URL:

https://download.peters-research.com/elevate/9.2.4/fjd5d/

Full analysis: https://app.any.run/tasks/ba6e7548-53d3-4040-b7c4-8482c1baf013
Verdict: Malicious activity
Analysis date: January 29, 2024, 09:27:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

AF49BC3DE191133B4E5A8E76CB8694F6

SHA1:

5310584D94151539F4AE681E0DC6C69C8323946D

SHA256:

9D3779E972FD757864D999F0DCE0A7882395DCCA015C62BF5F857025D2099365

SSDEEP:

3:N8SElqAfXAkXaTE964m8:2SK7/A/TNR8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • elv9_2_4.exe (PID: 3472)
      • irsetup.exe (PID: 3760)
      • vcredist_x86.exe (PID: 4092)
      • elv9_2_4.exe (PID: 3360)
      • irsetup.exe (PID: 292)
      • vcredist_x86.exe (PID: 3784)

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • irsetup.exe (PID: 3760)
      • irsetup.exe (PID: 292)

    • Starts a Microsoft application from unusual location

      • vcredist_x86.exe (PID: 4092)
      • vcredist_x86.exe (PID: 3784)

    • Reads the Internet Settings

      • elv9_2_4.exe (PID: 3472)
      • elv9_2_4.exe (PID: 3360)

    • Executable content was dropped or overwritten

      • elv9_2_4.exe (PID: 3472)
      • irsetup.exe (PID: 3760)
      • vcredist_x86.exe (PID: 4092)
      • elv9_2_4.exe (PID: 3360)
      • irsetup.exe (PID: 292)
      • vcredist_x86.exe (PID: 3784)

    • Process drops legitimate windows executable

      • irsetup.exe (PID: 3760)
      • vcredist_x86.exe (PID: 4092)
      • irsetup.exe (PID: 292)
      • vcredist_x86.exe (PID: 3784)

  • INFO

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 2584)
      • chrome.exe (PID: 3872)

    • The process uses the downloaded file

      • iexplore.exe (PID: 2580)
      • chrome.exe (PID: 3872)
      • chrome.exe (PID: 3288)

    • Application launched itself

      • chrome.exe (PID: 2360)
      • iexplore.exe (PID: 2580)
      • chrome.exe (PID: 3872)

    • Create files in a temporary directory

      • elv9_2_4.exe (PID: 3472)
      • irsetup.exe (PID: 3760)
      • install.exe (PID: 1780)
      • elv9_2_4.exe (PID: 3360)
      • irsetup.exe (PID: 292)
      • install.exe (PID: 3732)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 2584)
      • chrome.exe (PID: 3872)

    • Manual execution by a user

      • chrome.exe (PID: 2360)
      • explorer.exe (PID: 2348)
      • chrome.exe (PID: 3872)

    • Checks supported languages

      • elv9_2_4.exe (PID: 3472)
      • irsetup.exe (PID: 3760)
      • vcredist_x86.exe (PID: 4092)
      • install.exe (PID: 1780)
      • elv9_2_4.exe (PID: 3360)
      • vcredist_x86.exe (PID: 3784)
      • irsetup.exe (PID: 292)
      • install.exe (PID: 3732)

    • Reads the computer name

      • irsetup.exe (PID: 3760)
      • vcredist_x86.exe (PID: 4092)
      • install.exe (PID: 1780)
      • elv9_2_4.exe (PID: 3360)
      • irsetup.exe (PID: 292)
      • vcredist_x86.exe (PID: 3784)
      • elv9_2_4.exe (PID: 3472)
      • install.exe (PID: 3732)

    • Reads the machine GUID from the registry

      • install.exe (PID: 1780)
      • vcredist_x86.exe (PID: 4092)
      • vcredist_x86.exe (PID: 3784)
      • install.exe (PID: 3732)

    • Reads Environment values

      • vcredist_x86.exe (PID: 4092)
      • vcredist_x86.exe (PID: 3784)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
93
Monitored processes
44
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs elv9_2_4.exe no specs elv9_2_4.exe irsetup.exe vcredist_x86.exe install.exe no specs explorer.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs elv9_2_4.exe no specs elv9_2_4.exe irsetup.exe vcredist_x86.exe install.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
292"C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1796642 "__IRAFN:C:\Users\admin\Downloads\elv9_2_4.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-1302019708-1500728564-335382590-1000"C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
elv9_2_4.exe
User:
admin
Company:
Indigo Rose Corporation
Integrity Level:
HIGH
Description:
Setup Application
Exit code:
5
Version:
9.5.3.0
Modules
Images
c:\users\admin\appdata\local\temp\_ir_sf_temp_0\irsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
884"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x6bc88b38,0x6bc88b48,0x6bc88b54C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
884"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2152 --field-trial-handle=1160,i,2806290548077819821,487614043702189967,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1548"C:\Users\admin\Downloads\elv9_2_4.exe" C:\Users\admin\Downloads\elv9_2_4.exe—chrome.exe
User:
admin
Company:
Peters Research Ltd
Integrity Level:
MEDIUM
Description:
Elevate Setup Application
Exit code:
3221226540
Version:
9.2.4.0
Modules
Images
c:\users\admin\downloads\elv9_2_4.exe
c:\windows\system32\ntdll.dll
1596"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=3484 --field-trial-handle=1160,i,2806290548077819821,487614043702189967,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1736"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2272 --field-trial-handle=1160,i,2806290548077819821,487614043702189967,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1780c:\03036fcbc5883bfae560bd64\.\install.exe /qC:\03036fcbc5883bfae560bd64\install.exe—vcredist_x86.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
External Installer
Exit code:
0
Version:
9.0.30729.5677 built by: QFE
Modules
Images
c:\03036fcbc5883bfae560bd64\install.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
2348"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2360"C:\Program Files\Google\Chrome\Application\chrome.exe" "--disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction,OptimizationHints"C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2376"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=1372 --field-trial-handle=1112,i,930604250760029024,4477619128980505917,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
29 859
Read events
29 626
Write events
221
Delete events
12

