File name: | atom.exe |
Full analysis: | https://app.any.run/tasks/a00dd44d-580a-441d-ab4b-d4dbaea6f7b9 |
Verdict: | Malicious activity |
Analysis date: | February 22, 2020, 08:58:10 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | DE4981F84E6C410C82D9EFF8E2DA2AC3 |
SHA1: | 3A63BC0733BF0DA57EAC83489F5D81AC89FDD692 |
SHA256: | CC14A75C1E2D43537BC55C35D4801FFF8FC3094E11E5BF1B8BEEB02704BADC8C |
SSDEEP: | 24576:Id4WXdx60F0IPYbsN266cbsRG6ELOGf27+:IVdLHgo26FDh3O7+ |
.exe | | | Win64 Executable (generic) (76.4) |
---|---|---|
.exe | | | Win32 Executable (generic) (12.4) |
.exe | | | Generic Win/DOS Executable (5.5) |
.exe | | | DOS Executable Generic (5.5) |
LegalCopyright: | Copyright 2019 |
---|---|
ProductVersion: | 3.1.0.43 |
FileVersion: | 3.1.0.43 |
ProductName: | Atom Browser |
OriginalFileName: | Atom Browser |
InternalName: | Atom Browser |
FileDescription: | Atom Browser |
CompanyName: | Mail.Ru |
CharacterSet: | Unicode |
LanguageCode: | English (U.S.) |
FileSubtype: | - |
ObjectFileType: | Dynamic link library |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 3.1.0.43 |
FileVersionNumber: | 3.1.0.43 |
Subsystem: | Windows GUI |
SubsystemVersion: | 5.1 |
ImageVersion: | - |
OSVersion: | 5.1 |
EntryPoint: | 0x2335f |
UninitializedDataSize: | - |
InitializedDataSize: | 609280 |
CodeSize: | 372224 |
LinkerVersion: | 14.12 |
PEType: | PE32 |
TimeStamp: | 2019:09:05 15:48:51+02:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 05-Sep-2019 13:48:51 |
Detected languages: |
|
Debug artifacts: |
|
CompanyName: | Mail.Ru |
FileDescription: | Atom Browser |
InternalName: | Atom Browser |
OriginalFilename: | Atom Browser |
ProductName: | Atom Browser |
FileVersion: | 3.1.0.43 |
ProductVersion: | 3.1.0.43 |
LegalCopyright: | Copyright 2019 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000120 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 5 |
Time date stamp: | 05-Sep-2019 13:48:51 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x0005ADC0 | 0x0005AE00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.65347 |
.rdata | 0x0005C000 | 0x0001E526 | 0x0001E600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.03062 |
.data | 0x0007B000 | 0x00006FF4 | 0x00005E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 5.02695 |
.rsrc | 0x00082000 | 0x00068C60 | 0x00068E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 7.84577 |
.reloc | 0x000EB000 | 0x00006764 | 0x00006800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.53499 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.08604 | 604 | UNKNOWN | English - United States | RT_MANIFEST |
2 | 5.92671 | 4264 | UNKNOWN | English - United States | RT_ICON |
3 | 6.09856 | 16936 | UNKNOWN | English - United States | RT_ICON |
214 | 2 | 8 | UNKNOWN | English - United States | RT_ACCELERATOR |
ERROR/STYLES.CSS | 5.05012 | 913 | UNKNOWN | English - United States | ASSETS |
LOAD_FAILED.HTML | 5.41536 | 573 | UNKNOWN | English - United States | ASSETS |
LOW_DISK_SPACE.HTML | 5.41822 | 630 | UNKNOWN | English - United States | ASSETS |
SKIN.HTML | 4.9969 | 735 | UNKNOWN | English - United States | ASSETS |
SKIN/BUTTONS/CLOSE_HOVER.PNG | 7.30325 | 424 | UNKNOWN | English - United States | ASSETS |
