URL:

https://telegra.ph/Download-File-04-23-2

Full analysis: https://app.any.run/tasks/cd8c2ecb-61b0-4aac-aef7-70b294424efa
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: July 16, 2022, 11:05:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
trojan
stealer
Indicators:
MD5:

5D823BF52A9992AAACCD532EA250D119

SHA1:

F3404064B7DA1EFEE6DCBA7E2311872DA5718948

SHA256:

F4C7AC8BF8965A8A690E0AD0D1AE93BC52560F317A5F75764A98CF1F6A4FC811

SSDEEP:

3:N8IXLt+wJWn:2IXLtrWn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 2724)
      • CheatArena.exe (PID: 2472)
      • chrome.exe (PID: 19832)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3628)

    • Application was dropped or rewritten from another process

      • Seoeth.exe (PID: 2096)
      • 1.exe (PID: 2368)

    • Actions looks like stealing of personal data

      • AppLaunch.exe (PID: 242132)

    • Steals credentials from Web Browsers

      • AppLaunch.exe (PID: 242132)

    • Stealing of credential data

      • AppLaunch.exe (PID: 242132)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 1716)
      • iexplore.exe (PID: 3040)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 4056)

    • Checks supported languages

      • wmplayer.exe (PID: 3776)
      • setup_wm.exe (PID: 3288)
      • WinRAR.exe (PID: 2724)
      • CheatArena.exe (PID: 2472)
      • 1.exe (PID: 2368)
      • Seoeth.exe (PID: 2096)
      • AppLaunch.exe (PID: 399632)
      • AppLaunch.exe (PID: 242132)

    • Reads the computer name

      • wmplayer.exe (PID: 3776)
      • setup_wm.exe (PID: 3288)
      • WinRAR.exe (PID: 2724)
      • CheatArena.exe (PID: 2472)
      • AppLaunch.exe (PID: 242132)

    • Reads Environment values

      • setup_wm.exe (PID: 3288)
      • AppLaunch.exe (PID: 242132)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2724)
      • CheatArena.exe (PID: 2472)
      • chrome.exe (PID: 19832)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 2724)
      • CheatArena.exe (PID: 2472)
      • chrome.exe (PID: 19832)

    • Creates files in the user directory

      • CheatArena.exe (PID: 2472)

    • Checks for external IP

      • AppLaunch.exe (PID: 242132)

    • Reads the cookies of Mozilla Firefox

      • AppLaunch.exe (PID: 242132)

    • Reads default file associations for system extensions

      • chrome.exe (PID: 9196)

    • Loads DLL from Mozilla Firefox

      • AppLaunch.exe (PID: 242132)

    • Reads CPU info

      • AppLaunch.exe (PID: 242132)

    • Searches for installed software

      • AppLaunch.exe (PID: 242132)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 3164)
      • iexplore.exe (PID: 1716)
      • chrome.exe (PID: 4056)
      • chrome.exe (PID: 2880)
      • chrome.exe (PID: 2524)
      • chrome.exe (PID: 2512)
      • chrome.exe (PID: 476)
      • chrome.exe (PID: 3824)
      • iexplore.exe (PID: 3040)
      • chrome.exe (PID: 268)
      • chrome.exe (PID: 1808)
      • chrome.exe (PID: 3616)
      • chrome.exe (PID: 1696)
      • chrome.exe (PID: 3740)
      • chrome.exe (PID: 3300)
      • chrome.exe (PID: 3896)
      • chrome.exe (PID: 4052)
      • chrome.exe (PID: 3412)
      • chrome.exe (PID: 1080)
      • chrome.exe (PID: 2904)
      • chrome.exe (PID: 4040)
      • chrome.exe (PID: 1268)
      • chrome.exe (PID: 2096)
      • chrome.exe (PID: 4068)
      • chrome.exe (PID: 1276)
      • chrome.exe (PID: 3656)
      • chrome.exe (PID: 2672)
      • chrome.exe (PID: 328)
      • chrome.exe (PID: 4088)
      • chrome.exe (PID: 368)
      • chrome.exe (PID: 360556)
      • chrome.exe (PID: 10812)
      • chrome.exe (PID: 5196)
      • chrome.exe (PID: 76760)
      • chrome.exe (PID: 11156)
      • chrome.exe (PID: 269660)
      • chrome.exe (PID: 76088)
      • chrome.exe (PID: 169892)
      • chrome.exe (PID: 395204)
      • chrome.exe (PID: 395496)
      • chrome.exe (PID: 9196)
      • chrome.exe (PID: 175792)
      • chrome.exe (PID: 5968)
      • chrome.exe (PID: 12236)
      • chrome.exe (PID: 7308)
      • chrome.exe (PID: 14500)
      • chrome.exe (PID: 19832)
      • chrome.exe (PID: 16416)
      • chrome.exe (PID: 18728)
      • chrome.exe (PID: 13012)
      • chrome.exe (PID: 21604)

