File name:

AppNee.com.XOIC.v1.3.Final.7z

Full analysis: https://app.any.run/tasks/6b882ea5-d56a-4617-8402-165fa92b7d04
Verdict: Malicious activity
Analysis date: March 03, 2024, 19:46:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

5C25332FFEBFBC705D4774E7876F17A9

SHA1:

CD0879E54D997430357B659AD83F1A2DD8271D1F

SHA256:

B835A76C4F5541B20BD5E659D836F84F6C1C00CA7C5D2DC93B0AE6027B861B9F

SSDEEP:

12288:rP2sOAAYKiNXQI+mAJXwv+waA0UvIHNhItfkq35m:rP2sfAjiNQI+mAJXwvqA0UwHXItcq35m

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 4052)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 4052)
      • XOIC_1.3.exe (PID: 3716)
      • WinRAR.exe (PID: 1572)

    • Reads the Internet Settings

      • XOIC_1.3.exe (PID: 3716)

    • Executing commands from a ".bat" file

      • DDOSER-APRIL2-PATCH.exe (PID: 2244)
      • DDOSER-APRIL2-PATCH.exe (PID: 2560)
      • DDOSER-APRIL2-PATCH.exe (PID: 3352)

    • Starts CMD.EXE for commands execution

      • DDOSER-APRIL2-PATCH.exe (PID: 2244)
      • DDOSER-APRIL2-PATCH.exe (PID: 2560)
      • DDOSER-APRIL2-PATCH.exe (PID: 3352)

    • Start notepad (likely ransomware note)

      • WinRAR.exe (PID: 1572)

  • INFO

    • Checks supported languages

      • wmpnscfg.exe (PID: 3864)
      • XOIC_1.3.exe (PID: 3716)
      • DDOSER-APRIL2-PATCH.exe (PID: 2244)
      • DDOSER-APRIL2-PATCH.exe (PID: 2560)
      • DDOSER-APRIL2-PATCH.exe (PID: 3352)

    • Reads the computer name

      • wmpnscfg.exe (PID: 3864)
      • XOIC_1.3.exe (PID: 3716)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4052)
      • WinRAR.exe (PID: 1572)

    • Reads the machine GUID from the registry

      • XOIC_1.3.exe (PID: 3716)

    • Creates files in the program directory

      • XOIC_1.3.exe (PID: 3716)

    • Create files in a temporary directory

      • XOIC_1.3.exe (PID: 3716)
      • DDOSER-APRIL2-PATCH.exe (PID: 2244)
      • DDOSER-APRIL2-PATCH.exe (PID: 2560)
      • DDOSER-APRIL2-PATCH.exe (PID: 3352)

    • Application launched itself

      • iexplore.exe (PID: 2036)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2036)

