analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqa05jSmxTT3FlTENtNnJXN0RiazZkT2EyVVUtQXxBQ3Jtc0trd2hvN3M1UV9CdTFnMG05cEFDVHI4RnhUcHFLbDhBb2VDQ1g1ekd1MDd4SFE3cktlQVB6MlpvazlWWDB5cW5tZTNBQkktYlgtVU5lYWFBMUdXc2ZUT05Xemhlc3hhaE02TjI3cVlSQU0tNDZvX1FZcw&q=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F2qykx0rzry3ycv7%2FL%252Ag%252AnF%252Ack_source.zip%2Ffile

Full analysis: https://app.any.run/tasks/285245ca-33ae-4e66-827d-5e4faaa03504
Verdict: Malicious activity
Analysis date: May 20, 2022, 23:29:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

080BDCA01910CBC8B72DD30AC05B1E21

SHA1:

7A84E747273E8B222A09F24AF5342F17303C53E5

SHA256:

A869F728B1956B6F55277CC3A984FF48A7552BA2F886EDDC7DDE327B55803F1A

SSDEEP:

6:2OLUxGKmKLqZvNIb+EYTpvAbU23NQ3uaLtjN2N3zh3eG/7F8uRLQP6PO:2jGRfvNIaEYThAbUGQeaxWF3ee7F8uRc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • LogonFuck.exe (PID: 2912)
      • LogonFuck.exe (PID: 3948)
      • LogonFuck.exe (PID: 4036)
      • LogonFuck.exe (PID: 2764)

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 2724)
      • iexplore.exe (PID: 824)
      • LogonFuck.exe (PID: 4036)

    • Task Manager has been disabled (taskmgr)

      • LogonFuck.exe (PID: 4036)

    • Disables the Run in Start menu

      • LogonFuck.exe (PID: 4036)

    • Disables registry editing tools (regedit)

      • LogonFuck.exe (PID: 4036)

    • Disables the Command Prompt (cmd)

      • LogonFuck.exe (PID: 4036)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2128)
      • iexplore.exe (PID: 824)
      • iexplore.exe (PID: 2100)
      • iexplore.exe (PID: 3388)
      • iexplore.exe (PID: 3496)
      • iexplore.exe (PID: 1148)
      • iexplore.exe (PID: 3248)
      • iexplore.exe (PID: 3404)

    • Checks supported languages

      • LogonFuck.exe (PID: 2912)
      • WinRAR.exe (PID: 2724)
      • LogonFuck.exe (PID: 4036)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 2724)
      • iexplore.exe (PID: 824)
      • LogonFuck.exe (PID: 4036)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2724)
      • iexplore.exe (PID: 824)
      • LogonFuck.exe (PID: 4036)

    • Reads the computer name

      • WinRAR.exe (PID: 2724)
      • LogonFuck.exe (PID: 4036)

    • Reads Environment values

      • LogonFuck.exe (PID: 4036)

    • Starts Internet Explorer

      • LogonFuck.exe (PID: 4036)

    • Reads the time zone

      • iexplore.exe (PID: 3404)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 2128)
      • iexplore.exe (PID: 1976)
      • iexplore.exe (PID: 824)
      • takeown.exe (PID: 2336)
      • iexplore.exe (PID: 900)
      • iexplore.exe (PID: 2100)
      • iexplore.exe (PID: 1360)
      • iexplore.exe (PID: 3496)
      • iexplore.exe (PID: 3388)
      • iexplore.exe (PID: 1148)
      • iexplore.exe (PID: 2260)
      • iexplore.exe (PID: 3144)
      • iexplore.exe (PID: 3248)
      • iexplore.exe (PID: 3404)

    • Reads the computer name

      • iexplore.exe (PID: 1976)
      • iexplore.exe (PID: 2128)
      • iexplore.exe (PID: 824)
      • takeown.exe (PID: 2336)
      • iexplore.exe (PID: 900)
      • iexplore.exe (PID: 2100)
      • iexplore.exe (PID: 1360)
      • iexplore.exe (PID: 3496)
      • iexplore.exe (PID: 3388)
      • iexplore.exe (PID: 1148)
      • iexplore.exe (PID: 2260)
      • iexplore.exe (PID: 3248)
      • iexplore.exe (PID: 3144)
      • iexplore.exe (PID: 3404)

