URL:

https://github.com/RattlesHyper/TrafficerMC/releases/download/v1.6/TrafficerMC.1.6.0-windows-x86.exe

Full analysis: https://app.any.run/tasks/d5d996cc-7eaa-4df8-8700-0224207f70bb
Verdict: Malicious activity
Analysis date: July 26, 2024, 13:13:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

1AC8605C840589DDC9DC710934F1DE96

SHA1:

F217B6421CEC2F42B9756312A17957A4EFD9B7F3

SHA256:

D6EF71EEB9CA33DB7CB797D40608098E806A9921F4E2257914DBBBD570C8B48A

SSDEEP:

3:N8tEdkRR4xIMHNJArkCmmXqDMHqTevnAdA:2uiRR4xI2MsmXqDJSn4A

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • TrafficerMC.1.6.0-windows-x86.exe (PID: 2200)
      • TrafficerMC.exe (PID: 4092)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • TrafficerMC.1.6.0-windows-x86.exe (PID: 2200)

    • Executable content was dropped or overwritten

      • TrafficerMC.1.6.0-windows-x86.exe (PID: 2200)

    • Drops 7-zip archiver for unpacking

      • TrafficerMC.1.6.0-windows-x86.exe (PID: 2200)

    • Process drops legitimate windows executable

      • TrafficerMC.1.6.0-windows-x86.exe (PID: 2200)

    • The process creates files with name similar to system file names

      • TrafficerMC.1.6.0-windows-x86.exe (PID: 2200)

    • Application launched itself

      • TrafficerMC.exe (PID: 4092)

    • Reads the Internet Settings

      • TrafficerMC.exe (PID: 4092)

    • Reads settings of System Certificates

      • TrafficerMC.exe (PID: 4092)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2676)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2676)

    • The process uses the downloaded file

      • iexplore.exe (PID: 2676)

    • Reads the computer name

      • TrafficerMC.1.6.0-windows-x86.exe (PID: 2200)
      • TrafficerMC.exe (PID: 2484)
      • TrafficerMC.exe (PID: 368)
      • TrafficerMC.exe (PID: 3756)
      • TrafficerMC.exe (PID: 3264)
      • TrafficerMC.exe (PID: 4092)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3788)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 3788)

    • Create files in a temporary directory

      • TrafficerMC.1.6.0-windows-x86.exe (PID: 2200)
      • TrafficerMC.exe (PID: 4092)

    • Checks supported languages

      • TrafficerMC.1.6.0-windows-x86.exe (PID: 2200)
      • TrafficerMC.exe (PID: 2484)
      • TrafficerMC.exe (PID: 368)
      • TrafficerMC.exe (PID: 3052)
      • TrafficerMC.exe (PID: 3756)
      • TrafficerMC.exe (PID: 3264)
      • TrafficerMC.exe (PID: 4092)

    • Reads Environment values

      • TrafficerMC.exe (PID: 4092)
      • TrafficerMC.exe (PID: 3052)
      • TrafficerMC.exe (PID: 3264)

    • Reads product name

      • TrafficerMC.exe (PID: 4092)
      • TrafficerMC.exe (PID: 3052)
      • TrafficerMC.exe (PID: 3264)

    • Creates files or folders in the user directory

      • TrafficerMC.exe (PID: 4092)
      • TrafficerMC.exe (PID: 368)
      • TrafficerMC.exe (PID: 3052)

    • Process checks computer location settings

      • TrafficerMC.exe (PID: 3052)
      • TrafficerMC.exe (PID: 4092)
      • TrafficerMC.exe (PID: 3264)

    • Reads the machine GUID from the registry

      • TrafficerMC.exe (PID: 4092)
      • TrafficerMC.1.6.0-windows-x86.exe (PID: 2200)

