URL:

https://transfiles.ru/t6sb8

Full analysis: https://app.any.run/tasks/5d239ef4-9bfc-425e-81aa-55fed5b85cd6
Verdict: Malicious activity
Analysis date: February 18, 2024, 20:16:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

4A39DCE7FB7741D7A81B7156FAEAEB44

SHA1:

FDD50FBA1D3A80167E804E01F342C9E7FEAC0B40

SHA256:

F9790FCCF10C113B9E3C09F0377D665D89792CA177B7166E991A57DFEA88DAF2

SSDEEP:

3:N8fiWD5Td:21

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 1888)
      • wscript.exe (PID: 1636)

    • Drops the executable file immediately after the start

      • disable MRAC.exe (PID: 2168)
      • containerAgentproviderwebsession.exe (PID: 1576)
      • containerAgentproviderwebsession.exe (PID: 3252)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • disable MRAC.exe (PID: 2168)
      • disable MRAC.exe (PID: 2560)

    • Reads the Internet Settings

      • disable MRAC.exe (PID: 2168)
      • wscript.exe (PID: 1888)
      • disable MRAC.exe (PID: 2560)
      • wscript.exe (PID: 1636)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 1888)
      • wscript.exe (PID: 1636)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 1888)
      • wscript.exe (PID: 1636)

    • Executable content was dropped or overwritten

      • disable MRAC.exe (PID: 2168)
      • containerAgentproviderwebsession.exe (PID: 1576)
      • containerAgentproviderwebsession.exe (PID: 3252)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 1888)
      • wscript.exe (PID: 1636)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 3308)
      • cmd.exe (PID: 2308)

  • INFO

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 2472)
      • iexplore.exe (PID: 3348)

    • The process uses the downloaded file

      • iexplore.exe (PID: 2472)

    • Application launched itself

      • iexplore.exe (PID: 2472)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 3348)
      • iexplore.exe (PID: 2472)

    • Reads the computer name

      • disable MRAC.exe (PID: 2168)
      • disable MRAC.exe (PID: 2560)
      • containerAgentproviderwebsession.exe (PID: 1576)
      • containerAgentproviderwebsession.exe (PID: 3252)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2472)

    • Checks supported languages

      • disable MRAC.exe (PID: 2168)
      • containerAgentproviderwebsession.exe (PID: 1576)
      • disable MRAC.exe (PID: 2560)
      • containerAgentproviderwebsession.exe (PID: 3252)

    • Reads the machine GUID from the registry

      • containerAgentproviderwebsession.exe (PID: 1576)
      • containerAgentproviderwebsession.exe (PID: 3252)

    • Reads Environment values

      • containerAgentproviderwebsession.exe (PID: 1576)
      • containerAgentproviderwebsession.exe (PID: 3252)

    • Reads product name

      • containerAgentproviderwebsession.exe (PID: 1576)
      • containerAgentproviderwebsession.exe (PID: 3252)

    • Manual execution by a user

      • disable MRAC.exe (PID: 2560)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
60
Monitored processes
12
Malicious processes
3
Suspicious processes
4

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe disable mrac.exe wscript.exe no specs cmd.exe no specs reg.exe no specs containeragentproviderwebsession.exe disable mrac.exe wscript.exe no specs cmd.exe no specs reg.exe no specs containeragentproviderwebsession.exe

Process information

PID
CMD
Path
Indicators
Parent process
1576"C:\MsagentproviderHostdll/containerAgentproviderwebsession.exe"C:\MsagentproviderHostdll\containerAgentproviderwebsession.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Version:
16.10.31418.88
Modules
Images
c:\msagentproviderhostdll\containeragentproviderwebsession.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1592reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1636"C:\Windows\System32\WScript.exe" "C:\MsagentproviderHostdll\DFRhGV72zcI4MoSMws3K.vbe" C:\Windows\System32\wscript.exe—disable MRAC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1888"C:\Windows\System32\WScript.exe" "C:\MsagentproviderHostdll\DFRhGV72zcI4MoSMws3K.vbe" C:\Windows\System32\wscript.exe—disable MRAC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2168"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\disable MRAC.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\disable MRAC.exe
iexplore.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\po2hn1x2\disable mrac.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2308C:\Windows\system32\cmd.exe /c ""C:\MsagentproviderHostdll\Ed5V8GaQIPZo2Xo1s8MXIpHI.bat" "C:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2472"C:\Program Files\Internet Explorer\iexplore.exe" "https://transfiles.ru/t6sb8"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2560"C:\Users\admin\Desktop\disable MRAC.exe" C:\Users\admin\Desktop\disable MRAC.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
10
Modules
Images
c:\users\admin\desktop\disable mrac.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2564reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3252"C:\MsagentproviderHostdll/containerAgentproviderwebsession.exe"C:\MsagentproviderHostdll\containerAgentproviderwebsession.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
16.10.31418.88
Modules
Images
c:\msagentproviderhostdll\containeragentproviderwebsession.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
33 867
Read events
33 548
Write events
270
Delete events
49

Modification events

(PID) Process:(2472) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2472) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(2472) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31089319
(PID) Process:(2472) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(2472) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31089319
(PID) Process:(2472) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2472) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2472) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2472) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2472) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
9
Suspicious files
35
Text files
91
Unknown types
21