SKIN/BUTTONS/CLOSE_NORMAL.PNG | 7.28042 | 392 | UNKNOWN | English - United States | ASSETS |
ADVAPI32.dll |
GDI32.dll |
KERNEL32.dll |
OLEAUT32.dll |
SHELL32.dll |
SHLWAPI.dll |
USER32.dll |
WINHTTP.dll (delay-loaded) |
WS2_32.dll |
ole32.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3976 | "C:\Users\admin\AppData\Local\Temp\atom.exe" | C:\Users\admin\AppData\Local\Temp\atom.exe | explorer.exe | |
User: admin Company: Mail.Ru Integrity Level: MEDIUM Description: Atom Browser Exit code: 0 Version: 3.1.0.43 | ||||
2776 | "C:\Users\admin\AppData\Local\Temp\\loader_ldir_10906484\atom.exe" --cp | C:\Users\admin\AppData\Local\Temp\loader_ldir_10906484\atom.exe | atom.exe | |
User: admin Company: Mail.Ru Integrity Level: MEDIUM Description: Atom Browser Exit code: 0 Version: 3.1.0.43 | ||||
2736 | "C:\Users\admin\AppData\Local\Temp\mini_loader_scoped_dir_1582361906\atom.exe" --arf=1 --rfr=530000 --ga-tid=UA-122680070-1 --ga-cid= --usagestats=1 --ext_params=IVID=3aoqbm3a4g1v00000L0g94Xv%3A%3A391434471%3A0-0-36ad1db-0%3ACAASEJLjEmkT9yq5QzzH4jy_oDsaYMCq6tnpU4R2_wYnG3um9tMZE08JHEVTvs6A7S5IVBg7FJDCp8cLpwbgvXdAr-CR7tC2BW9oX9Jebq4N8fIgJdz-l_5SV81TnCYkNjtFtfUyKZc9f8eZviTRU3RkvG7WNg --onboarding-pages=import,security,vk,stats,shortcuts,backgrounds,ntp_settings "--ntp-settings={\"feedEnable\": true, \"searchEnable\": true, \"historyEnable\": true, \"noteEnable\": true, \"widgetMailEnable\": true, \"widgetOkEnable\": true}" --rmt-onboarding=https://browserdata.cdnmail.ru/atom_welcome_page/v2/ | C:\Users\admin\AppData\Local\Temp\mini_loader_scoped_dir_1582361906\atom.exe | atom.exe | |
User: admin Company: The Atom Authors Integrity Level: MEDIUM Description: Atom Installer Exit code: 0 Version: 6.0.0.156 | ||||
3932 | "C:\Users\admin\AppData\Local\Temp\CR_E032C.tmp\setup.exe" --install-archive="C:\Users\admin\AppData\Local\Temp\CR_E032C.tmp\CHROME.PACKED.7Z" --arf=1 --rfr=530000 --ga-tid=UA-122680070-1 --ga-cid= --usagestats=1 --ext_params=IVID=3aoqbm3a4g1v00000L0g94Xv%3A%3A391434471%3A0-0-36ad1db-0%3ACAASEJLjEmkT9yq5QzzH4jy_oDsaYMCq6tnpU4R2_wYnG3um9tMZE08JHEVTvs6A7S5IVBg7FJDCp8cLpwbgvXdAr-CR7tC2BW9oX9Jebq4N8fIgJdz-l_5SV81TnCYkNjtFtfUyKZc9f8eZviTRU3RkvG7WNg --onboarding-pages=import,security,vk,stats,shortcuts,backgrounds,ntp_settings "--ntp-settings={\"feedEnable\": true, \"searchEnable\": true, \"historyEnable\": true, \"noteEnable\": true, \"widgetMailEnable\": true, \"widgetOkEnable\": true}" --rmt-onboarding=https://browserdata.cdnmail.ru/atom_welcome_page/v2/ | C:\Users\admin\AppData\Local\Temp\CR_E032C.tmp\setup.exe | atom.exe | |
User: admin Company: The Atom Authors Integrity Level: MEDIUM Description: Atom Installer Exit code: 0 Version: 6.0.0.156 | ||||
2960 | C:\Users\admin\AppData\Local\Temp\CR_E032C.tmp\setup.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Mail.Ru\Atom\User Data\Crashpad" --url=https://browser.mail.ru/cr/report --annotation=ProductName=Atom --annotation=Version=6.0.0.156 --annotation=bid={09E4EB5E-06E5-43EB-99CE-65ACEAF20628} --annotation=plat=Win32 --initial-client-data=0x108,0x10c,0x110,0xf8,0x114,0xb38268,0xb38278,0xb38284 | C:\Users\admin\AppData\Local\Temp\CR_E032C.tmp\setup.exe | — | setup.exe |
