URL:

givemeredditstreams.xyz/f1/600041133/gulf-air-bahrain-gp

Full analysis: https://app.any.run/tasks/d4ecde9f-0c74-4b86-ba5d-a1736265f3e9
Verdict: Malicious activity
Analysis date: March 07, 2024, 07:41:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

42E241E890558A155E15FDCCCC0B312A

SHA1:

8BDB11A93EB04625096AA5F475B3FF0C91489A7E

SHA256:

99AFC1D614E96C53E497AAB988B4EE263122EE350891E860875ACED7F57F1CB4

SSDEEP:

3:FB6wRXhfvD3VyUWNCIHkXuCV:76iVyFzkdV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3864)

    • The process uses the downloaded file

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 696)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
3
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe flashutil32_32_0_0_453_activex.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
696C:\Windows\system32\Macromed\Flash\FlashUtil32_32_0_0_453_ActiveX.exe -EmbeddingC:\Windows\System32\Macromed\Flash\FlashUtil32_32_0_0_453_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 32.0 r0
Exit code:
0
Version:
32,0,0,453
Modules
Images
c:\windows\system32\macromed\flash\flashutil32_32_0_0_453_activex.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3692"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3864 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3864"C:\Program Files\Internet Explorer\iexplore.exe" "givemeredditstreams.xyz/f1/600041133/gulf-air-bahrain-gp"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
25 300
Read events
25 145
Write events
118
Delete events
37

Modification events

(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31092834
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31092834
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
81
Text files
45
Unknown types
30

