File name:

df747e0fca43337df68d9f74703caa9375c996bbfa32d27d4b2ca0fca264163d

Full analysis: https://app.any.run/tasks/920ae0df-c422-4f31-9b52-fef9f93329d7
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Analysis date: December 06, 2018, 08:20:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

C47B4AD0C8F869C9F1EA9250DD1F9666

SHA1:

132F808D4C6E7818B5E0866FA5FFEE1D76F32D96

SHA256:

DF747E0FCA43337DF68D9F74703CAA9375C996BBFA32D27D4B2CA0FCA264163D

SSDEEP:

24576:hd09Gmemf0zDyPFo5zxuH1TnoKInSsieUcgIwVdNNfNdiX7pkuk01dkJ5V+1T:Pycmf0zDyPC5QtynSrBIwVFfNdIHk9o

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Changes the autorun value in the registry

      • df747e0fca43337df68d9f74703caa9375c996bbfa32d27d4b2ca0fca264163d.exe (PID: 3124)
    • Loads dropped or rewritten executable

      • df747e0fca43337df68d9f74703caa9375c996bbfa32d27d4b2ca0fca264163d.exe (PID: 3124)
    • Application was dropped or rewritten from another process

      • Email Access Online.exe (PID: 2880)
    • Connects to CnC server

      • Email Access Online.exe (PID: 2880)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • df747e0fca43337df68d9f74703caa9375c996bbfa32d27d4b2ca0fca264163d.exe (PID: 3124)
    • Creates a software uninstall entry

      • df747e0fca43337df68d9f74703caa9375c996bbfa32d27d4b2ca0fca264163d.exe (PID: 3124)
      • Email Access Online.exe (PID: 2880)
    • Reads Internet Cache Settings

      • Email Access Online.exe (PID: 2880)
    • Starts Internet Explorer

      • Email Access Online.exe (PID: 2880)
    • Reads internet explorer settings

      • Email Access Online.exe (PID: 2880)
  • INFO

    • Changes internet zones settings

      • IEXPLORE.EXE (PID: 3516)
    • Application launched itself

      • IEXPLORE.EXE (PID: 3516)
    • Reads Internet Cache Settings

      • IEXPLORE.EXE (PID: 3964)
    • Reads internet explorer settings

      • IEXPLORE.EXE (PID: 3964)
    • Creates files in the user directory

      • IEXPLORE.EXE (PID: 3964)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:10:17 10:31:53+02:00
PEType: PE32
LinkerVersion: 6
CodeSize: 25088
InitializedDataSize: 147968
UninitializedDataSize: 2048
EntryPoint: 0x33b6
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.29.0.33
ProductVersionNumber: 2.29.0.33
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: ASCII
CompanyName: Springtech Ltd
FileDescription: Desktop web search
FileVersion: 2.29.0.33
LegalCopyright: (c) 2018 Springtech Ltd
OriginalFileName: SBInstaller
ProductName: Desktop Search Bar
ProductVersion: 2.29.0.33

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 17-Oct-2018 08:31:53
Detected languages:
  • English - United States
CompanyName: Springtech Ltd
FileDescription: Desktop web search
FileVersion: 2.29.0.33
LegalCopyright: (c) 2018 Springtech Ltd
OriginalFilename: SBInstaller
ProductName: Desktop Search Bar
ProductVersion: 2.29.0.33

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000C8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 17-Oct-2018 08:31:53
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0000615D
0x00006200
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.45023
.rdata
0x00008000
0x000013A4
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.163
.data
0x0000A000
0x00020338
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.9824
.ndata
0x0002B000
0x00026000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00051000
0x000100D6
0x00010200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.39237