Modification events

(PID) Process:(2580) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(2580) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(2580) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(2580) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2580) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2580) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2580) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2580) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2580) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2580) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
35
Suspicious files
102
Text files
95
Unknown types
1

Dropped files

PID
Process
Filename
Type
2584iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:FFA54A560BBCE1756389F801051B1E75
SHA256:2C8A89FCAD362C013F52AE4C655172F3C57278D557A578F325130E4B89BD2FCA
2584iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab9549.tmpcompressed
MD5:AC05D27423A85ADC1622C714F2CB6184
SHA256:C6456E12E5E53287A547AF4103E0397CB9697E466CF75844312DC296D43D144D
2580iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\urlblockindex[1].binbinary
MD5:FA518E3DFAE8CA3A0E495460FD60C791
SHA256:775853600060162C4B4E5F883F9FD5A278E61C471B3EE1826396B6D129499AA7
2584iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5237B19BEFD37CEC19A885F5C8D684BAbinary
MD5:74E9D5BB3CCE486B6A3BEECB333B4307
SHA256:5F621D7C4A7966F0F7E3C31274251C4E93E4AF7630B93452B561C57511038BC5
2360chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF156c02.TMP —
MD5:—
SHA256:—
2360chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
2584iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar954C.tmpcat
MD5:9C0C641C06238516F27941AA1166D427
SHA256:4276AF3669A141A59388BC56A87F6614D9A9BDDDF560636C264219A7EB11256F
2584iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:AA6E8FB901BDA6BBD3D78BBC0271101D
SHA256:D109B09DC3292C6949C752A6AE0881F6C697C565A3856B2991CC057D32D32BC7
2584iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar954A.tmpcat
MD5:9C0C641C06238516F27941AA1166D427
SHA256:4276AF3669A141A59388BC56A87F6614D9A9BDDDF560636C264219A7EB11256F
2584iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:AC05D27423A85ADC1622C714F2CB6184
SHA256:C6456E12E5E53287A547AF4103E0397CB9697E466CF75844312DC296D43D144D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
42
DNS requests
45
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2584
iexplore.exe
GET
304
23.32.238.218:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?da46b50ef2a0354a
unknown
—
—
unknown
2580
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D
unknown
binary
471 b
unknown
2584
iexplore.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
2580
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
unknown
binary
471 b
unknown
2580
iexplore.exe
GET
304
23.32.238.218:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a071a3cff9a7a2a1
unknown
—
—
unknown
2580
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
2584
iexplore.exe
GET
304
23.32.238.218:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a0aa2a2858c872c9
unknown
—
—
unknown
2584
iexplore.exe
GET
200
23.32.238.218:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?09ca35c5e0844a72
unknown
compressed
65.2 Kb
unknown
2584
iexplore.exe
GET
200
23.32.238.218:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?d66bcfdf10b71413
unknown
compressed
65.2 Kb
unknown
2584
iexplore.exe
GET
200
184.24.77.61:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgOfNPfC74nlJL%2BXwtti5%2BnkYA%3D%3D
unknown
binary
503 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2584
iexplore.exe
77.68.82.55:443
download.peters-research.com
IONOS SE
GB
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2584
iexplore.exe
23.32.238.218:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
2584
iexplore.exe
69.192.161.44:80
x1.c.lencr.org
AKAMAI-AS
DE
unknown
2584
iexplore.exe
184.24.77.61:80
r3.o.lencr.org
Akamai International B.V.
DE
unknown
2580
iexplore.exe
77.68.82.55:443
download.peters-research.com
IONOS SE
GB
unknown
2580
iexplore.exe
23.32.238.218:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
2580
iexplore.exe
104.126.37.177:443
www.bing.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
download.peters-research.com
  • 77.68.82.55
unknown
ctldl.windowsupdate.com
  • 23.32.238.218
  • 23.32.238.211
  • 23.32.238.219
  • 23.32.238.195
  • 23.32.238.225
  • 23.32.238.226
  • 23.32.238.201
  • 23.32.238.203
  • 23.32.238.192
whitelisted
x1.c.lencr.org
  • 69.192.161.44
whitelisted
r3.o.lencr.org
  • 184.24.77.61
  • 184.24.77.64
  • 184.24.77.81
  • 184.24.77.70
  • 184.24.77.76
shared
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.177
  • 104.126.37.160
  • 104.126.37.163
  • 104.126.37.179
  • 104.126.37.154
  • 104.126.37.168
  • 104.126.37.153
  • 104.126.37.170
  • 104.126.37.161
  • 104.126.37.152
  • 104.126.37.137
  • 104.126.37.155
  • 104.126.37.131
  • 104.126.37.145
  • 104.126.37.147
  • 104.126.37.139
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
clientservices.googleapis.com
  • 142.250.185.67
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://download.peters-research.com/elevate/9.2.4/fjd5d/