    • Reads the software policy settings

      • TrafficerMC.exe (PID: 4092)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
9
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe trafficermc.1.6.0-windows-x86.exe trafficermc.exe no specs trafficermc.exe no specs trafficermc.exe trafficermc.exe no specs trafficermc.exe no specs trafficermc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
368"C:\Users\admin\AppData\Local\Temp\2BdmL2kTzYZ43JE819YeV9x5k49\TrafficerMC.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\admin\AppData\Roaming\trafficermc" --mojo-platform-channel-handle=1280 --field-trial-handle=1036,i,3591516584042617913,15022191255830436020,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8C:\Users\admin\AppData\Local\Temp\2BdmL2kTzYZ43JE819YeV9x5k49\TrafficerMC.exe
TrafficerMC.exe
User:
admin
Company:
RattlesHyper
Integrity Level:
MEDIUM
Description:
TrafficerMC
Version:
1.6.0
Modules
Images
c:\users\admin\appdata\local\temp\2bdml2ktzyz43je819yev9x5k49\trafficermc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\2bdml2ktzyz43je819yev9x5k49\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
2200"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\TrafficerMC.1.6.0-windows-x86.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\TrafficerMC.1.6.0-windows-x86.exe
iexplore.exe
User:
admin
Company:
RattlesHyper
Integrity Level:
MEDIUM
Description:
A Minecraft botting tool with Anti-AFK, Chat spammer, Inventory/Chest manager features.
Version:
1.6.0
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\trafficermc.1.6.0-windows-x86.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2484"C:\Users\admin\AppData\Local\Temp\2BdmL2kTzYZ43JE819YeV9x5k49\TrafficerMC.exe" --type=gpu-process --user-data-dir="C:\Users\admin\AppData\Roaming\trafficermc" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=964 --field-trial-handle=1036,i,3591516584042617913,15022191255830436020,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2C:\Users\admin\AppData\Local\Temp\2BdmL2kTzYZ43JE819YeV9x5k49\TrafficerMC.exe—TrafficerMC.exe
User:
admin
Company:
RattlesHyper
Integrity Level:
LOW
Description:
TrafficerMC
Exit code:
0
Version:
1.6.0
Modules
Images
c:\users\admin\appdata\local\temp\2bdml2ktzyz43je819yev9x5k49\trafficermc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\2bdml2ktzyz43je819yev9x5k49\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
2676"C:\Program Files\Internet Explorer\iexplore.exe" "https://github.com/RattlesHyper/TrafficerMC/releases/download/v1.6/TrafficerMC.1.6.0-windows-x86.exe"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3052"C:\Users\admin\AppData\Local\Temp\2BdmL2kTzYZ43JE819YeV9x5k49\TrafficerMC.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Roaming\trafficermc" --app-path="C:\Users\admin\AppData\Local\Temp\2BdmL2kTzYZ43JE819YeV9x5k49\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=1524 --field-trial-handle=1036,i,3591516584042617913,15022191255830436020,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1C:\Users\admin\AppData\Local\Temp\2BdmL2kTzYZ43JE819YeV9x5k49\TrafficerMC.exe—TrafficerMC.exe
User:
admin
Company:
RattlesHyper
Integrity Level:
MEDIUM
Description:
TrafficerMC
Version:
1.6.0
Modules
Images
c:\users\admin\appdata\local\temp\2bdml2ktzyz43je819yev9x5k49\trafficermc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\2bdml2ktzyz43je819yev9x5k49\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
3264"C:\Users\admin\AppData\Local\Temp\2BdmL2kTzYZ43JE819YeV9x5k49\TrafficerMC.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Roaming\trafficermc" --app-path="C:\Users\admin\AppData\Local\Temp\2BdmL2kTzYZ43JE819YeV9x5k49\resources\app.asar" --no-sandbox --no-zygote --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1648 --field-trial-handle=1036,i,3591516584042617913,15022191255830436020,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1C:\Users\admin\AppData\Local\Temp\2BdmL2kTzYZ43JE819YeV9x5k49\TrafficerMC.exe—TrafficerMC.exe
User:
admin
Company:
RattlesHyper
Integrity Level:
MEDIUM
Description:
TrafficerMC
Version:
1.6.0
Modules
Images
c:\users\admin\appdata\local\temp\2bdml2ktzyz43je819yev9x5k49\trafficermc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\2bdml2ktzyz43je819yev9x5k49\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
3756"C:\Users\admin\AppData\Local\Temp\2BdmL2kTzYZ43JE819YeV9x5k49\TrafficerMC.exe" --type=gpu-process --user-data-dir="C:\Users\admin\AppData\Roaming\trafficermc" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1248 --field-trial-handle=1036,i,3591516584042617913,15022191255830436020,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2C:\Users\admin\AppData\Local\Temp\2BdmL2kTzYZ43JE819YeV9x5k49\TrafficerMC.exe—TrafficerMC.exe
User:
admin
Company:
RattlesHyper
Integrity Level:
LOW
Description:
TrafficerMC
Version:
1.6.0
Modules
Images
c:\users\admin\appdata\local\temp\2bdml2ktzyz43je819yev9x5k49\trafficermc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\2bdml2ktzyz43je819yev9x5k49\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
3788"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2676 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
4092C:\Users\admin\AppData\Local\Temp\2BdmL2kTzYZ43JE819YeV9x5k49\TrafficerMC.exe C:\Users\admin\AppData\Local\Temp\2BdmL2kTzYZ43JE819YeV9x5k49\TrafficerMC.exe—TrafficerMC.1.6.0-windows-x86.exe
User:
admin
Company:
RattlesHyper
Integrity Level:
MEDIUM
Description:
TrafficerMC
Version:
1.6.0
Modules
Images
c:\users\admin\appdata\local\temp\2bdml2ktzyz43je819yev9x5k49\trafficermc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\2bdml2ktzyz43je819yev9x5k49\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
Total events
26 099
Read events
25 994
Write events
90
Delete events
15