    • Reads the computer name

      • iexplore.exe (PID: 3164)
      • iexplore.exe (PID: 1716)
      • chrome.exe (PID: 4056)
      • chrome.exe (PID: 2524)
      • chrome.exe (PID: 2880)
      • chrome.exe (PID: 1696)
      • iexplore.exe (PID: 3040)
      • chrome.exe (PID: 3740)
      • chrome.exe (PID: 1276)
      • chrome.exe (PID: 4088)
      • chrome.exe (PID: 368)
      • chrome.exe (PID: 360556)
      • chrome.exe (PID: 9196)
      • chrome.exe (PID: 7308)

    • Application launched itself

      • iexplore.exe (PID: 3164)
      • chrome.exe (PID: 4056)

    • Changes internet zones settings

      • iexplore.exe (PID: 3164)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 1716)
      • iexplore.exe (PID: 3164)
      • chrome.exe (PID: 2524)
      • iexplore.exe (PID: 3040)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1716)
      • iexplore.exe (PID: 3040)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 1716)
      • iexplore.exe (PID: 3164)
      • iexplore.exe (PID: 3040)

    • Manual execution by user

      • chrome.exe (PID: 4056)
      • wmplayer.exe (PID: 3776)
      • CheatArena.exe (PID: 2472)
      • WinRAR.exe (PID: 2724)

    • Reads the hosts file

      • chrome.exe (PID: 4056)
      • chrome.exe (PID: 2524)

    • Creates files in the user directory

      • iexplore.exe (PID: 3040)
      • iexplore.exe (PID: 3164)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3164)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3164)

    • Reads the date of Windows installation

      • chrome.exe (PID: 360556)

    • Dropped object may contain Bitcoin addresses

      • chrome.exe (PID: 4056)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
104
Monitored processes
60
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start iexplore.exe iexplore.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs iexplore.exe wmplayer.exe no specs setup_wm.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winrar.exe searchprotocolhost.exe no specs cheatarena.exe 1.exe no specs seoeth.exe no specs chrome.exe no specs chrome.exe no specs applaunch.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs applaunch.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
268"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1024,4536328566861488517,14616976342039278484,131072 --enable-features=PasswordImport --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1948 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
328"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1024,4536328566861488517,14616976342039278484,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4692 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
368"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1024,4536328566861488517,14616976342039278484,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1704 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\gdi32.dll
476"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1024,4536328566861488517,14616976342039278484,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1928 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
1080"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1024,4536328566861488517,14616976342039278484,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2192 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
1268"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1024,4536328566861488517,14616976342039278484,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
1276"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1024,4536328566861488517,14616976342039278484,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4684 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\version.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
1696"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1024,4536328566861488517,14616976342039278484,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1276 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
1716"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3164 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\version.dll
1808"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1024,4536328566861488517,14616976342039278484,131072 --enable-features=PasswordImport --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2272 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
Total events
49 300
Read events
48 640
Write events
643
Delete events
17

Modification events

(PID) Process:(3164) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3164) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3164) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30972163
(PID) Process:(3164) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
279832706
(PID) Process:(3164) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30972164
(PID) Process:(3164) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3164) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3164) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3164) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3164) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
5
Suspicious files
247
Text files
271
Unknown types
53

Dropped files

PID
Process
Filename
Type
1716iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
1716iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771der
MD5:—
SHA256:—
1716iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\Download-File-04-23-2[1].htmhtml
MD5:—
SHA256:—
1716iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2Dder
MD5:—
SHA256:—
1716iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\630487363B056DDFB759CD38C3E1B65A_3DAC96173110C37A12CADACBD346CE32binary
MD5:—
SHA256:—
1716iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2Dbinary
MD5:—
SHA256:—
1716iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\630487363B056DDFB759CD38C3E1B65A_3DAC96173110C37A12CADACBD346CE32der
MD5:—
SHA256:—
1716iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771binary
MD5:—
SHA256:—
1716iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\jquery.min[1].jstext
MD5:8101D596B2B8FA35FE3A634EA342D7C3
SHA256:540BC6DEC1DD4B92EA4D3FB903F69EABF6D919AFD48F4E312B163C28CFF0F441
1716iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\quill.core.min[1].csstext
MD5:C109C41150B8C3FEB5CF8E349A6B05A4
SHA256:2D8806A9454F45E2C653E351411DCC6466D613AE1BBD9C44D3A31E052C5E511C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
61
TCP/UDP connections
193
DNS requests
106
Threats
13