    • Application launched itself

      • iexplore.exe (PID: 1976)
      • iexplore.exe (PID: 900)
      • iexplore.exe (PID: 2260)
      • iexplore.exe (PID: 3144)

    • Changes internet zones settings

      • iexplore.exe (PID: 1976)
      • iexplore.exe (PID: 900)
      • iexplore.exe (PID: 2260)
      • iexplore.exe (PID: 3144)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 1976)
      • iexplore.exe (PID: 2128)
      • iexplore.exe (PID: 824)
      • iexplore.exe (PID: 2100)
      • iexplore.exe (PID: 3388)
      • iexplore.exe (PID: 3496)
      • iexplore.exe (PID: 1148)
      • iexplore.exe (PID: 3248)
      • iexplore.exe (PID: 3404)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 1976)
      • iexplore.exe (PID: 2128)
      • iexplore.exe (PID: 824)
      • iexplore.exe (PID: 2100)
      • iexplore.exe (PID: 3388)
      • iexplore.exe (PID: 3496)
      • iexplore.exe (PID: 1148)
      • iexplore.exe (PID: 3248)
      • iexplore.exe (PID: 3404)

    • Changes settings of System certificates

      • iexplore.exe (PID: 1976)
      • iexplore.exe (PID: 2100)
      • iexplore.exe (PID: 3496)
      • iexplore.exe (PID: 1148)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2128)
      • iexplore.exe (PID: 824)
      • iexplore.exe (PID: 2100)
      • iexplore.exe (PID: 3388)
      • iexplore.exe (PID: 1148)
      • iexplore.exe (PID: 3496)
      • iexplore.exe (PID: 3248)
      • iexplore.exe (PID: 3404)

    • Creates files in the user directory

      • iexplore.exe (PID: 2128)
      • iexplore.exe (PID: 1976)
      • iexplore.exe (PID: 824)
      • iexplore.exe (PID: 3388)
      • iexplore.exe (PID: 2100)
      • iexplore.exe (PID: 900)
      • iexplore.exe (PID: 1148)
      • iexplore.exe (PID: 3496)
      • iexplore.exe (PID: 3248)
      • iexplore.exe (PID: 3404)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 1976)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 1976)
      • iexplore.exe (PID: 2100)
      • iexplore.exe (PID: 1148)
      • iexplore.exe (PID: 3496)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 2100)
      • iexplore.exe (PID: 3404)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 900)
      • iexplore.exe (PID: 2260)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
65
Monitored processes
19
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe winrar.exe logonfuck.exe no specs logonfuck.exe iexplore.exe logonfuck.exe no specs logonfuck.exe takeown.exe no specs iexplore.exe no specs iexplore.exe iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe no specs iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
1976"C:\Program Files\Internet Explorer\iexplore.exe" "https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqa05jSmxTT3FlTENtNnJXN0RiazZkT2EyVVUtQXxBQ3Jtc0trd2hvN3M1UV9CdTFnMG05cEFDVHI4RnhUcHFLbDhBb2VDQ1g1ekd1MDd4SFE3cktlQVB6MlpvazlWWDB5cW5tZTNBQkktYlgtVU5lYWFBMUdXc2ZUT05Xemhlc3hhaE02TjI3cVlSQU0tNDZvX1FZcw&q=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F2qykx0rzry3ycv7%2FL%252Ag%252AnF%252Ack_source.zip%2Ffile"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
4294967295
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2128"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1976 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
4294967295
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2724"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\LogonFuck_source.zip"C:\Program Files\WinRAR\WinRAR.exe
iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
4294967295
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\user32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\comdlg32.dll
3948"C:\Users\admin\AppData\Local\Temp\Rar$EXa2724.6758\LogonFuck\LogonFuck\bin\Release\LogonFuck.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2724.6758\LogonFuck\LogonFuck\bin\Release\LogonFuck.exe—WinRAR.exe
User:
admin
Company:
gabrik
Integrity Level:
MEDIUM
Description:
LogonFuck
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\rar$exa2724.6758\logonfuck\logonfuck\bin\release\logonfuck.exe
2912"C:\Users\admin\AppData\Local\Temp\Rar$EXa2724.6758\LogonFuck\LogonFuck\bin\Release\LogonFuck.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2724.6758\LogonFuck\LogonFuck\bin\Release\LogonFuck.exe
WinRAR.exe
User:
admin
Company:
gabrik
Integrity Level:
HIGH
Description:
LogonFuck
Exit code:
2148734720
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2724.6758\logonfuck\logonfuck\bin\release\logonfuck.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
824"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1976 CREDAT:1053988 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
4294967295
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\sechost.dll
2764"C:\Users\admin\AppData\Local\Temp\Rar$EXa2724.10457\LogonFuck\LogonFuck\obj\Release\LogonFuck.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2724.10457\LogonFuck\LogonFuck\obj\Release\LogonFuck.exe—WinRAR.exe
User:
admin
Company:
gabrik
Integrity Level:
MEDIUM
Description:
LogonFuck
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\rar$exa2724.10457\logonfuck\logonfuck\obj\release\logonfuck.exe
4036"C:\Users\admin\AppData\Local\Temp\Rar$EXa2724.10457\LogonFuck\LogonFuck\obj\Release\LogonFuck.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2724.10457\LogonFuck\LogonFuck\obj\Release\LogonFuck.exe
WinRAR.exe
User:
admin
Company:
gabrik
Integrity Level:
HIGH
Description:
LogonFuck
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2724.10457\logonfuck\logonfuck\obj\release\logonfuck.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2336"C:\Windows\System32\takeown.exe" /f C:\Windows\System32\LogonUI.exeC:\Windows\System32\takeown.exe—LogonFuck.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Takes ownership of a file
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\takeown.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
900"C:\Program Files\Internet Explorer\iexplore.exe" https://kaspersky.com/C:\Program Files\Internet Explorer\iexplore.exe—LogonFuck.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
99 329
Read events
98 237
Write events
0
Delete events
0