Dropped files

PID
Process
Filename
Type
3692iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\gulf-air-bahrain-gp[1].htmhtml
MD5:B468FAA7606222DA2C415FB39BC8EF48
SHA256:B97E2D21D0A5A080CFFE1F87727D2C8CCD6A85C1E1732F6F4A538DD49DDD1817
3692iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:3CF618059CAA84B8E947A3B8B2B98466
SHA256:AC006064C10F55F086E8D023FEC4BA88CD416C9EC9D656D045EA9206907FBE11
3692iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\moment.min[1].jstext
MD5:99D33210B6EB23CF25FCD4AB7CFC9F2A
SHA256:081737985335AF4BE15FC676ED4CCC0703C7446C6B5CBC9317E40BCDC6428E5D
3692iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751der
MD5:822467B728B7A66B081C91795373789A
SHA256:AF2343382B88335EEA72251AD84949E244FF54B6995063E24459A7216E9576B9
3692iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\jquery.ajaxchimp.min[1].jshtml
MD5:AFFF6F7B5E91CAD36D221E12D4112C56
SHA256:A1020B46686D8B3E0885D526DDEF134BCF5AACF679795DF309C6A1494EA060C7
3692iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:12E4A065F5ADDC595E3A3ED8C6CE2175
SHA256:E3C67FB99A2166B7E604CF414B153B555FC78A3C5C6C9C9CB7BF13A630A2F9D4
3692iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAder
MD5:8BC2CA0DCDA844A2FE7A89EDE104CCE0
SHA256:1B9A5367C83246E30AF48BE2E5C60CE44F72EE9954CFA3E70327C7DB2D4CE284
3692iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab39.tmpcompressed
MD5:753DF6889FD7410A2E9FE333DA83A429
SHA256:B42DC237E44CBC9A43400E7D3F9CBD406DBDEFD62BFE87328F8663897D69DF78
3692iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:F8B9B3F0E68ED533C9BC45A911759D2B
SHA256:9317D98F169C33C93CEB3FF23611610929198A494C70001A1125DED6C61F5FE1
3692iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab3B.tmpcompressed
MD5:753DF6889FD7410A2E9FE333DA83A429
SHA256:B42DC237E44CBC9A43400E7D3F9CBD406DBDEFD62BFE87328F8663897D69DF78
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
34
TCP/UDP connections
119
DNS requests
31
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3692
iexplore.exe
GET
200
188.114.97.3:80
http://givemeredditstreams.xyz/assets/js/mdb.min.js
unknown
text
43.4 Kb
unknown
3692
iexplore.exe
GET
200
188.114.97.3:80
http://givemeredditstreams.xyz/assets/js/jquery.min.js
unknown
text
30.2 Kb
unknown
3692
iexplore.exe
GET
200
188.114.97.3:80
http://givemeredditstreams.xyz/assets/css/font-awesome.css
unknown
text
19.9 Kb
unknown
3692
iexplore.exe
GET
200
188.114.97.3:80
http://givemeredditstreams.xyz/assets/css/flatpickr.min.css
unknown
text
2.95 Kb
unknown
3692
iexplore.exe
GET
—
23.32.238.243:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?bf012385ffb92421
unknown
—
—
unknown
3692
iexplore.exe
GET
200
188.114.97.3:80
http://givemeredditstreams.xyz/assets/js/flatpickr.js
unknown
text
14.1 Kb
unknown
3692
iexplore.exe
GET
304
23.32.238.195:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b896de0a430f1ce1
unknown
—
—
unknown
3692
iexplore.exe
GET
304
23.32.238.216:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?21e2d5edb0479497
unknown
—
—
unknown
3692
iexplore.exe
GET
304
23.32.238.243:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?fe621b814c27cf17
unknown
—
—
unknown
3692
iexplore.exe
GET
304
23.32.238.192:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2788e0fe40679967
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3692
iexplore.exe
188.114.97.3:80
givemeredditstreams.xyz
CLOUDFLARENET
NL
unknown
3692
iexplore.exe
156.146.33.141:443
www.displayvertising.com
Datacamp Limited
DE
unknown
3692
iexplore.exe
172.217.18.14:443
studio.youtube.com
GOOGLE
US
whitelisted
3692
iexplore.exe
104.21.92.201:443
givemereddit.eu
CLOUDFLARENET
—
unknown
3692
iexplore.exe
184.24.77.169:443
a.espncdn.com
Akamai International B.V.
DE
unknown
3692
iexplore.exe
23.32.238.235:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3692
iexplore.exe
23.32.238.243:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
givemeredditstreams.xyz
  • 188.114.97.3
  • 188.114.96.3
unknown
a.espncdn.com
  • 184.24.77.169
  • 184.24.77.143
whitelisted
www.displayvertising.com
  • 156.146.33.141
  • 195.181.175.40
  • 156.146.33.137
  • 212.102.56.182
  • 195.181.170.19
  • 195.181.175.15
  • 212.102.56.178
unknown
givemereddit.eu
  • 104.21.92.201
  • 172.67.197.177
unknown
studio.youtube.com
  • 172.217.18.14
  • 142.250.185.78
  • 142.250.184.238
  • 216.58.212.174
  • 142.250.185.174
  • 172.217.23.110
  • 142.250.185.238
  • 142.250.186.174
  • 142.250.185.110
  • 142.250.186.110
  • 142.250.186.78
  • 172.217.16.206
  • 142.250.186.142
  • 142.250.185.206
  • 216.58.206.46
  • 142.250.185.142
whitelisted
ctldl.windowsupdate.com
  • 23.32.238.195
  • 23.32.238.211
  • 23.32.238.243
  • 23.32.238.176
  • 23.32.238.192
  • 23.32.238.208
  • 23.32.238.216
  • 23.32.238.235
  • 23.32.238.241
whitelisted
x1.c.lencr.org
  • 69.192.161.44
whitelisted
ocsp.pki.goog
  • 142.250.185.195
whitelisted
fonts.gstatic.com
  • 142.250.186.35
whitelisted
x2.c.lencr.org
  • 69.192.161.44
whitelisted

Threats

PID
Process
Class
Message
3692
iexplore.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3692
iexplore.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3692
iexplore.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3692
iexplore.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3692
iexplore.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3692
iexplore.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3692
iexplore.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3692
iexplore.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
3692
iexplore.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
3692
iexplore.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
givemeredditstreams.xyz/f1/600041133/gulf-air-bahrain-gp