Joe Sandbox Cloud Basic Analysis Report
Play interactive tourEdit tour

Windows Analysis Report http://clientconfig.passport.net/ppcrlcheck.xml

Overview

General Information

Sample URL:http://clientconfig.passport.net/ppcrlcheck.xml
Analysis ID:442150
Infos:

Most interesting Screenshot:

Detection

Score:0
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

No high impact signatures.

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

Process Tree

  • System is w10x64
  • iexplore.exe (PID: 3528 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)
    • iexplore.exe (PID: 5676 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3528 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

  • • Compliance
  • • Networking
  • • System Summary

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeFile opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dllJump to behavior
Source: unknownDNS traffic detected: queries for: clientconfig.passport.net
Source: ~DFA6E06D8D5AC0EE3D.TMP.2.drString found in binary or memory: http://clientconfig.passport.net/ppcrlcheck.xml
Source: {E953362D-D99B-11EB-90E4-ECF4BB862DED}.dat.2.drString found in binary or memory: http://clientconfig.passport.net/ppcrlcheck.xmlRoot
Source: classification engineClassification label: clean0.win@3/8@2/0
Source: C:\Program Files\internet explorer\iexplore.exeFile created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\HighJump to behavior
Source: C:\Program Files\internet explorer\iexplore.exeFile created: C:\Users\user\AppData\Local\Temp\~DFECE3B6569521AA4E.TMPJump to behavior
Source: C:\Program Files\internet explorer\iexplore.exeFile read: C:\Users\desktop.iniJump to behavior
Source: unknownProcess created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3528 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exeProcess created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3528 CREDAT:17410 /prefetch:2Jump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exeFile opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dllJump to behavior

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection1Masquerading1OS Credential DumpingFile and Directory Discovery1Remote ServicesData from Local SystemExfiltration Over Other Network MediumNon-Application Layer Protocol1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsProcess Injection1LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothApplication Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 442150 URL: http://clientconfig.passpor... Startdate: 30/06/2021 Architecture: WINDOWS Score: 0 11 clientconfig.passport.net 2->11 6 iexplore.exe 2 61 2->6         started        process3 process4 8 iexplore.exe 2 33 6->8         started        dnsIp5 13 clientconfig.passport.net 8->13

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
http://clientconfig.passport.net/ppcrlcheck.xml0%VirustotalBrowse
http://clientconfig.passport.net/ppcrlcheck.xml0%Avira URL Cloudsafe

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

SourceDetectionScannerLabelLink
clientconfig.passport.net0%VirustotalBrowse

URLs

SourceDetectionScannerLabelLink
http://clientconfig.passport.net/ppcrlcheck.xml0%VirustotalBrowse
http://clientconfig.passport.net/ppcrlcheck.xmlRoot0%Avira URL Cloudsafe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
clientconfig.passport.net
unknown
unknownfalseunknown

Contacted URLs

NameMaliciousAntivirus DetectionReputation
http://clientconfig.passport.net/ppcrlcheck.xmlfalseunknown
NameSourceMaliciousAntivirus DetectionReputation
http://clientconfig.passport.net/ppcrlcheck.xml~DFA6E06D8D5AC0EE3D.TMP.2.drfalseunknown
http://clientconfig.passport.net/ppcrlcheck.xmlRoot{E953362D-D99B-11EB-90E4-ECF4BB862DED}.dat.2.drfalse
  • Avira URL Cloud: safe
unknown

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:32.0.0 Black Diamond
Analysis ID:442150
Start date:30.06.2021
Start time:05:07:58
Joe Sandbox Product:CloudBasic
Overall analysis duration:0h 2m 19s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:browseurl.jbs
Sample URL:http://clientconfig.passport.net/ppcrlcheck.xml
Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:5
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • HCA enabled
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Detection:CLEAN
Classification:clean0.win@3/8@2/0
Cookbook Comments:
  • Adjust boot time
  • Enable AMSI
Warnings:
  • Exclude process from analysis (whitelisted): ielowutil.exe, backgroundTaskHost.exe, svchost.exe
  • Excluded IPs from analysis (whitelisted): 104.43.193.48, 40.88.32.150, 23.203.80.193, 104.42.151.234, 96.16.150.73, 20.82.210.154
  • Excluded domains from analysis (whitelisted): iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, arc.msn.com, skypedataprdcolcus15.cloudapp.net, e11290.dspg.akamaiedge.net, e13551.dscg.akamaiedge.net, skypedataprdcoleus15.cloudapp.net, msagfx.live.com-6.edgekey.net, authgfx.msa.akadns6.net, go.microsoft.com, blobcollector.events.data.trafficmanager.net, go.microsoft.com.edgekey.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, skypedataprdcolwus16.cloudapp.net
  • Not all processes where analyzed, report is missing behavior information

