analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://www.mediafire.com/file/kxyrlxrujr9du2o/Master_in_Hacking_with_XSS_Cross_Site_Scripting_Downloaded_By_Muhammad_Zubair.zip/file

Full analysis: https://app.any.run/tasks/d34a66b8-f09b-4be1-8223-f6cbe1d3510d
Verdict: Malicious activity
Analysis date: January 24, 2022, 19:51:47
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

EA6F6A3080EEB488914807B2D6DFEC82

SHA1:

71E1BBACBD964F505FD50188ECE1C8DF54C87604

SHA256:

C190FBECAEF081BD6768486E99C69D37EFE2583F6B1091162A7075FA6BE0744F

SSDEEP:

3:N1KJS4w3eGUoPXJV8Bhmy5QgcuWdV66kz2BdDYEaHlIVY9:Cc4w3eGDJgP5idVzkzWFM7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • reg.exe (PID: 3144)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3792)
      • iexplore.exe (PID: 1108)
      • iexplore.exe (PID: 2944)

    • Checks supported languages

      • Skype.exe (PID: 2768)
      • Skype.exe (PID: 3016)
      • Skype.exe (PID: 2112)
      • Skype.exe (PID: 404)
      • Skype.exe (PID: 3488)
      • Skype.exe (PID: 4044)

    • Reads the computer name

      • Skype.exe (PID: 2768)
      • Skype.exe (PID: 3016)
      • Skype.exe (PID: 2112)
      • Skype.exe (PID: 404)
      • Skype.exe (PID: 3488)
      • Skype.exe (PID: 4044)

    • Reads CPU info

      • Skype.exe (PID: 2768)

    • Application launched itself

      • Skype.exe (PID: 2768)
      • Skype.exe (PID: 2112)
      • Skype.exe (PID: 3488)

    • Uses REG.EXE to modify Windows registry

      • Skype.exe (PID: 2768)

    • Creates files in the user directory

      • Skype.exe (PID: 2768)
      • Skype.exe (PID: 2112)
      • Skype.exe (PID: 3488)

    • Changes default file association

      • Skype.exe (PID: 2768)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 1108)
      • iexplore.exe (PID: 3792)
      • iexplore.exe (PID: 2944)

    • Checks supported languages

      • iexplore.exe (PID: 1108)
      • iexplore.exe (PID: 3792)
      • iexplore.exe (PID: 2944)
      • reg.exe (PID: 3144)
      • reg.exe (PID: 508)

    • Changes internet zones settings

      • iexplore.exe (PID: 1108)

    • Application launched itself

      • iexplore.exe (PID: 1108)

    • Creates files in the user directory

      • iexplore.exe (PID: 3792)
      • iexplore.exe (PID: 1108)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3792)
      • iexplore.exe (PID: 1108)
      • Skype.exe (PID: 2768)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3792)
      • iexplore.exe (PID: 2944)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3792)
      • iexplore.exe (PID: 1108)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 1108)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 1108)
      • Skype.exe (PID: 2768)

    • Changes settings of System certificates

      • iexplore.exe (PID: 1108)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 1108)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 1108)

    • Manual execution by user

      • Skype.exe (PID: 2768)

    • Reads the hosts file

      • Skype.exe (PID: 2768)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
11
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe iexplore.exe no specs skype.exe skype.exe reg.exe skype.exe no specs reg.exe no specs skype.exe skype.exe no specs skype.exe

