URL:

http://url5568.6sense-privacy.com/ls/click?upn=52Cym-2FhJfB2shax5RbiU4oOG5Pij13pqw1077EX4ATJbE3uMV4-2F-2B5F2kBG71XeLqFeoJ_bQiQ5-2BGmXnymGnBlJujf8jxSh31Jt4-2FTPaJKOca8Mi4aza-2BRXBzxsxvbF-2Feif-2BeO0gD7vuuHwLNCqpzHk13HP04O1x979zHQSs6oabLz-2FaYQlvxZ48mqZMPbO5V1LJ04RVHDsqS4YBq-2FUzTRHts9cXtm9JAIfbJlQSlRrJUYxoJBrVh5KHXtoQA4zYAThMLO4ZaHxpv3avPBB8pq7zhjbjrZx4S1fitNwtzOwJCLShRxS5m-2FrbdctZqrAb0Dx95O8zvWaKNRF3wnmVs-2FPIkknu7YxbgM4sHNxMuRraSdU7xeJbAlMvl0Uk-2F6DOS-2BhW0HcZyO9z6miYyT-2Fj5zADUY2q1Kdka3Lf7WmiaXjlPY-2FgIBo4d0XIXGW0G3UhUJ-2F8Tl

Full analysis: https://app.any.run/tasks/7c08369d-7886-4c6b-a1b1-05a7c993186b
Verdict: Malicious activity
Analysis date: June 19, 2023, 22:11:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

F9905AA308D43AA9899B40750B6C9569

SHA1:

18C3EC555163F4B0B8C7351B4580625EDAD0F712

SHA256:

038BA4713C88EAEC61EC2D5FEE6A839805DF3E55362AF90173EBAA5506035C22

SSDEEP:

12:ESxTssSnb26PilA0mAidHXvrPvvObCyiXMQNYzjZzUY:Wse26wbPilrvKChRNujZoY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 548)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
548"C:\Program Files\Internet Explorer\iexplore.exe" "http://url5568.6sense-privacy.com/ls/click?upn=52Cym-2FhJfB2shax5RbiU4oOG5Pij13pqw1077EX4ATJbE3uMV4-2F-2B5F2kBG71XeLqFeoJ_bQiQ5-2BGmXnymGnBlJujf8jxSh31Jt4-2FTPaJKOca8Mi4aza-2BRXBzxsxvbF-2Feif-2BeO0gD7vuuHwLNCqpzHk13HP04O1x979zHQSs6oabLz-2FaYQlvxZ48mqZMPbO5V1LJ04RVHDsqS4YBq-2FUzTRHts9cXtm9JAIfbJlQSlRrJUYxoJBrVh5KHXtoQA4zYAThMLO4ZaHxpv3avPBB8pq7zhjbjrZx4S1fitNwtzOwJCLShRxS5m-2FrbdctZqrAb0Dx95O8zvWaKNRF3wnmVs-2FPIkknu7YxbgM4sHNxMuRraSdU7xeJbAlMvl0Uk-2F6DOS-2BhW0HcZyO9z6miYyT-2Fj5zADUY2q1Kdka3Lf7WmiaXjlPY-2FgIBo4d0XIXGW0G3UhUJ-2F8Tl"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2936"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:548 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
13 818
Read events
13 735
Write events
83
Delete events
0

Modification events

(PID) Process:(548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
19
Text files
89
Unknown types
0

