URL:

http://url5568.6sense-privacy.com/ls/click?upn=52Cym-2FhJfB2shax5RbiU4oOG5Pij13pqw1077EX4ATJbE3uMV4-2F-2B5F2kBG71XeLqFeoJ_bQiQ5-2BGmXnymGnBlJujf8jxSh31Jt4-2FTPaJKOca8Mi4aza-2BRXBzxsxvbF-2Feif-2BeO0gD7vuuHwLNCqpzHk13HP04O1x979zHQSs6oabLz-2FaYQlvxZ48mqZMPbO5V1LJ04RVHDsqS4YBq-2FUzTRHts9cXtm9JAIfbJlQSlRrJUYxoJBrVh5KHXtoQA4zYAThMLO4ZaHxpv3avPBB8pq7zhjbjrZx4S1fitNwtzOwJCLShRxS5m-2FrbdctZqrAb0Dx95O8zvWaKNRF3wnmVs-2FPIkknu7YxbgM4sHNxMuRraSdU7xeJbAlMvl0Uk-2F6DOS-2BhW0HcZyO9z6miYyT-2Fj5zADUY2q1Kdka3Lf7WmiaXjlPY-2FgIBo4d0XIXGW0G3UhUJ-2F8Tl

Full analysis: https://app.any.run/tasks/7c08369d-7886-4c6b-a1b1-05a7c993186b
Verdict: Malicious activity
Analysis date: June 19, 2023, 22:11:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

F9905AA308D43AA9899B40750B6C9569

SHA1:

18C3EC555163F4B0B8C7351B4580625EDAD0F712

SHA256:

038BA4713C88EAEC61EC2D5FEE6A839805DF3E55362AF90173EBAA5506035C22

SSDEEP:

12:ESxTssSnb26PilA0mAidHXvrPvvObCyiXMQNYzjZzUY:Wse26wbPilrvKChRNujZoY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 548)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
548"C:\Program Files\Internet Explorer\iexplore.exe" "http://url5568.6sense-privacy.com/ls/click?upn=52Cym-2FhJfB2shax5RbiU4oOG5Pij13pqw1077EX4ATJbE3uMV4-2F-2B5F2kBG71XeLqFeoJ_bQiQ5-2BGmXnymGnBlJujf8jxSh31Jt4-2FTPaJKOca8Mi4aza-2BRXBzxsxvbF-2Feif-2BeO0gD7vuuHwLNCqpzHk13HP04O1x979zHQSs6oabLz-2FaYQlvxZ48mqZMPbO5V1LJ04RVHDsqS4YBq-2FUzTRHts9cXtm9JAIfbJlQSlRrJUYxoJBrVh5KHXtoQA4zYAThMLO4ZaHxpv3avPBB8pq7zhjbjrZx4S1fitNwtzOwJCLShRxS5m-2FrbdctZqrAb0Dx95O8zvWaKNRF3wnmVs-2FPIkknu7YxbgM4sHNxMuRraSdU7xeJbAlMvl0Uk-2F6DOS-2BhW0HcZyO9z6miYyT-2Fj5zADUY2q1Kdka3Lf7WmiaXjlPY-2FgIBo4d0XIXGW0G3UhUJ-2F8Tl"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2936"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:548 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
13 818
Read events
13 735
Write events
83
Delete events
0

Modification events

(PID) Process:(548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
19
Text files
89
Unknown types
0