Modification events

No data
Executable files
10
Suspicious files
135
Text files
924
Unknown types
220

Dropped files

PID
Process
Filename
Type
2128iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\715Z9KQN.txttext
MD5:476624F26E36A130CCA671D9FEC37442
SHA256:42B99167195E4B96E8ECBDBBDFB609740DE547408CA75653388881208C75C63E
2128iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:DC4A53BEF9481EED43092A4F432BB37A
SHA256:B2BBFD76FED03A2D98BC8A9C662FD1C0A6A348C6F0F9CB2F63D3F18B73F54530
2128iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:43C9BF118C91704B591F7658F9D22127
SHA256:35BE1D00964EC17D0905F714D64C8BE1D3E32411817CAFB7FAC54C5F51380678
2128iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_7172467AE25B54F1B9D87A9343356E9Bder
MD5:F7A987233EC6C363F5225C5654BAD626
SHA256:5DF2AF937E6007C6BFCEF4AC91AD9F85AF357C8EE0BDEBE97DABD121BEC16E42
2128iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAder
MD5:876BB087B3EB935A4DA2E5E7B74DC034
SHA256:0B332FABB7D73FBA30142FB2A062431AC432BD49FBF7BD71416B00A368770E64
2128iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_7172467AE25B54F1B9D87A9343356E9Bbinary
MD5:E23DA2BC1A98D7E934CBA2C2BC7D1C97
SHA256:9CC2F019CAC6C7FEE4EEAB8B86426C8A796744415E7FEEF972720FD07DEF90DE
2128iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_7BD24FBCF7F89F33B2FA5E0C8CE277C8binary
MD5:04E02BFA4A74839269F2685AF52A2151
SHA256:3F327928F3B9B3866626DAB7E54C3743FC8BC3358C2EA28390C6D0D4C96DBF13
2128iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAder
MD5:5A11C6099B9E5808DFB08C5C9570C92F
SHA256:91291A5EDC4E10A225D3C23265D236ECC74473D9893BE5BD07E202D95B3FB172
1976iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8Fder
MD5:5C1113B7526A7723B64400D44129FA78
SHA256:9ECC27C740862AB2712DA2C4FF31592E2C0A8643576E64551EE344A73FBE2494
2128iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_7BD24FBCF7F89F33B2FA5E0C8CE277C8der
MD5:719EE8BAAE2EB00F5333A113E61AC119
SHA256:A24F6AF39CB20E29BC8C1F90FDE803029DBE41A6E5DD0710D1317952B940AA46
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
103
TCP/UDP connections
596
DNS requests
226
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2128
iexplore.exe
GET
200
172.64.155.188:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEBN9U5yqfDGppDNwGWiEeo0%3D
US
der
727 b
whitelisted
2128
iexplore.exe
GET
200
18.66.9.49:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D
US
der
1.39 Kb
shared
1976
iexplore.exe
GET
200
93.184.220.29:80
http://crl3.digicert.com/Omniroot2025.crl
US
der
7.78 Kb
whitelisted
2128
iexplore.exe
GET
200
172.64.155.188:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
2128
iexplore.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
2128
iexplore.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDExSUZ712qmxLhqE9UUaDV
US
der
472 b
whitelisted
1976
iexplore.exe
GET
200
178.79.242.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c0a0f27c2943d5a6
DE
compressed
4.70 Kb