Dropped files

PID
Process
Filename
Type
548iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\82CB34DD3343FE727DF8890D352E0D8Fbinary
MD5:8E7A23A3879299C4D20E214E5D5AD5C4
SHA256:0777CE0B434E4DD3ECB5730A3FD8F3832A9ACB2B376EE1E2F04D762C2575C89E
2936iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\wpa-style[1].csstext
MD5:F7D6002274471A172F431178210FA670
SHA256:ADAE42CF649A0A05F6C2493F5C47E778846F13357B1603C0AE0243B4ED69D8F3
2936iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\privacy-center[1].htmhtml
MD5:7A5DF79FBAAFF2C161C6E29461785403
SHA256:B1C52A7C21C4B21BF69866D7859284068D6ECC90306FE22076F81DAA0176A7ED
2936iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
2936iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\frontend[1].csstext
MD5:81CE8F9E2DCFAD18EFA05BDD6CD3394E
SHA256:7501AF8AD36FE4D3375E2BFC2461D3C4AB3DB4A8D619D1608D4D9CF092CB647E
2936iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:A787C975617F5B4E9B918734517E37C8
SHA256:3C4C802C47D5334A1D38E82CC7EF27930FCCA5901C5817461119738F1CED3FA3
548iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\urlblockindex[1].binbinary
MD5:FA518E3DFAE8CA3A0E495460FD60C791
SHA256:775853600060162C4B4E5F883F9FD5A278E61C471B3EE1826396B6D129499AA7
548iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:F12C265A76A9E5A0279BAD4724C67E62
SHA256:D6F55023574BD134D2BDF74DD2BAE0F0235A52BB302C7B290977DC05E13A2012
2936iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\privacy-center[1].htmtext
MD5:FDA44910DEB1A460BE4AC5D56D61D837
SHA256:933B971C6388D594A23FA1559825DB5BEC8ADE2DB1240AA8FC9D0C684949E8C9
2936iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\style[1].csstext
MD5:136B245D18BA9383A56041FA3D997143
SHA256:E84715546CE01C1070F2ED08D12765353005709A4707F3FFBAC55F7A3EB32DB9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
45
DNS requests
14
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2936
iexplore.exe
GET
301
141.193.213.21:80
http://www.6sense.com/privacy-center
ES
html
162 b
malicious
2936
iexplore.exe
GET
302
167.89.118.52:80
http://url5568.6sense-privacy.com/ls/click?upn=52Cym-2FhJfB2shax5RbiU4oOG5Pij13pqw1077EX4ATJbE3uMV4-2F-2B5F2kBG71XeLqFeoJ_bQiQ5-2BGmXnymGnBlJujf8jxSh31Jt4-2FTPaJKOca8Mi4aza-2BRXBzxsxvbF-2Feif-2BeO0gD7vuuHwLNCqpzHk13HP04O1x979zHQSs6oabLz-2FaYQlvxZ48mqZMPbO5V1LJ04RVHDsqS4YBq-2FUzTRHts9cXtm9JAIfbJlQSlRrJUYxoJBrVh5KHXtoQA4zYAThMLO4ZaHxpv3avPBB8pq7zhjbjrZx4S1fitNwtzOwJCLShRxS5m-2FrbdctZqrAb0Dx95O8zvWaKNRF3wnmVs-2FPIkknu7YxbgM4sHNxMuRraSdU7xeJbAlMvl0Uk-2F6DOS-2BhW0HcZyO9z6miYyT-2Fj5zADUY2q1Kdka3Lf7WmiaXjlPY-2FgIBo4d0XIXGW0G3UhUJ-2F8Tl
US
html
59 b
whitelisted
548
iexplore.exe
GET
200
192.229.221.95:80
http://crl3.digicert.com/Omniroot2025.crl
US
der
7.78 Kb
whitelisted
—
—
GET
301
141.193.213.20:80
http://6sense.com/privacy-center
ES
html
162 b
malicious
2936
iexplore.exe
GET
200
142.250.185.227:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
2936
iexplore.exe
GET
200
142.250.185.227:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
2936
iexplore.exe
GET
200
142.250.185.227:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEE%2Fke5Q8HG0aENG6mJCKPmQ%3D
US
der
471 b
whitelisted
2936
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?fbfc03f98bc5ce51
US
compressed
4.70 Kb
whitelisted
548
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
1076
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2936
iexplore.exe
167.89.123.54:80
—
SENDGRID
US
suspicious
4
System
192.168.100.255:137
—
—
—
whitelisted
568
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
548
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted
548
iexplore.exe
2.16.187.27:443
www.bing.com
Akamai International B.V.
DE
whitelisted
548
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2936
iexplore.exe
167.89.118.83:80
—
SENDGRID
US
suspicious
548
iexplore.exe
152.199.19.161:443
r20swj13mr.microsoft.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 2.16.187.27
  • 2.16.187.43
whitelisted
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
crl3.digicert.com
  • 192.229.221.95
whitelisted
www.6sense.com
  • 141.193.213.21
  • 141.193.213.20
malicious
6sense.com
  • 141.193.213.20
  • 141.193.213.21
malicious
client-registry.mutinycdn.com
  • 151.101.1.91
  • 151.101.65.91
  • 151.101.129.91
  • 151.101.193.91
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO TLS Handshake Failure
—
—
Potentially Bad Traffic
ET INFO TLS Handshake Failure
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://url5568.6sense-privacy.com/ls/click?upn=52Cym-2FhJfB2shax5RbiU4oOG5Pij13pqw1077EX4ATJbE3uMV4-2F-2B5F2kBG71XeLqFeoJ_bQiQ5-2BGmXnymGnBlJujf8jxSh31Jt4-2FTPaJKOca8Mi4aza-2BRXBzxsxvbF-2Feif-2BeO0gD7vuuHwLNCqpzHk13HP04O1x979zHQSs6oabLz-2FaYQlvxZ48mqZMPbO5V1LJ04RVHDsqS4YBq-2FUzTRHts9cXtm9JAIfbJlQSlRrJUYxoJBrVh5KHXtoQA4zYAThMLO4ZaHxpv3avPBB8pq7zhjbjrZx4S1fitNwtzOwJCLShRxS5m-2FrbdctZqrAb0Dx95O8zvWaKNRF3wnmVs-2FPIkknu7YxbgM4sHNxMuRraSdU7xeJbAlMvl0Uk-2F6DOS-2BhW0HcZyO9z6miYyT-2Fj5zADUY2q1Kdka3Lf7WmiaXjlPY-2FgIBo4d0XIXGW0G3UhUJ-2F8Tl