Simulations

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E953362B-D99B-11EB-90E4-ECF4BB862DED}.dat
Process:C:\Program Files\internet explorer\iexplore.exe
File Type:Microsoft Word Document
Category:dropped
Size (bytes):30296
Entropy (8bit):1.8549605636701565
Encrypted:false
SSDEEP:96:rV/ZbaZtr2OQWwARtwMfwMlMw4wmwbfwLMX:rV/ZbaZtr2OQW7RtJfjlMD9efoMX
MD5:70C8E509C8493F3A86D19946B1E33E11
SHA1:8AA85964F18632D037BBD0CC028BCC866C0E405B
SHA-256:A635B6F30DCFCB19AC47033D87FDEBCE86DB7D09FC325A6A0E37967DE09FE3A7
SHA-512:B830F7726E061B37782EA47C913FF0F3BD01EA9CE731D05486C1811C41DA918CC2EE3F1A85CEF7CEB665F23FB1C81B5A9481756C72754A604B046032C57FD21F
Malicious:false
Reputation:low
Preview: ................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E953362D-D99B-11EB-90E4-ECF4BB862DED}.dat
Process:C:\Program Files\internet explorer\iexplore.exe
File Type:Microsoft Word Document
Category:dropped
Size (bytes):24204
Entropy (8bit):1.6334935040911147
Encrypted:false
SSDEEP:48:IwgGcpr1GwpaVG4pQhGrapbSTGQpB6GHHpcbTGUp80GzYpmoDGopZO2fBG+Xpm:rEZfQH6xBStjB21WwMcvxg
MD5:0B03C95332767986FA2FC685A605486A
SHA1:4E050C1448E3384A06C156469DAC6692AA9C9DC0
SHA-256:56FB16196A70C457019A810AF1A471AD30D3EB545594CA9B16B5EDEE960836EB
SHA-512:1230421782F8702FE2C6CB0FE2CF34D88DE739C009867D01FC36E142C7D46A321849837EE6F3158B2A9C984FB08AEFAB223E38064181625B3A25BD732598C2EA
Malicious:false
Reputation:low
Preview: ................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{E953362E-D99B-11EB-90E4-ECF4BB862DED}.dat
Process:C:\Program Files\internet explorer\iexplore.exe
File Type:Microsoft Word Document
Category:dropped
Size (bytes):16984
Entropy (8bit):1.5641498684057
Encrypted:false
SSDEEP:48:IwGGcpr3GwpaeG4pQyGrapbSZGQpK/G7HpRwTGIpG:raZhQe60BSzAOTkA
MD5:15930B100D59E05D9EFF8F9951881B65
SHA1:65631AE76606D2DE2A95A805A69238F9D43EA9C0
SHA-256:98176137DBB7245C42C2F2F3C1B23070A50FD84667D71437906C5D24A83B4A0E
SHA-512:9ADDCC3F7EF704E0B788DC06B4DF72C2AA1574C0A0044D8AB4041716F498AECA11E4A0849DD0D48E4639BAA91A3DCDA67E4712CCC14B23DF4FD417D2F29AFD9A
Malicious:false
Reputation:low
Preview: ................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\xmltreeview[1]
Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:ASCII text, with CRLF line terminators
Category:downloaded
Size (bytes):17524
Entropy (8bit):4.340063035506032
Encrypted:false
SSDEEP:192:wiuFhk5un5EpDdblzKaz+OJGbiIBJofNbr5/dn82/jqmo3qAi:rq25unWZd9dvJGiIBJoh387oAi
MD5:03710426AB25AD1280E197F61249F9DE
SHA1:F5E7A6FD42503AE4758BC36C8DD78D98EFB35047
SHA-256:21E63F7C77896ED2B5F115957F2448E0A9E2DD738D7D487E471217421F6A93E1
SHA-512:213CB55B8573335D1384AE704FF4267F224376056F71548660F9B2FDAA1203D8ABDDB787900AAF5D1E0AC6E5BE261F713BDBEFB67643D08E8D3672512A1AF588
Malicious:false
Reputation:low
IE Cache URL:res://mshtml.dll/xmltreeview.js
Preview: (function()..{.. var XHTML = "http://www.w3.org/1999/xhtml";.. .. // Time slicing constants.. var LIMIT = 10; // Maximum number of nodes to process before checking time.. var DURATION = 200; // Maximum amount of time (ms) to process before unblocking UI.. var DELAY = 15; // Amount of time (ms) to unblock UI.... // Tree building state.. var iterator;.. var nextNode;.. var root;.. var rootFirstChild;.. var time;.. .. // Template References.. var attrTemplate, attrName, attrValue;.. var elmStartTemplate, elmStartName;.. var elmEndTemplate, elmEndName;.. var cdataTemplate, cdataValue;.. var commentTemplate, commentValue;.. var style; .. .. // Only invoke this script if it was injected by our parser. Test for a condition that is.. // impossible for a markup to create - two direct children of the document... var secondRootElement = document.documentElement.nextElementSibling;.. if (secondRootElement == null