User: admin Company: The Atom Authors Integrity Level: MEDIUM Description: Atom Installer Exit code: 0 Version: 6.0.0.156 | ||||
780 | "C:\Users\admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --installer-launcher --onboarding-pages=import,security,vk,stats,shortcuts,backgrounds,ntp_settings --ntp-settings="{\"feedEnable\": true, \"searchEnable\": true, \"historyEnable\": true, \"noteEnable\": true, \"widgetMailEnable\": true, \"widgetOkEnable\": true}" --rmt-onboarding=https://browserdata.cdnmail.ru/atom_welcome_page/v2/ | C:\Users\admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe | setup.exe | |
User: admin Company: The Atom Authors Integrity Level: MEDIUM Description: Atom Version: 6.0.0.156 | ||||
2244 | C:\Users\admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Mail.Ru\Atom\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\admin\AppData\Local\Mail.Ru\Atom\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Mail.Ru\Atom\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Mail.Ru\Atom\User Data" --url=https://browser.mail.ru/cr/report --annotation=ProductName=Atom --annotation=Version=6.0.0.156 --annotation=bid={09E4EB5E-06E5-43EB-99CE-65ACEAF20628} --annotation=plat=Win32 --initial-client-data=0x34,0x38,0x3c,0x30,0x40,0x6d36b8e8,0x6d36b8f8,0x6d36b904 | C:\Users\admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe | — | atom.exe |
User: admin Company: The Atom Authors Integrity Level: MEDIUM Description: Atom Version: 6.0.0.156 | ||||
852 | C:\Users\admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Mail.Ru\Atom\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Mail.Ru\Atom\User Data\Crashpad" --url=https://browser.mail.ru/cr/report --annotation=ProductName=Atom --annotation=Version=6.0.0.156 --annotation=bid={09E4EB5E-06E5-43EB-99CE-65ACEAF20628} --annotation=plat=Win32 --initial-client-data=0x70,0x74,0x78,0x6c,0x7c,0x3fe108,0x3fe118,0x3fe124 | C:\Users\admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe | — | atom.exe |
User: admin Company: The Atom Authors Integrity Level: MEDIUM Description: Atom Version: 6.0.0.156 | ||||
2720 | "C:\Users\admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=gpu-process --field-trial-handle=932,3403886789900735221,15442534131500474930,131072 --enable-features=VkMusic,VkNotify --disable-features=Channel,Dashboard,LocationBarPIP --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=14534527870524254798 --mojo-platform-channel-handle=944 --ignored=" --type=renderer " /prefetch:2 | C:\Users\admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe | — | atom.exe |
User: admin Company: The Atom Authors Integrity Level: LOW Description: Atom Exit code: 4 Version: 6.0.0.156 | ||||
1520 | "C:\Users\admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe" --type=utility --field-trial-handle=932,3403886789900735221,15442534131500474930,131072 --enable-features=VkMusic,VkNotify --disable-features=Channel,Dashboard,LocationBarPIP --lang=en-US --service-sandbox-type=network --service-request-channel-token=7023548535383578347 --mojo-platform-channel-handle=1380 /prefetch:8 | C:\Users\admin\AppData\Local\Mail.Ru\Atom\Application\atom.exe | atom.exe | |
