URL:

givemeredditstreams.xyz/f1/600041133/gulf-air-bahrain-gp

Full analysis: https://app.any.run/tasks/d4ecde9f-0c74-4b86-ba5d-a1736265f3e9
Verdict: Malicious activity
Analysis date: March 07, 2024, 07:41:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

42E241E890558A155E15FDCCCC0B312A

SHA1:

8BDB11A93EB04625096AA5F475B3FF0C91489A7E

SHA256:

99AFC1D614E96C53E497AAB988B4EE263122EE350891E860875ACED7F57F1CB4

SSDEEP:

3:FB6wRXhfvD3VyUWNCIHkXuCV:76iVyFzkdV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3864)

    • The process uses the downloaded file

      • FlashUtil32_32_0_0_453_ActiveX.exe (PID: 696)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
3
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe flashutil32_32_0_0_453_activex.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
696C:\Windows\system32\Macromed\Flash\FlashUtil32_32_0_0_453_ActiveX.exe -EmbeddingC:\Windows\System32\Macromed\Flash\FlashUtil32_32_0_0_453_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 32.0 r0
Exit code:
0
Version:
32,0,0,453
Modules
Images
c:\windows\system32\macromed\flash\flashutil32_32_0_0_453_activex.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3692"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3864 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3864"C:\Program Files\Internet Explorer\iexplore.exe" "givemeredditstreams.xyz/f1/600041133/gulf-air-bahrain-gp"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
25 300
Read events
25 145
Write events
118
Delete events
37

Modification events

(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31092834
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31092834
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
81
Text files
45
Unknown types
30