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\ppcrlcheck[1].xml
Process:C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:ASCII text, with CRLF line terminators
Category:downloaded
Size (bytes):105
Entropy (8bit):4.7452709993656885
Encrypted:false
SSDEEP:3:3IGMGdNWLKsHUN0LyMvNkDCFBAXLKsHUNnsz4v:3MGGVDLV0CuVLzi
MD5:8EAF24236F1468A0DC0A34A7FA31E3BC
SHA1:A7A15E5D59A7B9E520FBAE4AA9AC33BB3B38606F
SHA-256:F4E172A405E550D17D48FAF1CB95A760FD69FE9AAE54A29DA56D35A1CC939C27
SHA-512:E31A59C2425D5D7503AF426F327B26B3AFE2B47A1DB9DA64BD36A8D1926AF57B0B2754893A8611AED0BD22A66DA3507F2DF3F0D6AC5B062B72BDA19A48D4C6B4
Malicious:false
Reputation:low
IE Cache URL:http://clientconfig.passport.net/ppcrlcheck.xml
Preview: <Config>..<DeviceID minversion="16.000.26889.00"/>..<MobileCfg minversion="16.000.26208.0"/>..</Config>..
C:\Users\user\AppData\Local\Temp\~DFA6E06D8D5AC0EE3D.TMP
Process:C:\Program Files\internet explorer\iexplore.exe
File Type:data
Category:dropped
Size (bytes):34397
Entropy (8bit):0.3534384662562722
Encrypted:false
SSDEEP:24:c9lLh9lLh9lIn9lIn9lRg9lRA9lTS9lTy9lSSd9lSSd9lwW9lwm9l2o9l2I9l/oA:kBqoxKAuvScS+Z3lUoIoTO2fM
MD5:FF148EBA3E384AB3F5424E38E763FEC6
SHA1:80AF0051863250B13EA023263A3DCD2186CDFDE8
SHA-256:E9072CB94651741525186B04D465C859D70F6262111EB6C31094808325F786AF
SHA-512:70A6D805B17A04F9B8356752D14FA0B7C53CD3B805964B0ECDFB8DBB61C7F7D19FB060BC1A1EEFB8173BF24A65B996FCAE76B6BEA180D0591C619C0EEA2CF8E4
Malicious:false
Reputation:low
Preview: .............................*%..H..M..{y..+.0...(................... ...............................................*%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
C:\Users\user\AppData\Local\Temp\~DFB5DCC584A927CE04.TMP
Process:C:\Program Files\internet explorer\iexplore.exe
File Type:data
Category:dropped
Size (bytes):25441
Entropy (8bit):0.27918767598683664
Encrypted:false
SSDEEP:24:c9lLh9lLh9lIn9lIn9lRx/9lRJ9lTb9lTb9lSSU9lSSU9laAa/9laA:kBqoxxJhHWSVSEab
MD5:AB889A32AB9ACD33E816C2422337C69A
SHA1:1190C6B34DED2D295827C2A88310D10A8B90B59B
SHA-256:4D6EC54B8D244E63B0F04FBE2B97402A3DF722560AD12F218665BA440F4CEFDA
SHA-512:BD250855747BB4CEC61814D0E44F810156D390E3E9F120A12935EFDF80ACA33C4777AD66257CCA4E4003FEF0741692894980B9298F01C4CDD2D8A9C7BB522FB6
Malicious:false
Reputation:low
Preview: .............................*%..H..M..{y..+.0...(................... ...............................................*%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
C:\Users\user\AppData\Local\Temp\~DFECE3B6569521AA4E.TMP
Process:C:\Program Files\internet explorer\iexplore.exe
File Type:data
Category:dropped
Size (bytes):13029
Entropy (8bit):0.48029268761204974
Encrypted:false
SSDEEP:24:c9lLh9lLh9lIn9lIn9lozF9loZ9lW4rSrL4eurL9DqDe:kBqoIC8Q6LKLNGe
MD5:C7523AB6CF8761FAD2C9CC69AAEA65A1
SHA1:75EC336A494C3DFC9772024B9423041454BDD307
SHA-256:E503DB6E9921072186271080B14D317F4C625067B8DCE0496DEE1954B331AD25
SHA-512:082F199EC14A2763905808AF28850C8BE355EBEDE6B9DD0870C9B12CD71D383A4A4CA7ED91123925774F7FA6996238C3C5B804BF1C224220ED00F62CFD8AE9F2
Malicious:false
Reputation:low
Preview: .............................*%..H..M..{y..+.0...(................... ...............................................*%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