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.29536
1058
UNKNOWN
English - United States
RT_MANIFEST
2
4.95971
9640
UNKNOWN
English - United States
RT_ICON
3
5.17657
4264
UNKNOWN
English - United States
RT_ICON
4
6.06862
3752
UNKNOWN
English - United States
RT_ICON
5
6.38338
2216
UNKNOWN
English - United States
RT_ICON
6
6.0562
1384
UNKNOWN
English - United States
RT_ICON
7
5.85803
1128
UNKNOWN
English - United States
RT_ICON
103
2.71858
104
UNKNOWN
English - United States
RT_GROUP_ICON
105
2.73893
514
UNKNOWN
English - United States
RT_DIALOG
106
2.91148
248
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start df747e0fca43337df68d9f74703caa9375c996bbfa32d27d4b2ca0fca264163d.exe email access online.exe iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2880"C:\Users\admin\AppData\Local\Email Access Online\Email Access Online.exe" /firstrunC:\Users\admin\AppData\Local\Email Access Online\Email Access Online.exe
df747e0fca43337df68d9f74703caa9375c996bbfa32d27d4b2ca0fca264163d.exe
User:
admin
Company:
Springtech LTD
Integrity Level:
MEDIUM
Description:
Desktop web search
Exit code:
0
Version:
2.29.0.33
Modules
Images
c:\users\admin\appdata\local\email access online\email access online.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wininet.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3124"C:\Users\admin\AppData\Local\Temp\df747e0fca43337df68d9f74703caa9375c996bbfa32d27d4b2ca0fca264163d.exe" C:\Users\admin\AppData\Local\Temp\df747e0fca43337df68d9f74703caa9375c996bbfa32d27d4b2ca0fca264163d.exe
explorer.exe
User:
admin
Company:
Springtech Ltd
Integrity Level:
MEDIUM
Description:
Desktop web search
Exit code:
0
Version:
2.29.0.33
Modules
Images
c:\users\admin\appdata\local\temp\df747e0fca43337df68d9f74703caa9375c996bbfa32d27d4b2ca0fca264163d.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3516"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://results.hemailaccessonline.com/s?uid=7ce42b2c-83ca-4350-9603-a9aaeee50b9a&uc=20181017&source=-lp0-bb8-sbe&i_id=email_&ap=appfocus1C:\Program Files\Internet Explorer\IEXPLORE.EXE
Email Access Online.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3964"C:\Program Files\Internet Explorer\IEXPLORE.EXE" SCODEF:3516 CREDAT:71937C:\Program Files\Internet Explorer\IEXPLORE.EXE
IEXPLORE.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
957
Read events
868
Write events
89
Delete events
0

Modification events

(PID) Process:(3124) df747e0fca43337df68d9f74703caa9375c996bbfa32d27d4b2ca0fca264163d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Email Access Online
Value:
"C:\Users\admin\AppData\Local\Email Access Online\Email Access Online.exe" /delay 0
(PID) Process:(3124) df747e0fca43337df68d9f74703caa9375c996bbfa32d27d4b2ca0fca264163d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Email Access Online
Operation:writeName:UninstallImp
Value:
{"ae":"1","cid":"","domain":"hemailaccessonline.com","iid":"bio-sbe-email","partner":"appfocus1","source":"-lp0-bb8-sbe","ua":"Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F64.0.3282.140%20Safari%2F537.36%20Edge%2F17.17134","uc":"20181017","uid":"7ce42b2c-83ca-4350-9603-a9aaeee50b9a"}
(PID) Process:(3124) df747e0fca43337df68d9f74703caa9375c996bbfa32d27d4b2ca0fca264163d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Email Access Online
Operation:writeName:DisplayIcon
Value:
C:\Users\admin\AppData\Local\Email Access Online\Email Access Online.exe,3
(PID) Process:(3124) df747e0fca43337df68d9f74703caa9375c996bbfa32d27d4b2ca0fca264163d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Email Access Online
Operation:writeName:DisplayName
Value:
Email Access Online
(PID) Process:(3124) df747e0fca43337df68d9f74703caa9375c996bbfa32d27d4b2ca0fca264163d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Email Access Online
Operation:writeName:UninstallString
Value:
"C:\Users\admin\AppData\Local\Email Access Online\uninstall.exe" Email Access Online
(PID) Process:(3124) df747e0fca43337df68d9f74703caa9375c996bbfa32d27d4b2ca0fca264163d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Email Access Online
Operation:writeName:Publisher
Value:
Springtech Ltd
(PID) Process:(3124) df747e0fca43337df68d9f74703caa9375c996bbfa32d27d4b2ca0fca264163d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Email Access Online
Operation:writeName:NoModify
Value:
1
(PID) Process:(3124) df747e0fca43337df68d9f74703caa9375c996bbfa32d27d4b2ca0fca264163d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Email Access Online
Operation:writeName:NoRepair
Value:
1
(PID) Process:(3124) df747e0fca43337df68d9f74703caa9375c996bbfa32d27d4b2ca0fca264163d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Email Access Online
Operation:writeName:InstallLocation
Value:
C:\Users\admin\AppData\Local\Email Access Online
(PID) Process:(3124) df747e0fca43337df68d9f74703caa9375c996bbfa32d27d4b2ca0fca264163d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Email Access Online
Operation:writeName:DisplayVersion
Value:
2.29.0.33
Executable files
5
Suspicious files
5
Text files
42
Unknown types
4