Dropped files

PID
Process
Filename
Type
3692iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\gulf-air-bahrain-gp[1].htmhtml
MD5:B468FAA7606222DA2C415FB39BC8EF48
SHA256:B97E2D21D0A5A080CFFE1F87727D2C8CCD6A85C1E1732F6F4A538DD49DDD1817
3692iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\jquery.ajaxchimp.min[1].jshtml
MD5:AFFF6F7B5E91CAD36D221E12D4112C56
SHA256:A1020B46686D8B3E0885D526DDEF134BCF5AACF679795DF309C6A1494EA060C7
3692iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar3A.tmpcat
MD5:DD73CEAD4B93366CF3465C8CD32E2796
SHA256:A6752B7851B591550E4625B832A393AABCC428DE18D83E8593CD540F7D7CAE22
3692iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab39.tmpcompressed
MD5:753DF6889FD7410A2E9FE333DA83A429
SHA256:B42DC237E44CBC9A43400E7D3F9CBD406DBDEFD62BFE87328F8663897D69DF78
3692iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751der
MD5:822467B728B7A66B081C91795373789A
SHA256:AF2343382B88335EEA72251AD84949E244FF54B6995063E24459A7216E9576B9
3692iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:3CF618059CAA84B8E947A3B8B2B98466
SHA256:AC006064C10F55F086E8D023FEC4BA88CD416C9EC9D656D045EA9206907FBE11
3692iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:F8B9B3F0E68ED533C9BC45A911759D2B
SHA256:9317D98F169C33C93CEB3FF23611610929198A494C70001A1125DED6C61F5FE1
3692iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_08872284D8414653D8A6B617C1164F2Dder
MD5:D7E1DFAFD688F18A4678815B8BD3D74A
SHA256:7120737947CEF217459BF4CBE9F6D2AC2EBD1FE473A13CE2CF6B658D82D21339
3692iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:753DF6889FD7410A2E9FE333DA83A429
SHA256:B42DC237E44CBC9A43400E7D3F9CBD406DBDEFD62BFE87328F8663897D69DF78
3692iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\live_chat[1].htmhtml
MD5:CFF9246DC9696FAEE442C8027BCC258F
SHA256:A7A516BE64FB40944A8D7CC0880487393F8EB54CDE302CA5210E8A37B7B145CB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
34
TCP/UDP connections
119
DNS requests
31
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3692
iexplore.exe
GET
200
188.114.97.3:80
http://givemeredditstreams.xyz/assets/css/style.css?v=1698506433
unknown
text
5.31 Kb
unknown
3692
iexplore.exe
GET
200
188.114.97.3:80
http://givemeredditstreams.xyz/assets/js/moment.min.js
unknown
text
18.1 Kb
unknown
3692
iexplore.exe
GET
200
188.114.97.3:80
http://givemeredditstreams.xyz/f1/600041133/gulf-air-bahrain-gp
unknown
html
8.44 Kb
unknown
3692
iexplore.exe
GET
200
188.114.97.3:80
http://givemeredditstreams.xyz/assets/css/font-awesome.css
unknown
text
19.9 Kb
unknown
3692
iexplore.exe
GET
200
188.114.97.3:80
http://givemeredditstreams.xyz/assets/js/jquery.min.js
unknown
text
30.2 Kb
unknown
3692
iexplore.exe
GET
200
188.114.97.3:80
http://givemeredditstreams.xyz/assets/js/mdb.min.js
unknown
text
43.4 Kb
unknown
3692
iexplore.exe
GET
200
188.114.97.3:80
http://givemeredditstreams.xyz/assets/js/flatpickr.js
unknown
text
14.1 Kb
unknown
3692
iexplore.exe
GET
—
23.32.238.235:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?fb542102ae65dd3e
unknown
—
—
unknown
3692
iexplore.exe
GET
—
23.32.238.243:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?bf012385ffb92421
unknown
—
—
unknown
3692
iexplore.exe
GET
304
23.32.238.192:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2788e0fe40679967
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3692
iexplore.exe
188.114.97.3:80
givemeredditstreams.xyz
CLOUDFLARENET
NL
unknown
3692
iexplore.exe
156.146.33.141:443
www.displayvertising.com
Datacamp Limited
DE
unknown
3692
iexplore.exe
172.217.18.14:443
studio.youtube.com
GOOGLE
US
whitelisted
3692
iexplore.exe
104.21.92.201:443
givemereddit.eu
CLOUDFLARENET
—
unknown
3692
iexplore.exe
184.24.77.169:443
a.espncdn.com
Akamai International B.V.
DE
unknown
3692
iexplore.exe
23.32.238.235:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3692
iexplore.exe
23.32.238.243:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
givemeredditstreams.xyz
  • 188.114.97.3
  • 188.114.96.3
unknown
a.espncdn.com
  • 184.24.77.169
  • 184.24.77.143
whitelisted
www.displayvertising.com
  • 156.146.33.141
  • 195.181.175.40
  • 156.146.33.137
  • 212.102.56.182
  • 195.181.170.19
  • 195.181.175.15
  • 212.102.56.178
unknown
givemereddit.eu
  • 104.21.92.201
  • 172.67.197.177
unknown
studio.youtube.com
  • 172.217.18.14
  • 142.250.185.78
  • 142.250.184.238
  • 216.58.212.174
  • 142.250.185.174
  • 172.217.23.110
  • 142.250.185.238
  • 142.250.186.174
  • 142.250.185.110
  • 142.250.186.110
  • 142.250.186.78
  • 172.217.16.206
  • 142.250.186.142
  • 142.250.185.206
  • 216.58.206.46
  • 142.250.185.142
whitelisted
ctldl.windowsupdate.com
  • 23.32.238.195
  • 23.32.238.211
  • 23.32.238.243
  • 23.32.238.176
  • 23.32.238.192
  • 23.32.238.208
  • 23.32.238.216
  • 23.32.238.235
  • 23.32.238.241
whitelisted
x1.c.lencr.org
  • 69.192.161.44
whitelisted
ocsp.pki.goog
  • 142.250.185.195
whitelisted
fonts.gstatic.com
  • 142.250.186.35
whitelisted
x2.c.lencr.org
  • 69.192.161.44
whitelisted

Threats

PID
Process
Class
Message
3692
iexplore.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3692
iexplore.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3692
iexplore.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3692
iexplore.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3692
iexplore.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3692
iexplore.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3692
iexplore.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3692
iexplore.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
3692
iexplore.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
3692
iexplore.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
givemeredditstreams.xyz/f1/600041133/gulf-air-bahrain-gp