User: admin Company: The Atom Authors Integrity Level: MEDIUM Description: Atom Version: 6.0.0.156 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2776 | atom.exe | C:\Users\admin\AppData\Local\Temp\mini_loader_scoped_dir_1582361906\atom.exe | — | |
MD5:— | SHA256:— | |||
2736 | atom.exe | C:\Users\admin\AppData\Local\Temp\CR_E032C.tmp\CHROME.PACKED.7Z | — | |
MD5:— | SHA256:— | |||
2736 | atom.exe | C:\Users\admin\AppData\Local\Temp\CR_E032C.tmp\SETUP.EX_ | — | |
MD5:— | SHA256:— | |||
2776 | atom.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\slide_interface[1] | image | |
MD5:FB7D1CA54AA962E620B75DF6BAFA1083 | SHA256:53753D0AD1EA986372809681DC3DB3C13D07646E2D92B068C970BFFC2B9D9BE4 | |||
2776 | atom.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\progress_marque[1] | image | |
MD5:DF6E70789325B6937D4057508FBE46E8 | SHA256:D1E7AD86AFAF755DE9514D0B486511227C3245E18C70D7997F261B0A08634EA0 | |||
2776 | atom.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\slide_setups[1] | image | |
MD5:20A7573C7045A4865C7014D79EA96084 | SHA256:4152C1C164C8C03CCF4706389CE48317FE7A26DBBB9514E90261FC113F50691C | |||
2776 | atom.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\styles[1] | text | |
MD5:35FE167F44965E30A2CAA7D8EDA41B95 | SHA256:88EFAD924B177F7CC65133B5C163652E72E1FE156F33072C576B047B1DA841EF | |||
2776 | atom.exe | C:\ProgramData\Mail.Ru\Id | text | |
MD5:B2720DC2F7C6321E82257AF2142D2C11 | SHA256:497D224FF0209DE02F9262DE115B20150895F1E785E46D578B7DCED1303ACA9E | |||
3932 | setup.exe | C:\Users\admin\AppData\Local\Mail.Ru\Atom\User Data\Crashpad\settings.dat | binary | |
MD5:EBA1857E78E6CE2765C7ECB82BB7C256 | SHA256:48AD198615094F5060C6BAAB66DA9F84080BC3E7EFC0F3F693E8418469D405B6 | |||
2776 | atom.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\slide_popup[1] | image | |
MD5:9CE641C8D07754F6D5BBEEF3D08745FC | SHA256:797CB53519D6E01EC335F0FA5BB4E60A4DCE8C0B77B82C34B45AC2DB60D8B4A1 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2776 | atom.exe | GET | 204 | 217.69.139.245:80 | http://mrds.mail.ru/update/2/version.txt?type=loader_downloaded&BID=%7B09E4EB5E-06E5-43EB-99CE-65ACEAF20628%7D&kind=atom&masterid=%7BB37EEC5F-529B-4ACB-BE05-00E22B10273C%7D&rfr=&newrfr=530000&os=6.1&ver=3.1.0.43&IVID=3aoqbm3a4g1v00000L0g94Xv%3A%3A391434471%3A0-0-36ad1db-0%3ACAASEJLjEmkT9yq5QzzH4jy_oDsaYMCq6tnpU4R2_wYnG3um9tMZE08JHEVTvs6A7S5IVBg7FJDCp8cLpwbgvXdAr-CR7tC2BW9oX9Jebq4N8fIgJdz-l_5SV81TnCYkNjtFtfUyKZc9f8eZviTRU3RkvG7WNg&send_stats=1 | RU | — | — | suspicious |
2776 | atom.exe | GET | 204 | 217.69.139.245:80 | http://mrds.mail.ru/update/2/version.txt?type=loader_finished&BID=%7B09E4EB5E-06E5-43EB-99CE-65ACEAF20628%7D&kind=atom&masterid=%7BB37EEC5F-529B-4ACB-BE05-00E22B10273C%7D&rfr=&newrfr=530000&os=6.1&ver=3.1.0.43&IVID=3aoqbm3a4g1v00000L0g94Xv%3A%3A391434471%3A0-0-36ad1db-0%3ACAASEJLjEmkT9yq5QzzH4jy_oDsaYMCq6tnpU4R2_wYnG3um9tMZE08JHEVTvs6A7S5IVBg7FJDCp8cLpwbgvXdAr-CR7tC2BW9oX9Jebq4N8fIgJdz-l_5SV81TnCYkNjtFtfUyKZc9f8eZviTRU3RkvG7WNg&send_stats=1&system_code=0&exit_code=0 | RU | — | — | suspicious |
