URL:

https://www.google.com/search?client=firefox-b-d&q=alphabet+lore+

Full analysis: https://app.any.run/tasks/6e134324-e428-4cb4-9fa1-79d1e173861f
Verdict: Malicious activity
Analysis date: April 23, 2024, 19:28:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

A513F332DC7C2FE55902EE33831E4BFD

SHA1:

D27406F041D957AA385362DBD3AB8767735C1829

SHA256:

B02B9C9C2DD6A0D431FD5CBABA71C9D0D584AEC45312BF866AF666D9F717A081

SSDEEP:

3:N8DSLIwAEXG7Cj2d6IHQNEgUKb:2OLIwBGeCd6IwlUKb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the Internet Settings

      • MEMZ(1).exe (PID: 1072)
      • runonce.exe (PID: 1216)
      • sipnotify.exe (PID: 1464)

    • Reads security settings of Internet Explorer

      • MEMZ(1).exe (PID: 1072)

    • Application launched itself

      • MEMZ(1).exe (PID: 1072)
      • WerFault.exe (PID: 2084)

    • Checks Windows Trust Settings

      • MEMZ(1).exe (PID: 1072)

    • The process executes via Task Scheduler

      • ctfmon.exe (PID: 1552)
      • sipnotify.exe (PID: 1464)

    • Non-standard symbols in registry

      • WerFault.exe (PID: 2092)

    • Reads settings of System Certificates

      • sipnotify.exe (PID: 1464)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3416)
      • firefox.exe (PID: 1112)
      • firefox.exe (PID: 2100)

    • Manual execution by a user

      • firefox.exe (PID: 1112)
      • wmpnscfg.exe (PID: 2460)
      • MEMZ(1).exe (PID: 1072)
      • runonce.exe (PID: 1216)
      • IMEKLMG.EXE (PID: 2188)
      • IMEKLMG.EXE (PID: 2196)
      • wmpnscfg.exe (PID: 2524)
      • wmpnscfg.exe (PID: 2576)
      • wmpnscfg.exe (PID: 2644)

    • Checks supported languages

      • wmpnscfg.exe (PID: 2460)
      • MEMZ(1).exe (PID: 1072)
      • MEMZ(1).exe (PID: 3068)
      • MEMZ(1).exe (PID: 316)
      • MEMZ(1).exe (PID: 3376)
      • MEMZ(1).exe (PID: 2640)
      • MEMZ(1).exe (PID: 1380)
      • MEMZ(1).exe (PID: 1772)
      • IMEKLMG.EXE (PID: 2196)
      • IMEKLMG.EXE (PID: 2188)
      • wmpnscfg.exe (PID: 2524)
      • wmpnscfg.exe (PID: 2644)
      • wmpnscfg.exe (PID: 2576)

    • Reads the computer name

      • wmpnscfg.exe (PID: 2460)
      • MEMZ(1).exe (PID: 1072)
      • IMEKLMG.EXE (PID: 2188)
      • IMEKLMG.EXE (PID: 2196)
      • wmpnscfg.exe (PID: 2524)
      • wmpnscfg.exe (PID: 2576)
      • wmpnscfg.exe (PID: 2644)

    • The process uses the downloaded file

      • firefox.exe (PID: 2100)
      • MEMZ(1).exe (PID: 1072)

    • Drops the executable file immediately after the start

      • firefox.exe (PID: 2100)

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 2100)

    • Reads the machine GUID from the registry

      • MEMZ(1).exe (PID: 1072)
      • MEMZ(1).exe (PID: 316)
      • MEMZ(1).exe (PID: 1772)
      • MEMZ(1).exe (PID: 3068)
      • MEMZ(1).exe (PID: 3376)

    • Reads the time zone

      • runonce.exe (PID: 1216)

    • Reads security settings of Internet Explorer

      • runonce.exe (PID: 1216)
      • sipnotify.exe (PID: 1464)

    • Create files in a temporary directory

      • WerFault.exe (PID: 2092)

    • Reads the software policy settings

      • sipnotify.exe (PID: 1464)

    • Process checks whether UAC notifications are on

      • IMEKLMG.EXE (PID: 2188)
      • IMEKLMG.EXE (PID: 2196)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
110
Monitored processes
31
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs wmpnscfg.exe no specs memz(1).exe no specs memz(1).exe no specs memz(1).exe no specs memz(1).exe no specs memz(1).exe no specs memz(1).exe no specs memz(1).exe no specs ctfmon.exe no specs sipnotify.exe runonce.exe werfault.exe no specs werfault.exe no specs imeklmg.exe no specs imeklmg.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
316"C:\Users\admin\Downloads\MEMZ(1).exe" /watchdogC:\Users\admin\Downloads\MEMZ(1).exe—MEMZ(1).exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\downloads\memz(1).exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1072"C:\Users\admin\Downloads\MEMZ(1).exe" C:\Users\admin\Downloads\MEMZ(1).exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\downloads\memz(1).exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1112"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
1216runonce.exe /ExplorerC:\Windows\System32\runonce.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Run Once Wrapper
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\runonce.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1380"C:\Users\admin\Downloads\MEMZ(1).exe" /watchdogC:\Users\admin\Downloads\MEMZ(1).exe—MEMZ(1).exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\downloads\memz(1).exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1464C:\Windows\system32\sipnotify.exe -LogonOrUnlockC:\Windows\System32\sipnotify.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
sipnotify
Exit code:
0
Version:
6.1.7602.20480 (win7sp1_ldr_escrow.191010-1716)
Modules
Images
c:\windows\system32\sipnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1552C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1772"C:\Users\admin\Downloads\MEMZ(1).exe" /watchdogC:\Users\admin\Downloads\MEMZ(1).exe—MEMZ(1).exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\downloads\memz(1).exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1972"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2100.5.1649830359\257086062" -childID 4 -isForBrowser -prefsHandle 3980 -prefMapHandle 3820 -prefsLen 29209 -prefMapSize 244195 -jsInitHandle 868 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0e6eb66c-2dd9-48a8-ba8f-f912f0c22945} 2100 "\\.\pipe\gecko-crash-server-pipe.2100" 4004 2143a280 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
2084"C:\Windows\System32\WerFault.exe" -k -rqC:\Windows\System32\WerFault.exe—runonce.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
43 476
Read events
43 221
Write events
190
Delete events
65