    • The process uses the downloaded file

      • iexplore.exe (PID: 2036)
      • WinRAR.exe (PID: 1572)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 1572)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
67
Monitored processes
18
Malicious processes
0
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe xoic_1.3.exe no specs iexplore.exe iexplore.exe winrar.exe ddoser-april2-patch.exe no specs ddoser-april2-patch.exe cmd.exe no specs ping.exe no specs notepad.exe no specs ddoser-april2-patch.exe no specs ddoser-april2-patch.exe cmd.exe no specs ping.exe no specs ddoser-april2-patch.exe no specs ddoser-april2-patch.exe cmd.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
784"C:\Users\admin\AppData\Local\Temp\Rar$EXa1572.30087\DDOSER-APRIL2-PATCH.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa1572.30087\DDOSER-APRIL2-PATCH.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa1572.30087\ddoser-april2-patch.exe
c:\windows\system32\ntdll.dll
984"C:\Windows\system32\cmd" /c "C:\Users\admin\AppData\Local\Temp\CF2D.tmp\CF2E.tmp\CF2F.bat C:\Users\admin\AppData\Local\Temp\Rar$EXa1572.27429\DDOSER-APRIL2-PATCH.exe"C:\Windows\System32\cmd.exe—DDOSER-APRIL2-PATCH.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1216ping miamc.pl -t -l 65535C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
1572"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\DDOSER-APRIL-PATCH.zip"C:\Program Files\WinRAR\WinRAR.exe
iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1576"C:\Users\admin\AppData\Local\Temp\Rar$EXa1572.19358\DDOSER-APRIL2-PATCH.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa1572.19358\DDOSER-APRIL2-PATCH.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa1572.19358\ddoser-april2-patch.exe
c:\windows\system32\ntdll.dll
1864ping 176.124.190.9 -t -l 30000C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
3221225786
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
1956"C:\Windows\system32\cmd" /c "C:\Users\admin\AppData\Local\Temp\36F0.tmp\36F1.tmp\36F2.bat C:\Users\admin\AppData\Local\Temp\Rar$EXa1572.30087\DDOSER-APRIL2-PATCH.exe"C:\Windows\System32\cmd.exe—DDOSER-APRIL2-PATCH.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2036"C:\Program Files\Internet Explorer\iexplore.exe" http://sourceforge.net/projects/xoic/C:\Program Files\Internet Explorer\iexplore.exe
XOIC_1.3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2244"C:\Users\admin\AppData\Local\Temp\Rar$EXa1572.19358\DDOSER-APRIL2-PATCH.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa1572.19358\DDOSER-APRIL2-PATCH.exe
WinRAR.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa1572.19358\ddoser-april2-patch.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
2560"C:\Users\admin\AppData\Local\Temp\Rar$EXa1572.27429\DDOSER-APRIL2-PATCH.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa1572.27429\DDOSER-APRIL2-PATCH.exe
WinRAR.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa1572.27429\ddoser-april2-patch.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
Total events
33 459
Read events
33 256
Write events
167
Delete events
36

Modification events

(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(4052) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\AppNee.com.XOIC.v1.3.Final.7z
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
4
Suspicious files
38
Text files
134
Unknown types
22