2776 | atom.exe | GET | 204 | 217.69.139.245:80 | http://mrds.mail.ru/update/2/version.txt?type=loader_run&BID=%7B09E4EB5E-06E5-43EB-99CE-65ACEAF20628%7D&kind=atom&masterid=%7BB37EEC5F-529B-4ACB-BE05-00E22B10273C%7D&rfr=&newrfr=530000&os=6.1&ver=3.1.0.43&IVID=3aoqbm3a4g1v00000L0g94Xv%3A%3A391434471%3A0-0-36ad1db-0%3ACAASEJLjEmkT9yq5QzzH4jy_oDsaYMCq6tnpU4R2_wYnG3um9tMZE08JHEVTvs6A7S5IVBg7FJDCp8cLpwbgvXdAr-CR7tC2BW9oX9Jebq4N8fIgJdz-l_5SV81TnCYkNjtFtfUyKZc9f8eZviTRU3RkvG7WNg&send_stats=1&dsa=1 | RU | — | — | suspicious |
2776 | atom.exe | GET | 204 | 217.69.139.245:80 | http://mrds.mail.ru/update/2/version.txt?type=loader_install&BID=%7B09E4EB5E-06E5-43EB-99CE-65ACEAF20628%7D&kind=atom&masterid=%7BB37EEC5F-529B-4ACB-BE05-00E22B10273C%7D&rfr=&newrfr=530000&os=6.1&ver=3.1.0.43&IVID=3aoqbm3a4g1v00000L0g94Xv%3A%3A391434471%3A0-0-36ad1db-0%3ACAASEJLjEmkT9yq5QzzH4jy_oDsaYMCq6tnpU4R2_wYnG3um9tMZE08JHEVTvs6A7S5IVBg7FJDCp8cLpwbgvXdAr-CR7tC2BW9oX9Jebq4N8fIgJdz-l_5SV81TnCYkNjtFtfUyKZc9f8eZviTRU3RkvG7WNg&send_stats=1&statistic=0 | RU | — | — | suspicious |
1520 | atom.exe | GET | 200 | 151.139.128.14:80 | http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ2xvBYPgmu%2FP%2FmXiVKe%2BjES00TfwQU78EqlQwy2vtzMNyKE9gVS%2FcT6PgCEG8uQSIolB1kqNt7vj9%2B2M4%3D | US | der | 278 b | whitelisted |
3932 | setup.exe | GET | 200 | 2.21.242.187:80 | http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D | NL | der | 1.37 Kb | whitelisted |
1520 | atom.exe | GET | 200 | 151.139.128.14:80 | http://ocsp.trust-provider.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEHbYt4bR81JP7pU%2BcUA9mdU%3D | US | der | 471 b | whitelisted |
1520 | atom.exe | GET | 200 | 151.139.128.14:80 | http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQCA9WBtOhYrFDrcEvvowgZv | US | der | 314 b | whitelisted |
3932 | setup.exe | GET | 200 | 2.21.242.245:80 | http://ocsp.int-x3.letsencrypt.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgOxHUmOrqqGK%2FoNwNmTlfEYdQ%3D%3D | NL | der | 527 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1520 | atom.exe | 172.217.18.14:443 | www.google-analytics.com | Google Inc. | US | whitelisted |
2776 | atom.exe | 172.217.18.14:443 | www.google-analytics.com | Google Inc. | US | whitelisted |
1520 | atom.exe | 217.69.136.244:443 | bs.browser.mail.ru | Limited liability company Mail.Ru | RU | unknown |
2776 | atom.exe | 217.69.139.245:80 | mrds.mail.ru | Limited liability company Mail.Ru | RU | malicious |
2776 | atom.exe | 94.100.180.110:443 | browser.cdnmail.ru | Limited liability company Mail.Ru | RU | suspicious |
3932 | setup.exe | 217.69.136.244:443 | bs.browser.mail.ru | Limited liability company Mail.Ru | RU | unknown |
3932 | setup.exe | 2.21.242.187:80 | isrg.trustid.ocsp.identrust.com | Akamai International B.V. | NL | whitelisted |
1520 | atom.exe | 216.58.205.227:443 | www.gstatic.com | Google Inc. | US | whitelisted |
1520 | atom.exe | 94.100.180.197:443 | ad.mail.ru | Limited liability company Mail.Ru | RU | unknown |
1520 | atom.exe | 172.217.16.142:443 | redirector.gvt1.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
mrds.mail.ru |
| suspicious |
www.google-analytics.com |
| whitelisted |
browser.cdnmail.ru |
| suspicious |
bs.browser.mail.ru |
| unknown |
isrg.trustid.ocsp.identrust.com |
| whitelisted |
ocsp.int-x3.letsencrypt.org |
| whitelisted |
www.gstatic.com |
| whitelisted |
data.browser.mail.ru |
| unknown |
redirector.gvt1.com |
| whitelisted |
accounts.google.com |
| shared |