Modification events

(PID) Process:(3416) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3416) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3416) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31102388
(PID) Process:(3416) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3416) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31102388
(PID) Process:(3416) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3416) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3416) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3416) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3416) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
7
Suspicious files
160
Text files
46
Unknown types
43

Dropped files

PID
Process
Filename
Type
3384iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:1C71CE18DB4C40197F42E4E161778546
SHA256:46C225CF4D3110C4FD2DF4105E1C6C662B0982A3F3B7E0ECCCED204704D4C6BF
3384iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:807497F8020F3E4691C145BD1B276921
SHA256:821B27805114F57856E6C774176933F8FBEF5195F8876753075974D9DD501567
3384iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAder
MD5:AC89A852C2AAA3D389B2D2DD312AD367
SHA256:0B720E19270C672F9B6E0EC40B468AC49376807DE08A814573FE038779534F45
3384iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:C19AE50F8BC48D16421382ACDB958B64
SHA256:DC41C90F633B4BDB489663C6B82DE3B06F4CF5A87029820A0F63A566BBBCC946
3416iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[1].icoimage
MD5:F3418A443E7D841097C714D69EC4BCB8
SHA256:6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
3384iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_58CE33FE794A546ABE22647AB5C8AA99binary
MD5:F45A56FC5FC5C133FA0B4E3B6420A86B
SHA256:3296ABDA20D3BD48C2DE362AFDE58F1398559C228D9F3A50EA53F368D1D3CC06
3416iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Abinary
MD5:98C3C6E27C10D5CCE933356C49832788
SHA256:5CE89848E2E39CF69A9DB4E4D0E0AB1DD592DB38B326B84420AE7D09E91D4090
3416iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
3416iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\favicon[2].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
2100firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
43
TCP/UDP connections
114
DNS requests
188
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3384
iexplore.exe
GET
304
173.222.108.249:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3d3d14b9ee381273
unknown
—
—
unknown
3384
iexplore.exe
GET
304
173.222.108.243:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?7f68a02ba6df2d36
unknown
—
—
unknown
3384
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
—
—
unknown
3384
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
—
—
unknown
3384
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFBwRbDjnKinCvbzPd%2BGMUY%3D
unknown
—
—
unknown
3384
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQD0crTFWCTVIAm4ZwPnmLpo
unknown
—
—
unknown
3416
iexplore.exe
GET
304
173.222.108.249:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3ed6d2b4a8fbdc40
unknown
—
—
unknown
3416
iexplore.exe
GET
304
173.222.108.249:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?ccd3f16cad753a85
unknown
—
—
unknown
3416
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
—
—
unknown
2100
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3384
iexplore.exe
142.250.186.68:443
www.google.com
GOOGLE
US
whitelisted
3384
iexplore.exe
173.222.108.249:80
ctldl.windowsupdate.com
Akamai International B.V.
CH
unknown
3384
iexplore.exe
173.222.108.243:80
ctldl.windowsupdate.com
Akamai International B.V.
CH
unknown
3384
iexplore.exe
142.250.185.131:80
ocsp.pki.goog
GOOGLE
US
whitelisted
3384
iexplore.exe
172.217.16.206:443
consent.google.com
GOOGLE
US
whitelisted
3384
iexplore.exe
172.217.18.3:443
www.gstatic.com
GOOGLE
US
whitelisted
3416
iexplore.exe
142.250.186.68:443
www.google.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
www.google.com
  • 142.250.186.68
  • 2a00:1450:4001:806::2004
  • 172.217.16.196
  • 2a00:1450:4001:80b::2004
whitelisted
ctldl.windowsupdate.com
  • 173.222.108.249
  • 173.222.108.243
  • 2.19.126.137
  • 2.19.126.163
whitelisted
ocsp.pki.goog
  • 142.250.185.131
  • 142.250.186.35
whitelisted
consent.google.com
  • 172.217.16.206
  • 2a00:1450:4001:81d::200e
shared
www.gstatic.com
  • 172.217.18.3
  • 2a00:1450:4001:81d::2003
  • 172.217.16.195
  • 2a00:1450:4001:831::2003
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 92.122.215.58
  • 2.20.142.180
  • 92.122.215.74
  • 2.20.142.187
  • 92.122.215.53
  • 92.122.215.98
  • 92.122.215.56
  • 92.122.215.65
  • 92.122.215.72
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
detectportal.firefox.com
  • 34.107.221.82
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.google.com/search?client=firefox-b-d&q=alphabet+lore+