Process information

PID
CMD
Path
Indicators
Parent process
1108"C:\Program Files\Internet Explorer\iexplore.exe" "http://www.mediafire.com/file/kxyrlxrujr9du2o/Master_in_Hacking_with_XSS_Cross_Site_Scripting_Downloaded_By_Muhammad_Zubair.zip/file"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3792"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1108 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2944"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1108 CREDAT:660759 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2768"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" C:\Program Files\Microsoft\Skype for Desktop\Skype.exe
Explorer.EXE
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Version:
8.29.0.50
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft\skype for desktop\skype.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\skype for desktop\node.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\program files\microsoft\skype for desktop\msvcp140.dll
3016"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" --reporter-url=https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload --application-name=skype-preview "--crashes-directory=C:\Users\admin\AppData\Local\Temp\skype-preview Crashes" --v=1C:\Program Files\Microsoft\Skype for Desktop\Skype.exe
Skype.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Version:
8.29.0.50
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft\skype for desktop\skype.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\skype for desktop\node.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\program files\microsoft\skype for desktop\msvcp140.dll
3144C:\Windows\system32\reg.exe ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Skype for Desktop" /t REG_SZ /d "C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" /fC:\Windows\system32\reg.exe
Skype.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2112"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" --type=renderer --ms-disable-indexeddb-transaction-timeout --no-sandbox --service-pipe-token=53EF93F6A8EA3A3AA542A2260114670C --lang=en-US --app-user-model-id=Microsoft.Skype.SkypeDesktop --app-path="C:\Program Files\Microsoft\Skype for Desktop\resources\app.asar" --node-integration=false --webview-tag=true --no-sandbox --preload="C:\Program Files\Microsoft\Skype for Desktop\resources\app.asar\Preload.js" --context-id=2 --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=53EF93F6A8EA3A3AA542A2260114670C --renderer-client-id=3 --mojo-platform-channel-handle=1584 /prefetch:1C:\Program Files\Microsoft\Skype for Desktop\Skype.exe—Skype.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Exit code:
0
Version:
8.29.0.50
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\skype for desktop\node.dll
c:\program files\microsoft\skype for desktop\skype.exe
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\nsi.dll
c:\program files\microsoft\skype for desktop\msvcp140.dll
508C:\Windows\system32\reg.exe QUERY HKCU\Software\Microsoft\Skype /v RestartForUpdateC:\Windows\system32\reg.exe—Skype.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
404"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" --reporter-url=https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload --application-name=skype-preview "--crashes-directory=C:\Users\admin\AppData\Local\Temp\skype-preview Crashes" --v=1C:\Program Files\Microsoft\Skype for Desktop\Skype.exe
Skype.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Exit code:
2
Version:
8.29.0.50
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft\skype for desktop\skype.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\skype for desktop\node.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\nsi.dll
c:\windows\system32\rpcrt4.dll
c:\program files\microsoft\skype for desktop\msvcp140.dll
3488"C:\Program Files\Microsoft\Skype for Desktop\Skype.exe" --type=renderer --ms-disable-indexeddb-transaction-timeout --no-sandbox --service-pipe-token=3A1AFD1DB57441F7952D2527D5323993 --lang=en-US --app-user-model-id=Microsoft.Skype.SkypeDesktop --app-path="C:\Program Files\Microsoft\Skype for Desktop\resources\app.asar" --node-integration=false --webview-tag=true --no-sandbox --preload="C:\Program Files\Microsoft\Skype for Desktop\resources\app.asar\Preload.js" --context-id=1 --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=3A1AFD1DB57441F7952D2527D5323993 --renderer-client-id=4 --mojo-platform-channel-handle=2672 /prefetch:1C:\Program Files\Microsoft\Skype for Desktop\Skype.exe—Skype.exe
User:
admin
Company:
Skype Technologies S.A.
Integrity Level:
MEDIUM
Description:
Skype
Version:
8.29.0.50
Modules
Images
c:\program files\microsoft\skype for desktop\skype.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\skype for desktop\node.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\nsi.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\program files\microsoft\skype for desktop\msvcp140.dll
Total events
21 054
Read events
20 870
Write events
181
Delete events
3

Modification events

(PID) Process:(1108) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(1108) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(1108) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30937435
(PID) Process:(1108) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(1108) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30937435
(PID) Process:(1108) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1108) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1108) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1108) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1108) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
41
Text files
42
Unknown types
28