Dropped files

PID
Process
Filename
Type
3124df747e0fca43337df68d9f74703caa9375c996bbfa32d27d4b2ca0fca264163d.exeC:\Users\admin\AppData\Local\Temp\nsyAB29.tmp
MD5:
SHA256:
3124df747e0fca43337df68d9f74703caa9375c996bbfa32d27d4b2ca0fca264163d.exeC:\Users\admin\Desktop\Email Access Online .lnklnk
MD5:
SHA256:
2880Email Access Online.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\main_ie8[1]text
MD5:
SHA256:
3124df747e0fca43337df68d9f74703caa9375c996bbfa32d27d4b2ca0fca264163d.exeC:\Users\admin\AppData\Local\Temp\nsyAB2A.tmp\System.dllexecutable
MD5:A4DD044BCD94E9B3370CCF095B31F896
SHA256:2E226715419A5882E2E14278940EE8EF0AA648A3EF7AF5B3DC252674111962BC
2880Email Access Online.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D2YPIJ90\jquery_min[1]text
MD5:FCCABBF104532F62133F4B97D0059987
SHA256:86392CFF7D3B950BB824BBA8718F02EC166983B8A49CE44A9A007FE3A6625443
2880Email Access Online.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D2YPIJ90\settings[1]image
MD5:17B290EF12213BC690A8B7C137B98CE8
SHA256:786F7CBA8AADD887D4788D6287A9E1A35D3340B725B385941D481C654BE72228
2880Email Access Online.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\style[1]text
MD5:72C0ABC6A8296A73C14ED3456719A9CB
SHA256:378DD789A9CF11C9F37F7AF09A757EADAA6CE5E4FDB6011967B91DC497C729E2
3124df747e0fca43337df68d9f74703caa9375c996bbfa32d27d4b2ca0fca264163d.exeC:\Users\admin\AppData\Local\Email Access Online\Email Access Online.exeexecutable
MD5:8052003E500E26D2C4C0659CF06FC246
SHA256:2908A84AA26483BCACCB06F6F2C8F9C97A70ED45927DF43DD48F04CAA16F6DD0
3964IEXPLORE.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@hemailaccessonline[2].txt
MD5:
SHA256:
3516IEXPLORE.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D2YPIJ90\favicon[1].ico
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
23
DNS requests
12
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2880
Email Access Online.exe
GET
404
158.85.63.182:80
http://getsearchbar.com/Content/kits/SBVersion.json?distSubId3=2.29.0.33
US
html
215 b
suspicious
2880
Email Access Online.exe
GET
200
172.217.168.34:80
http://pagead2.googlesyndication.com/pagead/js/r20180910/r20180604/show_ads_impl.js
US
text
74.5 Kb
whitelisted
3964
IEXPLORE.EXE
GET
302
52.20.188.76:80
http://results.hemailaccessonline.com/s?uid=7ce42b2c-83ca-4350-9603-a9aaeee50b9a&uc=20181017&source=-lp0-bb8-sbe&i_id=email_&ap=appfocus1
US
html
249 b
malicious
2880
Email Access Online.exe
GET
200
52.0.149.84:80
http://imp.hemailaccessonline.com/impression.do?event=ex_installed&useragent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F64.0.3282.140%20Safari%2F537.36%20Edge%2F17.17134&user_id=7ce42b2c-83ca-4350-9603-a9aaeee50b9a&source=-lp0-bb8-sbe&traffic_source=appfocus1&subid=20181017&implementation_id=email_
US
image
109 b
malicious
2880
Email Access Online.exe
GET
200
52.0.149.84:80
