508396183132,1108856029134970513,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1900 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
Total events
31 143
Read events
30 807
Write events
334
Delete events
2

Modification events

(PID) Process:(3004) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3004) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
611452768
(PID) Process:(3004) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30935467
(PID) Process:(3004) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
911459018
(PID) Process:(3004) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30935467
(PID) Process:(3004) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3004) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3004) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3004) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3004) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
238
Text files
147
Unknown types
42

Dropped files

PID
Process
Filename
Type
2708iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\9954b009ed36b87492d4f39a3573d92c2fb9bb22[1].js —
MD5:—
SHA256:—
3004iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF9DA1236079877401.TMPgmc
MD5:BF1BC1E9FFE28474ACF31FBDE4DE1FDA
SHA256:65E01F1E2CBE418740FE93D52B1650EBD034C832A531915DE77A0D4816A0F7BE
2708iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\646C991C2A28825F3CC56E0A1D1E3FA9der
MD5:AD854489398CCECF33973716EA9C88D2
SHA256:59020102EA386F018DEC0DE12F14AA0F13F5C8A2BD388FA433C43504B421E8B8
2708iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:8D34D1010CB94514B5DA128D87FC92AF
SHA256:8617AC7A05F0BE127E4D682038750C000A0CBFBEC3002AF5FDB6F5B032B13519
3004iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF683B33F689297A68.TMPgmc
MD5:93AB9DAB917CDA9929A611B93B3E4C75
SHA256:A6E0EB278F3A84F251F2E9A4EB80A7E4E4B8E8A5BCE55137F1FA5F830EF8499D
2708iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_E5B132B41B26E2FD23A912C0CB5FBCBAder
MD5:C4815BBDDDD37A45A6DF78B6C330D07C
SHA256:29E78BF056E19E529BD143D9C325AE9FF506C0B25B5B8C477171575D5D081186
3004iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Last Active\{68D348C6-759E-11EC-A20C-12A9866C77DE}.datbinary
MD5:AFE09EF6E45467FBE95A54FD840A3577
SHA256:C1251887D478FA1AC8A0522C6A11CB584B29D41B91E899FF039E2A192956C03F
2708iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_E5B132B41B26E2FD23A912C0CB5FBCBAbinary
MD5:21B96398CD1F2E4046AE168AF31A5F60
SHA256:1854444E56FAF75E41D0BCAA5E29EC68E2085A75A7122DFAECCBC4FA9517BE62
3004iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{6215223F-759E-11EC-A20C-12A9866C77DE}.datbinary
MD5:C5BF9970CB3428C25A7D622AB1138113
SHA256:C8EF9E1570F2925B5E792B36806F412CCBD21F38B5F8A0F04448CA38183AAB12
2708iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\PTSans_700[1].eoteot
MD5:AF104769F0F597B85D9CB038AE14FC5D
SHA256:51A732C7368F0ACCD1A49382CDC5822E75020EDFDA1AE0B59C5E7128C87B7630
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
76
DNS requests
91
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2708
iexplore.exe
GET
200
142.250.185.195:80
http://crl.pki.goog/gsr1/gsr1.crl
US
der
1.61 Kb
whitelisted
2708
iexplore.exe
GET
—
142.250.185.195:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
—
—
whitelisted
3004
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
3004
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
712
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
712
firefox.exe
POST
200
142.250.185.195:80
http://ocsp.pki.goog/gts1c3
US
der
471 b
whitelisted
2708
iexplore.exe
GET
200
142.250.185.195:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGmSmALa8169CgAAAAEn3NM%3D
US
der
471 b
whitelisted
2716
chrome.exe
GET
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx
US
crx
242 Kb
whitelisted
1588
opera.exe
GET
200
93.184.220.29:80
http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl
US
der
592 b
whitelisted
712
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2708
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2708
iexplore.exe
2.16.186.81:80
ctldl.windowsupdate.com
Akamai International B.V.
—
whitelisted
2708
iexplore.exe
142.250.186.106:443
fonts.googleapis.com
Google Inc.
US
whitelisted
2708
iexplore.exe
172.67.20.89:443
app.any.run
—
US
malicious
2708
iexplore.exe
142.250.185.195:80
ocsp.pki.goog
Google Inc.
US
whitelisted
2716
chrome.exe
142.250.185.174:443
clients2.google.com
Google Inc.
US
whitelisted
3004
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
2716
chrome.exe
142.250.185.68:443
www.google.com
Google Inc.
US
whitelisted
2716
chrome.exe
142.250.185.77:443
accounts.google.com
Google Inc.
US
suspicious
836
Skype.exe
52.168.112.66:443
pipe.skype.com
Microsoft Corporation
US
suspicious

DNS requests

Domain
IP
Reputation
app.any.run
  • 172.67.20.89
  • 104.22.48.74
  • 104.22.49.74
whitelisted
ctldl.windowsupdate.com
  • 2.16.186.81
  • 2.16.186.56
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
fonts.googleapis.com
  • 142.250.186.106
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ocsp.pki.goog
  • 142.250.185.195
whitelisted
crl.pki.goog
  • 142.250.185.195
whitelisted
clients2.google.com
  • 142.250.185.174
whitelisted
clientservices.googleapis.com
  • 142.250.181.227
whitelisted

Threats

PID
Process
Class
Message
712
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
712
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
Process
Message
Skype.exe
[3888:3240:0115/005948.638:VERBOSE1:crash_service_main.cc(78)] Session start. cmdline is [--reporter-url=https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload --application-name=skype-preview "--crashes-directory=C:\Users\admin\AppData\Local\Temp\skype-preview Crashes" --v=1]
Skype.exe
[3888:3240:0115/005948.654:VERBOSE1:crash_service.cc(145)] window handle is 00050184
Skype.exe
[3888:3240:0115/005948.654:VERBOSE1:crash_service.cc(300)] pipe name is \\.\pipe\skype-preview Crash Service dumps at C:\Users\admin\AppData\Local\Temp\skype-preview Crashes
Skype.exe
[3888:3240:0115/005948.654:VERBOSE1:crash_service.cc(304)] checkpoint is C:\Users\admin\AppData\Local\Temp\skype-preview Crashes\crash_checkpoint.txt server is https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload maximum 128 reports/day reporter is electron-crash-service
Skype.exe
[3888:3240:0115/005948.654:VERBOSE1:crash_service_main.cc(94)] Ready to process crash requests
Skype.exe
[3888:976:0115/005948.654:VERBOSE1:crash_service.cc(333)] client start. pid = 836
Skype.exe
[3888:976:0115/005951.463:VERBOSE1:crash_service.cc(333)] client start. pid = 2072
Skype.exe
[1088:1296:0115/005951.532:VERBOSE1:crash_service_main.cc(78)] Session start. cmdline is [--reporter-url=https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload --application-name=skype-preview "--crashes-directory=C:\Users\admin\AppData\Local\Temp\skype-preview Crashes" --v=1]
Skype.exe
[1088:1296:0115/005951.534:VERBOSE1:crash_service.cc(145)] window handle is 000601B2
Skype.exe
[1088:1296:0115/005951.534:VERBOSE1:crash_service.cc(300)] pipe name is \\.\pipe\skype-preview Crash Service dumps at C:\Users\admin\AppData\Local\Temp\skype-preview Crashes
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://app.any.run/tasks/3c66ffc6-92e5-4f4a-8d82-d18e555d5e98/