Dropped files

PID
Process
Filename
Type
3792iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\file[1].htmhtml
MD5:4C4D7485E73AD5F0176B4BC255814178
SHA256:15DF9BA3208CCAEFE4C166D06FB966E3886DD08689246FB4040E58F74145B7E1
3792iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894der
MD5:E9953511B806D96C85112D07C44DE02A
SHA256:86008864D275A5005CDEE88B0DF9E38009AB1F28E731673403DDCD89078A381B
3792iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\SFFSR29N.txttext
MD5:D493787275F6FC88DA410A81652A276C
SHA256:64596EE93491EC71241C44E6125467409976E61F4A4E4CD7498593A3AA5DC65E
3792iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\KYV1IV0W.txttext
MD5:37F16B059CAADF3FCFC2B2D180C1EF98
SHA256:F772DF9E7104F9EF61C4E7FAD6F8736008B5823C4E222E98576C78EA051FAEE3
3792iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\SWM7Z8K5.txttext
MD5:BB133472B514135263B1B22D72CF69BD
SHA256:F8AA92D62B20033B3DD0BD78A29CDFC2AF368A10A8705ABF446107E7460CA4C4
3792iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62der
MD5:949CEC434DD48DBFECFC8A1A8D055B7F
SHA256:8B5B70DC721BE51D2D326069F158A3D0A820036F5EA0E0FA09E476C00A36D530
3792iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\71N18K88.txttext
MD5:6994E2D21706C33BA88D2C78DDA1237D
SHA256:0D66341736F5393A5DDBAAD8EF88163242C650DDDCE9D73E141908EE204B8B4F
3792iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62binary
MD5:7027F1DE37FC84DA63CB459AC9A228F5
SHA256:8D5BA14649ED2794DD7F87C2504495D81864D932EC8B9AE206C1D24392555F2E
3792iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894binary
MD5:F1A3023BD516BF443CBF29C207C333F8
SHA256:530B4127DC7446DB796410CB1644952D425F197DB8059F0180BDFF861D776ED0
3792iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\mf_logo_full_color[1].svgimage
MD5:B3BB5BF9102F80054D199F293046DB84
SHA256:8539C91AE0A82F8CAB27D481EA38AC4E66D1E5B36701FE295BCBA4399B9255BD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
108
DNS requests
44
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3792
iexplore.exe
GET
—
199.91.152.149:80
http://download1649.mediafire.com/7rut71m98yug/kxyrlxrujr9du2o/Master+in+Hacking+with+XSS+Cross+Site+Scripting.zip
US
—
—
suspicious
3792
iexplore.exe
GET
200
104.16.203.237:80
http://www.mediafire.com/file/kxyrlxrujr9du2o/Master_in_Hacking_with_XSS_Cross_Site_Scripting_Downloaded_By_Muhammad_Zubair.zip/file
US
html
83.5 Kb
shared
1108
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
3792
iexplore.exe
GET
200
104.16.202.237:80
http://static.mediafire.com/images/icons/svg_dark/check_circle_green.svg
US
image
300 b
shared
3792
iexplore.exe
GET
200
18.66.92.73:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
1.70 Kb
whitelisted
3792
iexplore.exe
GET
200
104.16.202.237:80
http://static.mediafire.com/images/backgrounds/download/social/fb_16x16.png
US
image
181 b
shared
3792
iexplore.exe
GET
200
52.222.206.35:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
US
der
1.51 Kb
whitelisted
3792
iexplore.exe
GET
200
104.16.202.237:80
http://static.mediafire.com/images/backgrounds/download/dl_promo_logo.png
US
image
2.19 Kb
shared
3792
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
3792
iexplore.exe
GET
200
104.16.203.237:80
http://www.mediafire.com/images/icons/svg_light/icons_sprite.svg
US
image
8.20 Kb
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3792
iexplore.exe
104.16.95.65:443
static.cloudflareinsights.com
Cloudflare Inc
US
shared
3792
iexplore.exe
104.26.6.139:443
btloader.com
Cloudflare Inc
US
suspicious
3792
iexplore.exe
104.16.203.237:80
www.mediafire.com
Cloudflare Inc
US
unknown
3792
iexplore.exe
142.250.185.206:80
translate.google.com
Google Inc.
US
whitelisted
3792
iexplore.exe
142.250.185.206:443
translate.google.com
Google Inc.
US
whitelisted
3792
iexplore.exe
142.250.184.200:443
www.googletagmanager.com
Google Inc.
US
suspicious
3792
iexplore.exe
23.32.238.201:80
ctldl.windowsupdate.com
XO Communications
US
suspicious
3792
iexplore.exe
104.16.202.237:80
www.mediafire.com
Cloudflare Inc
US
unknown
3792
iexplore.exe
104.19.215.37:443
cdn.otnolatrnup.com
Cloudflare Inc
US
shared
3792
iexplore.exe
52.222.206.214:443
cdn.amplitude.com
Amazon.com, Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
www.mediafire.com
  • 104.16.203.237
  • 104.16.202.237
shared
www.googletagmanager.com
  • 142.250.184.200
whitelisted
btloader.com
  • 104.26.6.139
  • 172.67.70.134
  • 104.26.7.139
whitelisted
translate.google.com
  • 142.250.185.206
whitelisted
static.cloudflareinsights.com
  • 104.16.95.65
  • 104.16.94.65
whitelisted
fundingchoicesmessages.google.com
  • 142.250.185.206
whitelisted
cdn.amplitude.com
  • 52.222.206.214
  • 52.222.206.6
  • 52.222.206.118
  • 52.222.206.178
whitelisted
cdn.otnolatrnup.com
  • 104.19.215.37
  • 104.19.214.37
whitelisted
static.mediafire.com
  • 104.16.202.237
  • 104.16.203.237
shared
ctldl.windowsupdate.com
  • 23.32.238.201
  • 23.32.238.178
whitelisted