Dropped files

PID
Process
Filename
Type
3348iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751binary
MD5:822467B728B7A66B081C91795373789A
SHA256:AF2343382B88335EEA72251AD84949E244FF54B6995063E24459A7216E9576B9
3348iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:B92850AA4F601F1ED53E9C48FB73141A
SHA256:3EFF4406C697E63FFFDA3CE8FF4C06A064CC6CC7587DF3D7774A0C2BDEE283A1
3348iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\06C38DEB724883F2EBA78A6DEB720EAFder
MD5:F793A8A355A3114B2061EECBDA2E5689
SHA256:788093D1C9325228A982EBFA3D7F8D149439ABBB09BF1D1BB8D51E39B4587DE3
3348iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\common_m[1].csstext
MD5:070816AE748DBF9E67F3A5144AEEB68A
SHA256:73D3D28D5DC18DEDD5748B4B506E44CAFBFA836ED3A04117E6BE7E72B7F2E1A5
3348iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\abuse[1].pngimage
MD5:3B7F009B9E66DD02EEA2CCDB26402572
SHA256:2B68B345C236CD622A7FF2B26F080D6CF820A8B684924533C28ED26DEF132E2C
3348iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\ru[1].pngimage
MD5:01F78ADD7628815BAA0126489CA6BBB4
SHA256:670BC999DF02739E39C67AB53DD9E9D4C7BE5049C14C29613FD96B2907A798A5
3348iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\jquery.min[1].jstext
MD5:3576A6E73C9DCCDBBC4A2CF8FF544AD7
SHA256:61C6CAEBD23921741FB5FFE6603F16634FCA9840C2BF56AC8201E9264D6DACCF
3348iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\jquery.bxslider.min[1].jstext
MD5:697D69A48E5356F7106E38C09F7F19E0
SHA256:BB9E7DC822C6B7B95A6329932885C72FF2CAF74B243FC1C40ACA0E858123B83E
3348iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\jquery.mCustomScrollbar.concat.min[1].jstext
MD5:43DABD6DBD8745FB808E146D96266E30
SHA256:150B9F119F532D05A6A0EECA49D36BC7A01F8EC912BAC67AF2A34309EE320BF3
3348iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\en[1].pngimage
MD5:06AA60774CECADD41E09151E2D006F16
SHA256:9A87F8ADE1743DC729FD6066A644C763D997B3415CDD7D27D38B0BBB4DD4B172
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
24
TCP/UDP connections
69
DNS requests
31
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3348
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?545e1839169dd0e6
unknown
—
—
unknown
3348
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f78d505714a595e3
unknown
—
—
unknown
3348
iexplore.exe
GET
200
72.246.169.163:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
3348
iexplore.exe
GET
200
195.138.255.19:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgMYmg8JuP%2FAwSvawMgXBgq3sg%3D%3D
unknown
binary
503 b
unknown
3348
iexplore.exe
GET
200
142.250.185.67:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
3348
iexplore.exe
GET
200
142.250.185.67:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
binary
724 b
unknown
3348
iexplore.exe
GET
200
142.250.185.67:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEBVwuMGYY9kfENL7iFzC1x0%3D
unknown
binary
471 b
unknown
3348
iexplore.exe
GET
200
142.250.185.67:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCG5mYmc5exBwr3zurLpXnC
unknown
binary
472 b
unknown
3348
iexplore.exe
GET
200
151.101.2.133:80
http://ocsp.globalsign.com/rootr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHUeP1PjGFkz6V8I7O6tApc%3D
unknown
binary
1.41 Kb
unknown
3348
iexplore.exe
GET
200
104.18.21.226:80
http://ocsp2.globalsign.com/rootr5/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQiD0S5cIHyfrLTJ1fvAkJWflH%2B2QQUPeYpSJvqB8ohREom3m7e0oPQn1kCDQHuXyKVQkkF%2BQGRqNw%3D
unknown
binary
1.25 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
3348
iexplore.exe
157.90.215.152:443
transfiles.ru
Hetzner Online GmbH
DE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3348
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
3348
iexplore.exe
72.246.169.163:80
x1.c.lencr.org
AKAMAI-AS
DE
unknown
3348
iexplore.exe
195.138.255.19:80
r3.o.lencr.org
AS33891 Netzbetrieb GmbH
DE
unknown
3348
iexplore.exe
172.217.18.98:443
pagead2.googlesyndication.com
GOOGLE
US
whitelisted
3348
iexplore.exe
93.158.134.119:443
mc.yandex.ru
YANDEX LLC
RU
whitelisted
3348
iexplore.exe
142.250.185.67:80
ocsp.pki.goog
GOOGLE
US
whitelisted
3348
iexplore.exe
142.250.185.174:443
www.google-analytics.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
transfiles.ru
  • 157.90.215.152
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
  • 23.48.23.40
  • 23.48.23.64
  • 23.48.23.50
  • 23.48.23.5
  • 23.48.23.6
  • 23.48.23.60
  • 23.48.23.67
  • 23.48.23.12
  • 23.48.23.7
whitelisted
x1.c.lencr.org
  • 72.246.169.163
whitelisted
r3.o.lencr.org
  • 195.138.255.19
  • 195.138.255.24
shared
pagead2.googlesyndication.com
  • 172.217.18.98
whitelisted
ocsp.pki.goog
  • 142.250.185.67
whitelisted
mc.yandex.ru
  • 93.158.134.119
  • 87.250.250.119
  • 77.88.21.119
  • 87.250.251.119
whitelisted
www.google-analytics.com
  • 142.250.185.174
whitelisted
ocsp.globalsign.com
  • 151.101.2.133
  • 151.101.66.133
  • 151.101.130.133
  • 151.101.194.133
whitelisted
ocsp2.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://transfiles.ru/t6sb8