Modification events

(PID) Process:(2676) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2676) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(2676) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31121245
(PID) Process:(2676) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(2676) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31121245
(PID) Process:(2676) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2676) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2676) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2676) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2676) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
22
Suspicious files
114
Text files
18
Unknown types
55

Dropped files

PID
Process
Filename
Type
3788iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\TrafficerMC.1.6.0-windows-x86.exe.0o53ynx.partial —
MD5:—
SHA256:—
2676iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\TrafficerMC.1.6.0-windows-x86.exe —
MD5:—
SHA256:—
2200TrafficerMC.1.6.0-windows-x86.exeC:\Users\admin\AppData\Local\Temp\nsaA31F.tmp\app-32.7z —
MD5:—
SHA256:—
3788iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:5B827327E8361070C156449F7F0ACC0C
SHA256:4530FEE36BB750AF9CCFD4766AB4D03F958ABC25F9AC0EB30792289E7A56A893
3788iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25binary
MD5:7232B107500C9F178C96A0BE37764A96
SHA256:069B02940B9832AA9F77B0CC78CEDE00F413B92C35B585AEBE9B2D60A70907A7
3788iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90der
MD5:116E2E525D151EF225B8918992AAF542
SHA256:162DFC2AEE189004AF5C6186F004D7A909337BE21E0CD81DFF66B8BA19C0888A
2200TrafficerMC.1.6.0-windows-x86.exeC:\Users\admin\AppData\Local\Temp\nsaA31F.tmp\7z-out\icudtl.dat —
MD5:—
SHA256:—
3788iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A66A8DB907BADC9D16AD67B2FBFFDD5Cbinary
MD5:6341FF58B8AE9E7BF6C22F92E20B39B7
SHA256:9748F6869033070426C901F752248F32541FC647A8646C1E5BDC91D0A3446373
2200TrafficerMC.1.6.0-windows-x86.exeC:\Users\admin\AppData\Local\Temp\nsaA31F.tmp\7z-out\LICENSES.chromium.html —
MD5:—
SHA256:—
2676iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\urlblockindex[1].binbinary
MD5:FA518E3DFAE8CA3A0E495460FD60C791
SHA256:775853600060162C4B4E5F883F9FD5A278E61C471B3EE1826396B6D129499AA7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
32
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3788
iexplore.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ%3D
unknown
—
—
whitelisted
3788
iexplore.exe
GET
304
23.32.238.74:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a19d47eb3acb618e
unknown
—
—
whitelisted
3788
iexplore.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd
unknown
—
—
whitelisted
3788
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
—
—
whitelisted
3788
iexplore.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPlNxcMEqnlIVyH5VuZ4lawhZX3QQU9oUKOxGG4QR9DqoLLNLuzGR7e64CEE4o94a2bBo7lCzSxA63QqU%3D
unknown
—
—
whitelisted
1372
svchost.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2676
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
1372
svchost.exe
GET
304
23.32.238.74:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33
unknown
—
—
whitelisted
2676
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1372
svchost.exe
GET
200
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1372
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1060
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
3788
iexplore.exe
140.82.121.4:443
github.com
GITHUB
US
unknown
3788
iexplore.exe
23.32.238.74:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3788
iexplore.exe
172.64.149.23:80
ocsp.comodoca.com
CLOUDFLARENET
US
unknown
3788
iexplore.exe
104.18.38.233:80
ocsp.comodoca.com
CLOUDFLARENET
—
shared
3788
iexplore.exe
185.199.111.133:443
objects.githubusercontent.com
FASTLY
US
unknown
3788
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.46
whitelisted
github.com
  • 140.82.121.4
shared
ctldl.windowsupdate.com
  • 23.32.238.74
  • 23.32.238.18
whitelisted
ocsp.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
ocsp.usertrust.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.sectigo.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
objects.githubusercontent.com
  • 185.199.111.133
  • 185.199.108.133
  • 185.199.110.133
  • 185.199.109.133
shared
ocsp.digicert.com
  • 192.229.221.95
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://github.com/RattlesHyper/TrafficerMC/releases/download/v1.6/TrafficerMC.1.6.0-windows-x86.exe