whitelisted
2128
iexplore.exe
GET
200
52.222.206.202:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
US
der
1.51 Kb
whitelisted
2128
iexplore.exe
GET
200
108.138.2.107:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
1.70 Kb
whitelisted
2128
iexplore.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEG3aTvFLTYzNCmxS2fUJutw%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2128
iexplore.exe
216.58.212.142:443
www.youtube.com
Google Inc.
US
whitelisted
1976
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
2128
iexplore.exe
172.64.155.188:80
ocsp.comodoca.com
—
US
suspicious
1976
iexplore.exe
216.58.212.142:443
www.youtube.com
Google Inc.
US
whitelisted
1976
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2128
iexplore.exe
142.250.186.78:443
www.youtube.com
Google Inc.
US
whitelisted
2128
iexplore.exe
142.250.186.131:80
ocsp.pki.goog
Google Inc.
US
whitelisted
2128
iexplore.exe
104.16.203.237:443
www.mediafire.com
Cloudflare Inc
US
unknown
1976
iexplore.exe
178.79.242.0:80
ctldl.windowsupdate.com
Limelight Networks, Inc.
DE
whitelisted
2128
iexplore.exe
142.250.185.163:443
www.gstatic.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.youtube.com
  • 216.58.212.142
  • 142.250.185.78
  • 142.250.185.110
  • 142.250.185.142
  • 142.250.185.174
  • 142.250.185.206
  • 142.250.185.238
  • 142.250.186.174
  • 142.250.181.238
  • 142.250.184.238
  • 172.217.16.142
  • 142.250.184.206
  • 216.58.212.174
  • 142.250.74.206
  • 142.250.186.46
  • 142.250.186.78
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ctldl.windowsupdate.com
  • 178.79.242.0
  • 95.140.236.0
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
ocsp.pki.goog
  • 142.250.186.131
whitelisted
www.gstatic.com
  • 142.250.185.163
whitelisted
crl3.digicert.com
  • 93.184.220.29
whitelisted
www.mediafire.com
  • 104.16.203.237
  • 104.16.202.237
shared
ocsp.comodoca.com
  • 172.64.155.188
  • 104.18.32.68
whitelisted

Threats

PID
Process
Class
Message
2100
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
2100
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
2100
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
2100
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
2100
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
2100
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
3496
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
3496
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
3496
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
3496
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.youtube.com/redirect?event=video_description&redir_token=QUFFLUhqa05jSmxTT3FlTENtNnJXN0RiazZkT2EyVVUtQXxBQ3Jtc0trd2hvN3M1UV9CdTFnMG05cEFDVHI4RnhUcHFLbDhBb2VDQ1g1ekd1MDd4SFE3cktlQVB6MlpvazlWWDB5cW5tZTNBQkktYlgtVU5lYWFBMUdXc2ZUT05Xemhlc3hhaE02TjI3cVlSQU0tNDZvX1FZcw&q=https%3A%2F%2Fwww.mediafire.com%2Ffile%2F2qykx0rzry3ycv7%2FL%252Ag%252AnF%252Ack_source.zip%2Ffile