analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Flinks.mail.info-flyingblue.com%2Fctt%3Fm%3D19847941%26r%3DOTg5MDQyMTc1Mjc1S0%26b%3D0%26j%3DMjAxNDk5NzE3MQS2%26k%3Dl%3Dhertz0622%257Cs%3Dhertz0622%257Cz%3DMAIN%257Cv%3DReminder1%257Ct%3DBTN%257Co%3D%26kx%3D1%26kt%3D12%26kd%3Dhttps%253a%252f%252ft6c7gr.codesandbox.io%3Fdg%3Dgianluca.giannini%40snam.it&data=05%7C01%7Cgianluca.giannini%40snam.it%7Ca7b85fa07f2d41fd70df08da581c0f31%7C19646c181578452eb5fb8504eb919aaa%7C0%7C0%7C637919174775637977%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000%7C%7C%7C&sdata=4AiPSfF%2BJhtTKU4eV0S8TY1Vps%2FsHEwaalFpHmLNQXM%3D&reserved=0

Full analysis: https://app.any.run/tasks/a99e707c-3033-4403-8dc7-9ec2ccca5d12
Verdict: Malicious activity
Analysis date: June 27, 2022, 09:49:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

9F1ECB9C002AF729F778890AD5EE5BDE

SHA1:

AB3926D1CB7AAEFA615CF3921B1DA1588FFB9B66

SHA256:

F1AA563854519C3AF2A6A66A01DFC85B74DB912C208C8D78F3EB8F9AED4E39FF

SSDEEP:

12:2yqxuL/Jrb4a+8AYmnauygCvNCX/CdJrMjKP7RT8IN2:2yqALx/4a+8QauMwXMIOP7uIN2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 4028)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 628)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 2480)
      • iexplore.exe (PID: 4028)
      • chrome.exe (PID: 628)
      • chrome.exe (PID: 2724)
      • chrome.exe (PID: 3024)
      • chrome.exe (PID: 1168)
      • chrome.exe (PID: 980)
      • chrome.exe (PID: 4056)
      • chrome.exe (PID: 3276)
      • chrome.exe (PID: 2604)
      • chrome.exe (PID: 3620)
      • chrome.exe (PID: 460)

    • Reads the computer name

      • iexplore.exe (PID: 2480)
      • iexplore.exe (PID: 4028)
      • chrome.exe (PID: 628)
      • chrome.exe (PID: 3024)
      • chrome.exe (PID: 1168)
      • chrome.exe (PID: 460)

    • Application launched itself

      • iexplore.exe (PID: 2480)
      • chrome.exe (PID: 628)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 4028)
      • iexplore.exe (PID: 2480)
      • chrome.exe (PID: 3024)

    • Changes internet zones settings

      • iexplore.exe (PID: 2480)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 4028)
      • iexplore.exe (PID: 2480)

    • Creates files in the user directory

      • iexplore.exe (PID: 4028)

    • Reads internet explorer settings

      • iexplore.exe (PID: 4028)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2480)

    • Manual execution by user

      • chrome.exe (PID: 628)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2480)

    • Reads the hosts file

      • chrome.exe (PID: 3024)
      • chrome.exe (PID: 628)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
12
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2480"C:\Program Files\Internet Explorer\iexplore.exe" "https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Flinks.mail.info-flyingblue.com%2Fctt%3Fm%3D19847941%26r%3DOTg5MDQyMTc1Mjc1S0%26b%3D0%26j%3DMjAxNDk5NzE3MQS2%26k%3Dl%3Dhertz0622%257Cs%3Dhertz0622%257Cz%3DMAIN%257Cv%3DReminder1%257Ct%3DBTN%257Co%3D%26kx%3D1%26kt%3D12%26kd%3Dhttps%253a%252f%252ft6c7gr.codesandbox.io%3Fdg%3Dgianluca.giannini%40snam.it&data=05%7C01%7Cgianluca.giannini%40snam.it%7Ca7b85fa07f2d41fd70df08da581c0f31%7C19646c181578452eb5fb8504eb919aaa%7C0%7C0%7C637919174775637977%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000%7C%7C%7C&sdata=4AiPSfF%2BJhtTKU4eV0S8TY1Vps%2FsHEwaalFpHmLNQXM%3D&reserved=0"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
4028"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2480 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
628"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe—Explorer.EXE
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\winmm.dll
c:\windows\system32\user32.dll
2724"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=86.0.4240.198 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x6e62d988,0x6e62d998,0x6e62d9a4C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
1168"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1032,9457582678827060487,2389961149554065277,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1052 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
3024"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1032,9457582678827060487,2389961149554065277,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1328 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
980"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1032,9457582678827060487,2389961149554065277,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1876 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
4056"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1032,9457582678827060487,2389961149554065277,131072 --enable-features=PasswordImport --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1308 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
3276"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1032,9457582678827060487,2389961149554065277,131072 --enable-features=PasswordImport --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2264 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
2604"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1032,9457582678827060487,2389961149554065277,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\gdi32.dll
Total events
19 547
Read events
19 386
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
27
Text files
46
Unknown types
19

