URL:

givemeredditstreams.xyz/f1/600041133/gulf-air-bahrain-gp

Full analysis: https://app.any.run/tasks/d4ecde9f-0c74-4b86-ba5d-a1736265f3e9
Verdict: Malicious activity
Analysis date: March 07, 2024, 07:41:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

42E241E890558A155E15FDCCCC0B312A

SHA1:

8BDB11A93EB04625096AA5F475B3FF0C91489A7E

SHA256:

99AFC1D614E96C53E497AAB988B4EE263122EE350891E860875ACED7F57F1CB4

SSDEEP:

3:FB6wRXhfvD3VyUWNCIHkXuCV:76iVyFzkdV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3864)

    • The process uses the downloaded file

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 696)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
3
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe flashutil32_32_0_0_453_activex.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
696C:\Windows\system32\Macromed\Flash\FlashUtil32_32_0_0_453_ActiveX.exe -EmbeddingC:\Windows\System32\Macromed\Flash\FlashUtil32_32_0_0_453_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 32.0 r0
Exit code:
0
Version:
32,0,0,453
Modules
Images
c:\windows\system32\macromed\flash\flashutil32_32_0_0_453_activex.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3692"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3864 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3864"C:\Program Files\Internet Explorer\iexplore.exe" "givemeredditstreams.xyz/f1/600041133/gulf-air-bahrain-gp"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
25 300
Read events
25 145
Write events
118
Delete events
37

Modification events

(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31092834
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31092834
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
81
Text files
45
Unknown types
30

