URL:

https://bazaar.abuse.ch/download/be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844/

Full analysis: https://app.any.run/tasks/ab3234ae-b44e-45fe-a2fc-15105d4c92e4
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: February 05, 2024, 16:02:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
wannacry
wannacryptor
Indicators:
MD5:

B806E353BC735168307450DA1614DB8A

SHA1:

9492C966C0E07B6FED8B01FE96FEAA4A10C7B79E

SHA256:

F55B51B302E3AC3D4A87D4D93F6EDDE536E373EEB4956E86D8444AC092872FE2

SSDEEP:

3:N8N0uDWB4SCG7PQtCRTBQwgtBt:23GzFOwit

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe (PID: 3868)

    • Wannacry exe files

      • !WannaDecryptor!.exe (PID: 2996)
      • !WannaDecryptor!.exe (PID: 968)
      • cmd.exe (PID: 1236)
      • !WannaDecryptor!.exe (PID: 3072)
      • !WannaDecryptor!.exe (PID: 2744)

    • WannaCry Ransomware is detected

      • be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe (PID: 3868)
      • cmd.exe (PID: 1236)

    • Writes a file to the Word startup folder

      • be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe (PID: 3868)

    • Modifies files in the Chrome extension folder

      • be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe (PID: 3868)

    • Actions looks like stealing of personal data

      • be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe (PID: 3868)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 3928)
      • be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe (PID: 3868)

    • Starts a Microsoft application from unusual location

      • be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe (PID: 3868)
      • !WannaDecryptor!.exe (PID: 2996)
      • !WannaDecryptor!.exe (PID: 968)
      • !WannaDecryptor!.exe (PID: 3072)
      • !WannaDecryptor!.exe (PID: 2744)

    • The process executes VB scripts

      • cmd.exe (PID: 2532)

    • Executable content was dropped or overwritten

      • be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe (PID: 3868)

    • Creates files like ransomware instruction

      • be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe (PID: 3868)

    • Executing commands from a ".bat" file

      • be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe (PID: 3868)

    • Starts CMD.EXE for commands execution

      • be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe (PID: 3868)

    • Uses TASKKILL.EXE to kill process

      • be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe (PID: 3868)

    • Reads the Internet Settings

      • !WannaDecryptor!.exe (PID: 2996)

  • INFO

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3928)

    • Application launched itself

      • iexplore.exe (PID: 1652)

    • The process uses the downloaded file

      • iexplore.exe (PID: 1652)
      • WinRAR.exe (PID: 3928)

    • Checks supported languages

      • be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe (PID: 3868)
      • wmpnscfg.exe (PID: 1644)
      • !WannaDecryptor!.exe (PID: 2996)
      • !WannaDecryptor!.exe (PID: 3072)
      • !WannaDecryptor!.exe (PID: 2744)
      • !WannaDecryptor!.exe (PID: 968)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3928)

    • Manual execution by a user

      • be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe (PID: 3868)
      • rundll32.exe (PID: 3960)
      • wmpnscfg.exe (PID: 1644)

    • Dropped object may contain TOR URL's

      • be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe (PID: 3868)

    • Reads the machine GUID from the registry

      • be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe (PID: 3868)

    • Reads the computer name

      • be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe (PID: 3868)
      • !WannaDecryptor!.exe (PID: 2996)
      • wmpnscfg.exe (PID: 1644)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 2912)

    • Creates files in the program directory

      • be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe (PID: 3868)

    • Creates files or folders in the user directory

      • be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe (PID: 3868)

    • Create files in a temporary directory

      • be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe (PID: 3868)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
68
Monitored processes
17
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe winrar.exe #WANNACRY be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe cmd.exe no specs cscript.exe no specs #WANNACRY !wannadecryptor!.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs rundll32.exe no specs wmpnscfg.exe no specs #WANNACRY cmd.exe no specs #WANNACRY !wannadecryptor!.exe no specs #WANNACRY !wannadecryptor!.exe no specs #WANNACRY !wannadecryptor!.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
968!WannaDecryptor!.exeC:\Users\admin\Desktop\!WannaDecryptor!.exe
be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Sync
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\desktop\!wannadecryptor!.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mfc42.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1236cmd.exe /c start /b !WannaDecryptor!.exe vC:\Windows\System32\cmd.exe
be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1644"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1652"C:\Program Files\Internet Explorer\iexplore.exe" "https://bazaar.abuse.ch/download/be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844/"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2532C:\Windows\system32\cmd.exe /c 117701707149021.batC:\Windows\System32\cmd.exe—be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2744!WannaDecryptor!.exe vC:\Users\admin\Desktop\!WannaDecryptor!.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Sync
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\desktop\!wannadecryptor!.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mfc42.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2912cscript //nologo c.vbsC:\Windows\System32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2996!WannaDecryptor!.exe fC:\Users\admin\Desktop\!WannaDecryptor!.exe
be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Sync
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\desktop\!wannadecryptor!.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mfc42.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3072!WannaDecryptor!.exe cC:\Users\admin\Desktop\!WannaDecryptor!.exe
be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Sync
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\desktop\!wannadecryptor!.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mfc42.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3080taskkill /f /im sqlserver.exeC:\Windows\System32\taskkill.exe—be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
Total events
19 519
Read events
19 406
Write events
105
Delete events
8