Dropped files

PID
Process
Filename
Type
4028iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2F23D0F5E4D72862517E1CB26A329742_F6FACC49395CFA949BCE851E73323C49binary
MD5:0384497A14BC083908EF76E2293EA38B
SHA256:682C52EAD2300F03CA59FF4AD709394984EDEC67EC84CA56808C4E13BC4DC02C
4028iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\default~app~embed~sandbox~sandbox-startup.55b6cfc89.chunk[1].jstext
MD5:E08E9699AA4F46986C36743E6177B86D
SHA256:F9261B7BEF22B75CD1B292A76F3C72573761BBE7BAB8EF1D40BBA12AE3F986E9
4028iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2F23D0F5E4D72862517E1CB26A329742_F6FACC49395CFA949BCE851E73323C49der
MD5:146D41CD6125622138EBAC996AA72EDD
SHA256:E0D600F9C6B9745C7208513B5679676ADD60855CE4EC03B3A65E57E27F08448E
4028iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27der
MD5:FC887F7C5EF1EEAE3FB3BA651F77AC36
SHA256:5F98609231B96FC1ECFEFF757089F66D6A74BBE8FED6B33D83A799790484AA56
4028iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:A57BF137920DF87762FF61C99DF6ED12
SHA256:930D3FD4358340F439413DC503DA598D22499357FEDB80D8CA555DE9A8F2ECB8
4028iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\vendors~app~embed~sandbox~sandbox-startup.bcc15d438.chunk[1].jstext
MD5:16175E8908809DC296CB8852EB2D621E
SHA256:04D7ABA76EA78655E33E814070D24579DA91F68A78A2C026C6D58D5CDA8AEC3F
4028iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dbinary
MD5:250A7B425C24312220967918D77510E6
SHA256:243A9215129B98ED99A07328AAB18FD4BE1585E65571FA54DDC182EF0F1D2518
4028iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\CabA29F.tmpcompressed
MD5:308336E7F515478969B24C13DED11EDE
SHA256:889B832323726A9F10AD03F85562048FDCFE20C9FF6F9D37412CF477B4E92FF9
4028iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\sandbox-startup.5298fe502[1].jstext
MD5:767D48E79B438ADD0807B9DB1B1EABDB
SHA256:CF199D079FD65A1F6AA9C89176608A55B93DCCEACA9EBE5C4D24348A26023189
4028iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:221BF6960508640E0BA00CB704FF5D70
SHA256:F13338CFBE85BCA9C9DEE54E72275A6EAB1C835159CBA664CED7176440FD15B8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
77
DNS requests
29
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4028
iexplore.exe
GET
200
142.250.185.67:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCfB0sRdF8W%2FBIjdfpYeZPw
US
der
472 b
whitelisted
4028
iexplore.exe
GET
200
142.250.185.67:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFis5ZQLQXhkEp1TGjnLAGc%3D
US
der
471 b
whitelisted
4028
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
4028
iexplore.exe
GET
200
142.250.185.67:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
4028
iexplore.exe
GET
200
104.18.32.68:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEFCpZvUyqtwlIPQ0nPc6GBw%3D
US
der
471 b
whitelisted
4028
iexplore.exe
GET
200
142.250.185.67:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEESz3%2FmlG2yGCtBzjzp1dVc%3D
US
der
471 b
whitelisted
4028
iexplore.exe
GET
200
184.24.77.52:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgPoUqRrGgvKwnY07AUA%2BP3DZQ%3D%3D
US
der
503 b
shared
4028
iexplore.exe
GET
200
172.64.155.188:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
4028
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAGewca9P1l7sgwzOOVR2Hc%3D
US
der
471 b
whitelisted
4028
iexplore.exe
GET
200
142.250.185.67:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4028
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
4028
iexplore.exe
172.64.155.188:80
ocsp.usertrust.com
—
US
suspicious
4028
iexplore.exe
104.47.8.28:443
eur03.safelinks.protection.outlook.com
Microsoft Corporation
NL
whitelisted
4028
iexplore.exe
104.18.47.230:443
static.cloudflareinsights.com
Cloudflare Inc
US
malicious
2480
iexplore.exe
131.253.33.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
4028
iexplore.exe
172.64.144.239:443
t6c7gr.codesandbox.io
—
US
suspicious
2480
iexplore.exe
67.26.139.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
4028
iexplore.exe
67.26.139.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
4028
iexplore.exe
104.18.32.68:80
ocsp.usertrust.com
Cloudflare Inc
US
suspicious
4028
iexplore.exe
3.127.205.219:443
links.mail.info-flyingblue.com
—
US
malicious

DNS requests

Domain
IP
Reputation
eur03.safelinks.protection.outlook.com
  • 104.47.8.28
  • 104.47.9.28
whitelisted
ctldl.windowsupdate.com
  • 67.26.139.254
  • 8.238.30.126
  • 8.248.131.254
  • 8.241.9.126
  • 8.241.11.254
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 131.253.33.200
  • 13.107.22.200
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
links.mail.info-flyingblue.com
  • 3.127.205.219
malicious
ocsp.usertrust.com
  • 172.64.155.188
  • 104.18.32.68
whitelisted
ocsp.sectigo.com
  • 104.18.32.68
  • 172.64.155.188
whitelisted
t6c7gr.codesandbox.io
  • 172.64.144.239
  • 104.18.43.17
suspicious
codesandbox.io
  • 104.18.43.17
  • 172.64.144.239
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Flinks.mail.info-flyingblue.com%2Fctt%3Fm%3D19847941%26r%3DOTg5MDQyMTc1Mjc1S0%26b%3D0%26j%3DMjAxNDk5NzE3MQS2%26k%3Dl%3Dhertz0622%257Cs%3Dhertz0622%257Cz%3DMAIN%257Cv%3DReminder1%257Ct%3DBTN%257Co%3D%26kx%3D1%26kt%3D12%26kd%3Dhttps%253a%252f%252ft6c7gr.codesandbox.io%3Fdg%3Dgianluca.giannini%40snam.it&data=05%7C01%7Cgianluca.giannini%40snam.it%7Ca7b85fa07f2d41fd70df08da581c0f31%7C19646c181578452eb5fb8504eb919aaa%7C0%7C0%7C637919174775637977%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000%7C%7C%7C&sdata=4AiPSfF%2BJhtTKU4eV0S8TY1Vps%2FsHEwaalFpHmLNQXM%3D&reserved=0