Dropped files

PID
Process
Filename
Type
3692iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:753DF6889FD7410A2E9FE333DA83A429
SHA256:B42DC237E44CBC9A43400E7D3F9CBD406DBDEFD62BFE87328F8663897D69DF78
3692iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAder
MD5:AC89A852C2AAA3D389B2D2DD312AD367
SHA256:0B720E19270C672F9B6E0EC40B468AC49376807DE08A814573FE038779534F45
3692iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\jquery.ajaxchimp.min[1].jshtml
MD5:AFFF6F7B5E91CAD36D221E12D4112C56
SHA256:A1020B46686D8B3E0885D526DDEF134BCF5AACF679795DF309C6A1494EA060C7
3692iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_08872284D8414653D8A6B617C1164F2Dder
MD5:D7E1DFAFD688F18A4678815B8BD3D74A
SHA256:7120737947CEF217459BF4CBE9F6D2AC2EBD1FE473A13CE2CF6B658D82D21339
3692iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab39.tmpcompressed
MD5:753DF6889FD7410A2E9FE333DA83A429
SHA256:B42DC237E44CBC9A43400E7D3F9CBD406DBDEFD62BFE87328F8663897D69DF78
3692iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab3B.tmpcompressed
MD5:753DF6889FD7410A2E9FE333DA83A429
SHA256:B42DC237E44CBC9A43400E7D3F9CBD406DBDEFD62BFE87328F8663897D69DF78
3692iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:6B2B977494A70AC00E255EA2EEC8FCFF
SHA256:F7FB88944082AEF9D45338C390E463A6CDE778B2922C85711DC5CB41DAB1034F
3692iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\moment.min[1].jstext
MD5:99D33210B6EB23CF25FCD4AB7CFC9F2A
SHA256:081737985335AF4BE15FC676ED4CCC0703C7446C6B5CBC9317E40BCDC6428E5D
3692iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\style[1].csstext
MD5:57DA3B5505B6E84628C6C3C44C42A4CA
SHA256:26F3BEF7B3F9842AE5E2590ED2035AEC0D7BC2CAE9868F01C02E734BAE57CE38
3692iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751der
MD5:822467B728B7A66B081C91795373789A
SHA256:AF2343382B88335EEA72251AD84949E244FF54B6995063E24459A7216E9576B9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
34
TCP/UDP connections
119
DNS requests
31
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3692
iexplore.exe
GET
—
142.250.185.195:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
—
—
unknown
3692
iexplore.exe
GET
—
23.32.238.235:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?bdd1e87152b01aed
DE
—
—
unknown
3692
iexplore.exe
GET
—
188.114.97.3:80
http://givemeredditstreams.xyz/assets/webfonts/fa-regular-400.ttf
NL
—
—
unknown
3692
iexplore.exe
GET
—
69.192.161.44:80
http://x1.c.lencr.org/
DE
—
—
unknown
3692
iexplore.exe
GET
200
69.192.161.44:80
http://x2.c.lencr.org/
DE
binary
299 b
unknown
3692
iexplore.exe
GET
200
188.114.97.3:80
http://givemeredditstreams.xyz/f1/600041133/gulf-air-bahrain-gp
NL
html
8.44 Kb
unknown
3692
iexplore.exe
GET
200
188.114.97.3:80
http://givemeredditstreams.xyz/assets/css/style.css?v=1698506433
NL
text
5.31 Kb
unknown
3692
iexplore.exe
GET
200
188.114.97.3:80
http://givemeredditstreams.xyz/assets/js/moment.min.js
NL
text
18.1 Kb
unknown
3692
iexplore.exe
GET
200
188.114.97.3:80
http://givemeredditstreams.xyz/assets/js/jquery.min.js
NL
text
30.2 Kb
unknown
3692
iexplore.exe
GET
200
188.114.97.3:80
http://givemeredditstreams.xyz/assets/js/mdb.min.js
NL
text
43.4 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3692
iexplore.exe
188.114.97.3:80
givemeredditstreams.xyz
CLOUDFLARENET
NL
unknown
3692
iexplore.exe
156.146.33.141:443
www.displayvertising.com
Datacamp Limited
DE
unknown
3692
iexplore.exe
172.217.18.14:443
studio.youtube.com
GOOGLE
US
whitelisted
3692
iexplore.exe
104.21.92.201:443
givemereddit.eu
CLOUDFLARENET
—
unknown
3692
iexplore.exe
184.24.77.169:443
a.espncdn.com
Akamai International B.V.
DE
unknown
3692
iexplore.exe
23.32.238.235:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3692
iexplore.exe
23.32.238.243:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
givemeredditstreams.xyz
  • 188.114.97.3
  • 188.114.96.3
unknown
a.espncdn.com
  • 184.24.77.169
  • 184.24.77.143
whitelisted
www.displayvertising.com
  • 156.146.33.141
  • 195.181.175.40
  • 156.146.33.137
  • 212.102.56.182
  • 195.181.170.19
  • 195.181.175.15
  • 212.102.56.178
unknown
givemereddit.eu
  • 104.21.92.201
  • 172.67.197.177
unknown
studio.youtube.com
  • 172.217.18.14
  • 142.250.185.78
  • 142.250.184.238
  • 216.58.212.174
  • 142.250.185.174
  • 172.217.23.110
  • 142.250.185.238
  • 142.250.186.174
  • 142.250.185.110
  • 142.250.186.110
  • 142.250.186.78
  • 172.217.16.206
  • 142.250.186.142
  • 142.250.185.206
  • 216.58.206.46
  • 142.250.185.142
whitelisted
ctldl.windowsupdate.com
  • 23.32.238.195
  • 23.32.238.211
  • 23.32.238.243
  • 23.32.238.176
  • 23.32.238.192
  • 23.32.238.208
  • 23.32.238.216
  • 23.32.238.235
  • 23.32.238.241
whitelisted
x1.c.lencr.org
  • 69.192.161.44
whitelisted
ocsp.pki.goog
  • 142.250.185.195
whitelisted
fonts.gstatic.com
  • 142.250.186.35
whitelisted
x2.c.lencr.org
  • 69.192.161.44
whitelisted

Threats

PID
Process
Class
Message
3692
iexplore.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3692
iexplore.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3692
iexplore.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3692
iexplore.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3692
iexplore.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3692
iexplore.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3692
iexplore.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3692
iexplore.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
3692
iexplore.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
3692
iexplore.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
givemeredditstreams.xyz/f1/600041133/gulf-air-bahrain-gp