http://imp.hemailaccessonline.com/impression.do?event=sbe_alive&useragent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F64.0.3282.140%20Safari%2F537.36%20Edge%2F17.17134&user_id=7ce42b2c-83ca-4350-9603-a9aaeee50b9a&source=-lp0-bb8-sbe&traffic_source=appfocus1&subid=20181017&implementation_id=email_&subid2=2.29.0.33
US
image
109 b
malicious
2880
Email Access Online.exe
GET
200
158.85.63.182:80
http://getsearchbar.com/Content/kits/rotate_strings.json?_=1544084503418
US
text
401 b
suspicious
3964
IEXPLORE.EXE
GET
302
52.20.188.76:80
http://results.hemailaccessonline.com/?uc=20181017&ap=appfocus1&source=-lp0-bb8-sbe&uid=7ce42b2c-83ca-4350-9603-a9aaeee50b9a&i_id=email_1&page=newtab
US
html
287 b
malicious
3964
IEXPLORE.EXE
GET
200
205.185.216.10:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
55.2 Kb
whitelisted
3964
IEXPLORE.EXE
GET
200
52.222.146.67:80
http://x.ss2.us/x.cer
US
der
1.27 Kb
whitelisted
3516
IEXPLORE.EXE
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2880
Email Access Online.exe
158.85.63.182:80
getsearchbar.com
SoftLayer Technologies Inc.
US
unknown
2880
Email Access Online.exe
172.217.168.34:80
pagead2.googlesyndication.com
Google Inc.
US
whitelisted
2880
Email Access Online.exe
52.0.149.84:80
imp.hemailaccessonline.com
Amazon.com, Inc.
US
malicious
2880
Email Access Online.exe
172.217.168.34:443
pagead2.googlesyndication.com
Google Inc.
US
whitelisted
3964
IEXPLORE.EXE
52.20.188.76:80
results.hemailaccessonline.com
Amazon.com, Inc.
US
unknown
3964
IEXPLORE.EXE
172.217.168.35:443
www.gstatic.com
Google Inc.
US
whitelisted
3516
IEXPLORE.EXE
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3964
IEXPLORE.EXE
52.20.188.76:443
results.hemailaccessonline.com
Amazon.com, Inc.
US
unknown
3964
IEXPLORE.EXE
205.185.216.10:80
www.download.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
3964
IEXPLORE.EXE
34.230.251.181:443
imp.hemailaccessonline.com
Amazon.com, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
getsearchbar.com
  • 158.85.63.182
suspicious
imp.hemailaccessonline.com
  • 52.0.149.84
  • 34.230.251.181
unknown
pagead2.googlesyndication.com
  • 172.217.168.34
whitelisted
googleads.g.doubleclick.net
  • 172.217.168.34
whitelisted
results.hemailaccessonline.com
  • 52.20.188.76
  • 52.1.180.135
malicious
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
x.ss2.us
  • 52.222.146.67
  • 52.222.146.119
  • 52.222.146.120
  • 52.222.146.93
whitelisted
www.download.windowsupdate.com
  • 205.185.216.10
  • 205.185.216.10
  • 205.185.216.42
  • 205.185.216.10
whitelisted
d3ff8olul1r3ot.cloudfront.net
  • 52.222.146.165
  • 52.222.146.115
  • 52.222.146.103
  • 52.222.146.90
shared
www.gstatic.com
  • 172.217.168.35
whitelisted

Threats

PID
Process
Class
Message
2880
Email Access Online.exe
A Network Trojan was detected
SC ADWARE Adware.Spigot / Win32/Adware.BrowserIO - C&C checkin
2880
Email Access Online.exe
A Network Trojan was detected
SC ADWARE Adware.Spigot / Win32/Adware.BrowserIO - C&C checkin
No debug info