Threats

PID
Process
Class
Message
3792
iexplore.exe
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
Process
Message
Skype.exe
[3016:3300:0124/195332.366:VERBOSE1:crash_service_main.cc(78)] Session start. cmdline is [--reporter-url=https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload --application-name=skype-preview "--crashes-directory=C:\Users\admin\AppData\Local\Temp\skype-preview Crashes" --v=1]
Skype.exe
[3016:3300:0124/195332.366:VERBOSE1:crash_service.cc(145)] window handle is 00020192
Skype.exe
[3016:3300:0124/195332.366:VERBOSE1:crash_service.cc(300)] pipe name is \\.\pipe\skype-preview Crash Service dumps at C:\Users\admin\AppData\Local\Temp\skype-preview Crashes
Skype.exe
[3016:3300:0124/195332.366:VERBOSE1:crash_service.cc(304)] checkpoint is C:\Users\admin\AppData\Local\Temp\skype-preview Crashes\crash_checkpoint.txt server is https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload maximum 128 reports/day reporter is electron-crash-service
Skype.exe
[3016:3300:0124/195332.366:VERBOSE1:crash_service_main.cc(94)] Ready to process crash requests
Skype.exe
[3016:2632:0124/195332.366:VERBOSE1:crash_service.cc(333)] client start. pid = 2768
Skype.exe
[3016:2632:0124/195334.841:VERBOSE1:crash_service.cc(333)] client start. pid = 2112
Skype.exe
[404:1408:0124/195334.919:VERBOSE1:crash_service_main.cc(78)] Session start. cmdline is [--reporter-url=https://rink.hockeyapp.net/api/2/apps/a741743329d94bc08826af367733939d/crashes/upload --application-name=skype-preview "--crashes-directory=C:\Users\admin\AppData\Local\Temp\skype-preview Crashes" --v=1]
Skype.exe
[404:1408:0124/195334.919:VERBOSE1:crash_service.cc(145)] window handle is 0002019C
Skype.exe
[404:1408:0124/195334.919:VERBOSE1:crash_service.cc(300)] pipe name is \\.\pipe\skype-preview Crash Service dumps at C:\Users\admin\AppData\Local\Temp\skype-preview Crashes
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://www.mediafire.com/file/kxyrlxrujr9du2o/Master_in_Hacking_with_XSS_Cross_Site_Scripting_Downloaded_By_Muhammad_Zubair.zip/file