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3040
iexplore.exe
GET
200
104.18.32.68:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
1.42 Kb
whitelisted
3040
iexplore.exe
GET
200
142.250.185.195:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
1716
iexplore.exe
GET
200
192.124.249.41:80
http://ocsp.godaddy.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQdI2%2BOBkuXH93foRUj4a7lAr4rGwQUOpqFBxBnKLbv9r0FQW4gwZTaD94CAQc%3D
US
der
1.69 Kb
whitelisted
1716
iexplore.exe
GET
200
192.124.249.41:80
http://ocsp.godaddy.com//MEowSDBGMEQwQjAJBgUrDgMCGgUABBS2CA1fbGt26xPkOKX4ZguoUjM0TgQUQMK9J47MNIMwojPX%2B2yz8LQsgM4CCQC2T6rhHiP0ng%3D%3D
US
der
1.74 Kb
whitelisted
3040
iexplore.exe
GET
200
108.138.2.173:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
1.70 Kb
whitelisted
3040
iexplore.exe
GET
200
142.250.185.195:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
3040
iexplore.exe
GET
200
172.64.155.188:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEBN9U5yqfDGppDNwGWiEeo0%3D
US
der
2.18 Kb
whitelisted
3040
iexplore.exe
GET
200
104.18.32.68:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCECsuburZdTZsFIpu26N8jAc%3D
US
der
2.18 Kb
whitelisted
1716
iexplore.exe
GET
200
192.124.249.41:80
http://ocsp.godaddy.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBTkIInKBAzXkF0Qh0pel3lfHJ9GPAQU0sSw0pHUTBFxs2HLPaH%2B3ahq1OMCAxvnFQ%3D%3D
US
der
1.66 Kb
whitelisted
3040
iexplore.exe
GET
200
142.250.185.195:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC8LbKC6DMw9BLG%2BP%2FsrywD
US
der
472 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1716
iexplore.exe
149.154.164.13:443
telegra.ph
Telegram Messenger LLP
GB
suspicious
1716
iexplore.exe
8.241.11.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
1716
iexplore.exe
192.124.249.41:80
ocsp.godaddy.com
Sucuri
US
suspicious
3164
iexplore.exe
149.154.164.13:443
telegra.ph
Telegram Messenger LLP
GB
suspicious
3164
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
1716
iexplore.exe
149.154.167.99:443
t.me
Telegram Messenger LLP
GB
malicious
3164
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2524
chrome.exe
142.250.186.173:443
accounts.google.com
Google Inc.
US
suspicious
2524
chrome.exe
142.250.184.195:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
2524
chrome.exe
142.250.185.228:443
www.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
telegra.ph
  • 149.154.164.13
malicious
ctldl.windowsupdate.com
  • 8.241.11.254
  • 8.248.149.254
  • 8.248.145.254
  • 67.26.137.254
  • 67.26.73.254
whitelisted
ocsp.godaddy.com
  • 192.124.249.41
  • 192.124.249.22
  • 192.124.249.23
  • 192.124.249.24
  • 192.124.249.36
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
t.me
  • 149.154.167.99
whitelisted
edit.telegra.ph
  • 149.154.164.13
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
clientservices.googleapis.com
  • 142.250.184.195
whitelisted
accounts.google.com
  • 142.250.186.173
shared

Threats

PID
Process
Class
Message
242132
AppLaunch.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup ip-api.com
242132
AppLaunch.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
242132
AppLaunch.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup ip-api.com
242132
AppLaunch.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
242132
AppLaunch.exe
A Network Trojan was detected
ET TROJAN Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
242132
AppLaunch.exe
A Network Trojan was detected
ET TROJAN Suspicious Zipped Filename in Outbound POST Request (passwords.txt) M2
242132
AppLaunch.exe
A Network Trojan was detected
ET TROJAN Suspicious Zipped Filename in Outbound POST Request (Passwords.txt) M2
242132
AppLaunch.exe
A Network Trojan was detected
ET INFO Observed Malicious Filename in Outbound POST Request (Information.txt)
242132
AppLaunch.exe
A Network Trojan was detected
ET TROJAN PennyWise Stealer Data Exfiltration
4 ETPRO signatures available at the full report
Process
Message
AppLaunch.exe
CLR: Managed code called FailFast without specifying a reason.
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://telegra.ph/Download-File-04-23-2