Dropped files

PID
Process
Filename
Type
548iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:0104E7D36CFCEA4535853EA44AC73135
SHA256:A4E9F320A47E1DF9BA52463882C559637DE81F8C143F041BEAE145F3E2E85A1E
548iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\urlblockindex[1].binbinary
MD5:FA518E3DFAE8CA3A0E495460FD60C791
SHA256:775853600060162C4B4E5F883F9FD5A278E61C471B3EE1826396B6D129499AA7
548iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8Fbinary
MD5:8E7A23A3879299C4D20E214E5D5AD5C4
SHA256:0777CE0B434E4DD3ECB5730A3FD8F3832A9ACB2B376EE1E2F04D762C2575C89E
548iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\82CB34DD3343FE727DF8890D352E0D8Fbinary
MD5:C79C10E912B6B46BFBDFFA18892943D5
SHA256:936A8C87447D0282D722C2E93C9E10C5CAD371C096D9FD3A8D54A3BA8A0319D8
2936iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
2936iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\privacy-center[1].htmhtml
MD5:7A5DF79FBAAFF2C161C6E29461785403
SHA256:B1C52A7C21C4B21BF69866D7859284068D6ECC90306FE22076F81DAA0176A7ED
2936iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\privacy-center[1].htmtext
MD5:FDA44910DEB1A460BE4AC5D56D61D837
SHA256:933B971C6388D594A23FA1559825DB5BEC8ADE2DB1240AA8FC9D0C684949E8C9
2936iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\privacy-center[1].htmhtml
MD5:D57E3A550060F85D44A175139EA23021
SHA256:43EDF068D34276E8ADE4113D4D7207DE19FC98A2AE1C07298E593EDAE2A8774C
2936iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:A787C975617F5B4E9B918734517E37C8
SHA256:3C4C802C47D5334A1D38E82CC7EF27930FCCA5901C5817461119738F1CED3FA3
2936iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\style[1].csstext
MD5:136B245D18BA9383A56041FA3D997143
SHA256:E84715546CE01C1070F2ED08D12765353005709A4707F3FFBAC55F7A3EB32DB9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
45
DNS requests
14
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2936
iexplore.exe
GET
301
141.193.213.21:80
http://www.6sense.com/privacy-center
ES
html
162 b
malicious
548
iexplore.exe
GET
200
192.229.221.95:80
http://crl3.digicert.com/Omniroot2025.crl
US
der
7.78 Kb
whitelisted
548
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2936
iexplore.exe
GET
200
142.250.185.227:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
—
—
GET
301
141.193.213.20:80
http://6sense.com/privacy-center
ES
html
162 b
malicious
2936
iexplore.exe
GET
200
142.250.185.227:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
2936
iexplore.exe
GET
302
167.89.118.52:80
http://url5568.6sense-privacy.com/ls/click?upn=52Cym-2FhJfB2shax5RbiU4oOG5Pij13pqw1077EX4ATJbE3uMV4-2F-2B5F2kBG71XeLqFeoJ_bQiQ5-2BGmXnymGnBlJujf8jxSh31Jt4-2FTPaJKOca8Mi4aza-2BRXBzxsxvbF-2Feif-2BeO0gD7vuuHwLNCqpzHk13HP04O1x979zHQSs6oabLz-2FaYQlvxZ48mqZMPbO5V1LJ04RVHDsqS4YBq-2FUzTRHts9cXtm9JAIfbJlQSlRrJUYxoJBrVh5KHXtoQA4zYAThMLO4ZaHxpv3avPBB8pq7zhjbjrZx4S1fitNwtzOwJCLShRxS5m-2FrbdctZqrAb0Dx95O8zvWaKNRF3wnmVs-2FPIkknu7YxbgM4sHNxMuRraSdU7xeJbAlMvl0Uk-2F6DOS-2BhW0HcZyO9z6miYyT-2Fj5zADUY2q1Kdka3Lf7WmiaXjlPY-2FgIBo4d0XIXGW0G3UhUJ-2F8Tl
US
html
59 b
whitelisted
2936
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?fbfc03f98bc5ce51
US
compressed
4.70 Kb
whitelisted
2936
iexplore.exe
GET
200
142.250.185.227:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEE%2Fke5Q8HG0aENG6mJCKPmQ%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
1076
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
2936
iexplore.exe
167.89.123.54:80
—
SENDGRID
US
suspicious
568
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
548
iexplore.exe
2.16.187.27:443
www.bing.com
Akamai International B.V.
DE
whitelisted
548
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted
548
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2936
iexplore.exe
167.89.118.83:80
—
SENDGRID
US
suspicious
548
iexplore.exe
152.199.19.161:443
r20swj13mr.microsoft.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 2.16.187.27
  • 2.16.187.43
whitelisted
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
crl3.digicert.com
  • 192.229.221.95
whitelisted
www.6sense.com
  • 141.193.213.21
  • 141.193.213.20
malicious
6sense.com
  • 141.193.213.20
  • 141.193.213.21
malicious
client-registry.mutinycdn.com
  • 151.101.1.91
  • 151.101.65.91
  • 151.101.129.91
  • 151.101.193.91
whitelisted

Threats

PID
Process
Class
Message
2936
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
2936
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://url5568.6sense-privacy.com/ls/click?upn=52Cym-2FhJfB2shax5RbiU4oOG5Pij13pqw1077EX4ATJbE3uMV4-2F-2B5F2kBG71XeLqFeoJ_bQiQ5-2BGmXnymGnBlJujf8jxSh31Jt4-2FTPaJKOca8Mi4aza-2BRXBzxsxvbF-2Feif-2BeO0gD7vuuHwLNCqpzHk13HP04O1x979zHQSs6oabLz-2FaYQlvxZ48mqZMPbO5V1LJ04RVHDsqS4YBq-2FUzTRHts9cXtm9JAIfbJlQSlRrJUYxoJBrVh5KHXtoQA4zYAThMLO4ZaHxpv3avPBB8pq7zhjbjrZx4S1fitNwtzOwJCLShRxS5m-2FrbdctZqrAb0Dx95O8zvWaKNRF3wnmVs-2FPIkknu7YxbgM4sHNxMuRraSdU7xeJbAlMvl0Uk-2F6DOS-2BhW0HcZyO9z6miYyT-2Fj5zADUY2q1Kdka3Lf7WmiaXjlPY-2FgIBo4d0XIXGW0G3UhUJ-2F8Tl