Modification events

(PID) Process:(1652) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(1652) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(1652) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(1652) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1652) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1652) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1652) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1652) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1652) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1652) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
4
Suspicious files
1 014
Text files
170
Unknown types
6

Dropped files

PID
Process
Filename
Type
3484iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:318BE669FE409526591F84AC9F82EA31
SHA256:3D7370B74C0FB39746DB529706E79B5F0194DDA26EAF8B47E667EC5858D18EC3
3484iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:D022364E647540F82682ADBC0BE0A7DD
SHA256:B9A18D9FD953A2F69B1E7D3F47B4A73E26B8A14A8C56BD9AC12712B331FE84F5
3484iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\bootstrap.min[1].jstext
MD5:61F338F870FCD0FF46362EF109D28533
SHA256:5AA53525ABC5C5200C70B3F6588388F86076CD699284C23CDA64E92C372A1548
3484iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_1C8038BAE9D4E52C4463A14FAB50BBA7binary
MD5:11ACAF1BFA1040968F63E9A278986D13
SHA256:37E5E5BD85F828387032689264748FC95DB6964D07533078641F69356A757738
3484iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\bootstrap.min[1].csstext
MD5:A15C2AC3234AA8F6064EF9C1F7383C37
SHA256:60B19E5DA6A9234FF9220668A5EC1125C157A268513256188EE80F2D2C8D8D36
3484iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_89709BA6A8E04CB298EC71539929CC6Dbinary
MD5:75350BAEC037C5B76E97465C2DEBA06C
SHA256:814CCABA178DF6BD3C350FA0669160CCF47B97E57F027D2CC03F39263505F41B
3484iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_89709BA6A8E04CB298EC71539929CC6Dbinary
MD5:20383E6A5BFB034D0EE72167CD193EE6
SHA256:91F3BA9E0A0D2E2069DB797884B9F4C68C9BC83B9EEB6836A134B5D9200D31AF
3484iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\jumbotron[1].csstext
MD5:0EF7EDC6BABEA5A47645BDA0C45368AA
SHA256:ADD38BACA7BBCCE0BCB6A9AFD59AC12F68D5075D3CF4745EFD627A365C2F4129
3484iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\jquery-3.5.1.min[1].jstext
MD5:DC5E7F18C8D36AC1D3D4753A87C98D0A
SHA256:F7F6A5894F1D19DDAD6FA392B2ECE2C5E578CBF7DA4EA805B6885EB6985B6E3D
3484iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\all.min[1].csstext
MD5:76CB46C10B6C0293433B371BAE2414B2
SHA256:876D023D9D10C97941B80C3B03E2A5B94631FF7A4AF9CEE5604A6A2D39718D84
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
44
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3484
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?98084960eae7a2ec
unknown
—
—
unknown
3484
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?83c23cd8118a42bc
unknown
—
—
unknown
3484
iexplore.exe
GET
200
151.101.66.133:80
http://ocsp2.globalsign.com/rootr3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCEH3wUWDKXSh7Z3b6AuDWurw%3D
unknown
binary
1.40 Kb
unknown
3484
iexplore.exe
GET
200
172.217.16.195:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
3484
iexplore.exe
GET
200
172.217.16.195:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBNRO0CFNoMoCn81RqoChws%3D
unknown
binary
471 b
unknown
3484
iexplore.exe
GET
200
172.217.16.195:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
binary
724 b
unknown
3484
iexplore.exe
GET
200
172.217.16.195:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEE80yiW5Mf2wCipGbb3nZn0%3D
unknown
binary
471 b
unknown
3484
iexplore.exe
GET
200
172.217.16.195:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDf%2FqechPhkiAm5teJWf%2BUv
unknown
binary
472 b
unknown
1652
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?95d95b669c097e41
unknown
—
—
unknown
1652
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5565915fab5f2bac
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
3484
iexplore.exe
151.101.2.49:443
bazaar.abuse.ch
FASTLY
US
unknown
3484
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
3484
iexplore.exe
151.101.66.133:80
ocsp2.globalsign.com
FASTLY
US
unknown
3484
iexplore.exe
142.250.185.136:443
www.googletagmanager.com
GOOGLE
US
unknown
3484
iexplore.exe
142.250.186.132:443
www.google.com
GOOGLE
US
whitelisted
3484
iexplore.exe
172.217.16.195:80
ocsp.pki.goog
GOOGLE
US
whitelisted
3484
iexplore.exe
142.250.185.227:443
www.gstatic.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
bazaar.abuse.ch
  • 151.101.2.49
  • 151.101.66.49
  • 151.101.130.49
  • 151.101.194.49
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp2.globalsign.com
  • 151.101.66.133
  • 151.101.130.133
  • 151.101.2.133
  • 151.101.194.133
whitelisted
www.googletagmanager.com
  • 142.250.185.136
whitelisted
www.google.com
  • 142.250.186.132
whitelisted
ocsp.pki.goog
  • 172.217.16.195
whitelisted
www.gstatic.com
  • 142.250.185.227
whitelisted
region1.google-analytics.com
  • 216.239.32.36
  • 216.239.34.36
whitelisted
fonts.gstatic.com
  • 216.58.212.163
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://bazaar.abuse.ch/download/be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844/