No static file info

Network Behavior

Download Network PCAP: filtered – full

TimestampSource PortDest PortSource IPDest IP
Jun 30, 2021 05:08:37.426891088 CEST5836153192.168.2.38.8.8.8
Jun 30, 2021 05:08:37.479319096 CEST53583618.8.8.8192.168.2.3
Jun 30, 2021 05:08:43.987750053 CEST6349253192.168.2.38.8.8.8
Jun 30, 2021 05:08:44.040796995 CEST53634928.8.8.8192.168.2.3
Jun 30, 2021 05:08:44.335333109 CEST6083153192.168.2.38.8.8.8
Jun 30, 2021 05:08:44.398221970 CEST53608318.8.8.8192.168.2.3
Jun 30, 2021 05:08:45.089806080 CEST6010053192.168.2.38.8.8.8
Jun 30, 2021 05:08:45.150749922 CEST53601008.8.8.8192.168.2.3
Jun 30, 2021 05:08:45.595489979 CEST5319553192.168.2.38.8.8.8
Jun 30, 2021 05:08:45.653718948 CEST53531958.8.8.8192.168.2.3
Jun 30, 2021 05:08:46.492430925 CEST5014153192.168.2.38.8.8.8
Jun 30, 2021 05:08:46.552767992 CEST53501418.8.8.8192.168.2.3
Jun 30, 2021 05:08:47.478185892 CEST5302353192.168.2.38.8.8.8
Jun 30, 2021 05:08:47.527425051 CEST53530238.8.8.8192.168.2.3
Jun 30, 2021 05:08:49.646250963 CEST4956353192.168.2.38.8.8.8
Jun 30, 2021 05:08:49.708538055 CEST53495638.8.8.8192.168.2.3
Jun 30, 2021 05:08:50.807521105 CEST5135253192.168.2.38.8.8.8
Jun 30, 2021 05:08:50.859483004 CEST53513528.8.8.8192.168.2.3
Jun 30, 2021 05:08:53.169118881 CEST5934953192.168.2.38.8.8.8
Jun 30, 2021 05:08:53.237868071 CEST53593498.8.8.8192.168.2.3
Jun 30, 2021 05:08:54.705971003 CEST5708453192.168.2.38.8.8.8
Jun 30, 2021 05:08:54.760845900 CEST53570848.8.8.8192.168.2.3
Jun 30, 2021 05:08:55.631154060 CEST5882353192.168.2.38.8.8.8
Jun 30, 2021 05:08:55.692164898 CEST53588238.8.8.8192.168.2.3
Jun 30, 2021 05:08:56.939466000 CEST5756853192.168.2.38.8.8.8
Jun 30, 2021 05:08:56.998513937 CEST53575688.8.8.8192.168.2.3
Jun 30, 2021 05:08:57.870837927 CEST5054053192.168.2.38.8.8.8
Jun 30, 2021 05:08:57.927963018 CEST53505408.8.8.8192.168.2.3
Jun 30, 2021 05:09:01.161003113 CEST5436653192.168.2.38.8.8.8
Jun 30, 2021 05:09:01.209811926 CEST53543668.8.8.8192.168.2.3
Jun 30, 2021 05:09:02.564724922 CEST5303453192.168.2.38.8.8.8
Jun 30, 2021 05:09:02.624188900 CEST53530348.8.8.8192.168.2.3
Jun 30, 2021 05:09:02.944524050 CEST5776253192.168.2.38.8.8.8
Jun 30, 2021 05:09:03.003376961 CEST53577628.8.8.8192.168.2.3
Jun 30, 2021 05:09:03.867918968 CEST5543553192.168.2.38.8.8.8
Jun 30, 2021 05:09:03.917721033 CEST53554358.8.8.8192.168.2.3
Jun 30, 2021 05:09:04.985889912 CEST5071353192.168.2.38.8.8.8
Jun 30, 2021 05:09:05.045377016 CEST53507138.8.8.8192.168.2.3
Jun 30, 2021 05:09:06.201332092 CEST5613253192.168.2.38.8.8.8
Jun 30, 2021 05:09:06.254000902 CEST53561328.8.8.8192.168.2.3
Jun 30, 2021 05:09:08.153950930 CEST5898753192.168.2.38.8.8.8
Jun 30, 2021 05:09:08.221405983 CEST53589878.8.8.8192.168.2.3