Dropped files

PID
Process
Filename
Type
4052WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa4052.16498\Close_XOIC.battext
MD5:621CA1F3E3FF3AF2769FA0F3C19C6402
SHA256:44C8C063BD63D1834F5504831101B880F9BEC6B6B18258A5CC069C9F5E3B75F9
4052WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa4052.16498\Latest version.urlurl
MD5:9EC3A66D33554446972F3FCF8C62879B
SHA256:C7B72FB6DB94D88E5BDDC09D3792D454AFB6D1905633841FEE883D44A4F0CB59
4052WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa4052.16498\Original source.urlurl
MD5:1BFB173207BEF41F4E5CB389A2420C91
SHA256:0C44EDAC72838E4D4DC074ADA81299972B55CB207BF77800CAD322EC80958834
3948iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\xoic[1].htmhtml
MD5:225679F4AB850DD73F9C06465F5B3BCE
SHA256:073B76B51C5AEFB15CCE3BFDCC9D9322A872B84AEB7A7CCDF20B9C271BA3EF12
3948iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\3ZC5OO25.txttext
MD5:FA89083DBFEB17CCADD24B299EB3872D
SHA256:E0320AB2CAEA4ED50C949358599D908C7F3C135BF383C7FF0BDABD31008EA4E4
3948iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\xoic[1].htmhtml
MD5:89EB49E2928BCB1FDB98D6BAAF8633DD
SHA256:1A5A2595E49631247EA28C8B5D075B64AE334D627CE45A704307AFC9111D349B
3948iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:9A89FA89ACE220C2D7415E2C0BDCB73E
SHA256:A2FF6F910A58E2FA5BC32EFF5B4365394AEF60A5585201D36974DF29CBC104C5
3948iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:5B2BF76C3734460EF71A0D79F4EDF0E7
SHA256:0A48D1D9204BBDEE420840308388FEC1059DEB01C5515642656FEC26601659A4
3948iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\lato[1].csstext
MD5:8F61F228AD51184B5F8BBBF14B436DF9
SHA256:DA04907546EDDC4640039BB9EFBBB483D220B1E4EC553F9830A9510B7FF14899
4052WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa4052.16498\XOIC_1.3.exeexecutable
MD5:B6C4E2C4FA384212126D7DBB832460C9
SHA256:1AB7EDE95C3811F3019114853291E46AD6E041E9E20AC640AC1A4A45B3743484
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
27
TCP/UDP connections
74
DNS requests
33
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3948
iexplore.exe
GET
200
142.250.74.195:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFCjJ1PwkYAi7fE%3D
unknown
binary
724 b
unknown
3948
iexplore.exe
GET
200
142.250.74.195:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
3948
iexplore.exe
GET
200
142.250.74.195:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
binary
724 b
unknown
3948
iexplore.exe
GET
200
142.250.74.195:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIAjrICMzZli2TN25s%3D
unknown
binary
724 b
unknown
3948
iexplore.exe
GET
200
142.250.74.195:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
binary
724 b
unknown
3948
iexplore.exe
GET
200
142.250.74.195:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIAjrICMzZli2TN25s%3D
unknown
binary
724 b
unknown
3948
iexplore.exe
GET
200
142.250.74.195:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGHsycmQas7CCZXEOfu%2B%2Bqs%3D
unknown
binary
471 b
unknown
3948
iexplore.exe
GET
200
142.250.74.195:80
http://ocsp.pki.goog/s/gts1d4/9kOnRorwuhU/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSMBFDqU0NJQdZdEGU3bkhj0FoRrQQUJeIYDrJXkZQq5dRdhpCD3lOzuJICEQCn3IglCroPfAlxmQvYMTHU
unknown
binary
472 b
unknown
3948
iexplore.exe
GET
200
2.19.51.203:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgOoDMk2RHf8%2BIqygNF0KH9Q4Q%3D%3D
unknown
binary
503 b
unknown
3948
iexplore.exe
GET
200
142.250.74.195:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC2ISj9D7BtrgnmODKt9ZmU
unknown
binary
472 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3948
iexplore.exe
104.18.37.111:80
sourceforge.net
CLOUDFLARENET
—
unknown
3948
iexplore.exe
104.18.37.111:443
sourceforge.net
CLOUDFLARENET
—
unknown
3948
iexplore.exe
95.100.155.18:80
ctldl.windowsupdate.com
Akamai International B.V.
DK
unknown
3948
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3948
iexplore.exe
104.18.40.209:443
a.fsdn.com
CLOUDFLARENET
—
shared
3948
iexplore.exe
87.230.98.76:443
d.delivery.consentmanager.net
PlusServer GmbH
DE
unknown
3948
iexplore.exe
156.146.33.138:443
cdn.consentmanager.net
Datacamp Limited
DE
unknown

DNS requests

Domain
IP
Reputation
sourceforge.net
  • 104.18.37.111
  • 172.64.150.145
whitelisted
ctldl.windowsupdate.com
  • 95.100.155.18
  • 23.65.29.16
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
a.fsdn.com
  • 104.18.40.209
  • 172.64.147.47
whitelisted
d.delivery.consentmanager.net
  • 87.230.98.76
unknown
cdn.consentmanager.net
  • 156.146.33.138
  • 212.102.56.178
  • 195.181.170.19
  • 195.181.175.40
  • 156.146.33.141
  • 212.102.56.182
malicious
x1.c.lencr.org
  • 23.218.185.6
whitelisted
c.sf-syn.com
  • 172.64.154.159
  • 104.18.33.97
whitelisted
r3.o.lencr.org
  • 2.19.51.203
  • 2.19.51.226
shared
api.bing.com
  • 13.107.5.80
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AppNee.com.XOIC.v1.3.Final.7z