DNS Queries

TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
Jun 30, 2021 05:08:45.595489979 CEST192.168.2.38.8.8.80xadeStandard query (0)clientconfig.passport.netA (IP address)IN (0x0001)
Jun 30, 2021 05:09:02.564724922 CEST192.168.2.38.8.8.80xd1bfStandard query (0)clientconfig.passport.netA (IP address)IN (0x0001)

DNS Answers

TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
Jun 30, 2021 05:08:45.653718948 CEST8.8.8.8192.168.2.30xadeNo error (0)clientconfig.passport.netauthgfx.msa.akadns6.netCNAME (Canonical name)IN (0x0001)
Jun 30, 2021 05:09:02.624188900 CEST8.8.8.8192.168.2.30xd1bfNo error (0)clientconfig.passport.netauthgfx.msa.akadns6.netCNAME (Canonical name)IN (0x0001)

Code Manipulations

Statistics

CPU Usage

0102030s020406080100

Click to jump to process

Memory Usage

0102030s0.002040MB

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: iexplore.exe PID: 3528 Parent PID: 792

Function Logs

General

Start time:05:08:43
Start date:30/06/2021
Path:C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):false
Commandline:'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:0x7ff67b9a0000
File size:823560 bytes
MD5 hash:6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:low
Show Windows behavior

File Activities

Show Windows behavior

Section Activities

Show Windows behavior

Registry Activities

Show Windows behavior

Mutex Activities

Show Windows behavior

Process Activities

Show Windows behavior

Thread Activities

Show Windows behavior

Memory Activities

Show Windows behavior

System Activities

Show Windows behavior

Timing Activities

Show Windows behavior

Windows UI Activities

Show Windows behavior

Network Activities

Show Windows behavior

Object Security Activities

Show Windows behavior

LPC Port Activities

Analysis Process: iexplore.exe PID: 5676 Parent PID: 3528

Function Logs

General

Start time:05:08:43
Start date:30/06/2021
Path:C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):true
Commandline:'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3528 CREDAT:17410 /prefetch:2
Imagebase:0xd0000
File size:822536 bytes
MD5 hash:071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:low
Show Windows behavior

File Activities

Show Windows behavior

Section Activities

Show Windows behavior

Registry Activities

Show Windows behavior

Mutex Activities

Show Windows behavior

Process Activities

Show Windows behavior

Thread Activities

Show Windows behavior

Memory Activities

Show Windows behavior

System Activities

Show Windows behavior

Timing Activities

Show Windows behavior

Windows UI Activities

Show Windows behavior

Network Activities

Show Windows behavior

Object Security Activities

Show Windows behavior

LPC Port Activities

Disassembly