URL:

https://sellix.io/OWkeys

Full analysis: https://app.any.run/tasks/fc089f0b-4c48-474d-87ba-4c4592ca46bd
Verdict: No threats detected
Analysis date: November 24, 2020, 13:10:37
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

83EC8F545A3A2DB134D2ADF8F9352255

SHA1:

4F9510E00E7AB86AB4AC3A3B8DB9E5EB7E26965E

SHA256:

182210D19BC9E35AFB8D1145A9DC84F376985EAEEB299CED25E8298EF83E63E6

SSDEEP:

3:N8NTEW:2N/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3060)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 3060)
      • iexplore.exe (PID: 2724)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3060)
      • iexplore.exe (PID: 2724)

    • Changes internet zones settings

      • iexplore.exe (PID: 2724)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3060)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3060)
      • iexplore.exe (PID: 2724)

    • Checks supported languages

      • iexplore.exe (PID: 2724)
      • iexplore.exe (PID: 3060)

    • Creates files in the user directory

      • iexplore.exe (PID: 3060)
      • iexplore.exe (PID: 2724)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2724)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2724)

    • Application launched itself

      • iexplore.exe (PID: 2724)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2724"C:\Program Files\Internet Explorer\iexplore.exe" https://sellix.io/OWkeysC:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\shell32.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\cryptbase.dll
3060"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2724 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\comdlg32.dll
c:\program files\internet explorer\ieshims.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\shell32.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
Total events
13 839
Read events
13 746
Write events
91
Delete events
2

Modification events

(PID) Process:(2724) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{7A975252-2E56-11EB-9A22-12A9866C77DE}
Value:
0
(PID) Process:(2724) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(2724) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2724) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2724) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A7000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2724) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2724) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2724) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2724) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2724) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
0
Suspicious files
15
Text files
137
Unknown types
28

Dropped files

PID
Process
Filename
Type
3060iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\2Q9SQDGY.txttext
MD5:4533144E958B5F5AC58FDA8AAB9F3444
SHA256:6C473B3B47FCF662F9426201A207C0AD96C33264C056B4269928B1323EB9764F
3060iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CC197601BE0898B7B0FCC91FA15D8A69_3EEEDD2B04859625AAE2F1CF7B24A129der
MD5:F22B1C487D0794B59F6BBA973C47DD2B
SHA256:FB6F04CF0D6DF3909648F5A7A8399F77D5433056621A19292CD6A7589FF812F9
3060iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27der
MD5:5500BBA58EE1AFDDE916DDE338EBAECB
SHA256:95CE4A3ACA650E61C206D5B3DFC12716CD33111E67D5A606AADE02955EDD1FE0
3060iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:4A8E23CBADBEEE71EEBD849CA3753BFB
SHA256:067BA2475F6F9CEE44C8A80B907199C33CEB37589E7412EB2E7D48A6395F3264
3060iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\102[1].csstext
MD5:A9E9D9BF2490BA784866628ABB7377BF
SHA256:5F12AF83F018CF0E00C5ADF52063D2DC67328149E02B7AF0A1F0406D4E9BE0FD
3060iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\85[1].csstext
MD5:9BDC65EA598D1B085B1255AF1C725B09
SHA256:B25D6EE6F0DD1823D6F4519718F817AC4F1C1461F2BBD665A35C9FC1CF8E7378
3060iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\HCXILFF5.txttext
MD5:17D52E9DC8CAB2953A8F85B751D1F385
SHA256:7C2999063FAE952FD835FB7610994FE8F488DC64268D5BA980AAE98250AAF461
3060iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288Bbinary
MD5:68FB4C15794D7DEE7580AFCB3A361100
SHA256:7204ADD1AA0D5E83D5F270FCC9E018D043A81581D2835AB65ACE8371E0D4A4B4
3060iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\loader[1].pngimage
MD5:8B1EF17D0B421376546DDB292EC950BD
SHA256:E0B2130C16B8965F18A52AA6D46B9531D53C2786165089657E14D4EEAB78B67D
3060iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\loader[1].csstext
MD5:7FE6E4B5886869C32E002DEE778EBC11
SHA256:997AD47640AF8F2269CA186F1F991B453B2155919981F578A60D63B1E127B14D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
78
DNS requests
22
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3060
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
3060
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
3060
iexplore.exe
GET
200
172.217.23.99:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
3060
iexplore.exe
GET
200
172.217.23.99:80
http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDa2MTpyZrzlQgAAAAAYth4
US
der
472 b
whitelisted
3060
iexplore.exe
GET
200
172.217.23.99:80
http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDa2MTpyZrzlQgAAAAAYth4
US
der
472 b
whitelisted
3060
iexplore.exe
GET
200
172.217.23.99:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
3060
iexplore.exe
GET
200
13.224.89.219:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
1.70 Kb
whitelisted
3060
iexplore.exe
GET
200
172.217.23.99:80
http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEFcLuT0XSrlKAgAAAACAVZE%3D
US
der
471 b
whitelisted
3060
iexplore.exe
GET
200
172.217.23.99:80
http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDgM%2F2Oalb9SggAAAAAYth0
US
der
472 b
whitelisted
3060
iexplore.exe
GET
200
172.217.23.99:80
http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDgM%2F2Oalb9SggAAAAAYth0
US
der
472 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3060
iexplore.exe
104.22.4.33:443
sellix.io
Cloudflare Inc
US
unknown
3060
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3060
iexplore.exe
172.217.18.106:443
fonts.googleapis.com
Google Inc.
US
whitelisted
3060
iexplore.exe
172.217.23.168:443
www.googletagmanager.com
Google Inc.
US
whitelisted
3060
iexplore.exe
172.217.23.99:80
ocsp.pki.goog
Google Inc.
US
whitelisted
3060
iexplore.exe
172.217.18.14:443
www.google-analytics.com
Google Inc.
US
whitelisted
3060
iexplore.exe
65.9.190.115:443
widget.intercom.io
AT&T Services, Inc.
US
unknown
3060
iexplore.exe
172.217.23.99:443
ocsp.pki.goog
Google Inc.
US
whitelisted
3060
iexplore.exe
65.9.190.11:443
js.intercomcdn.com
AT&T Services, Inc.
US
unknown
2724
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
sellix.io
  • 104.22.4.33
  • 104.22.5.33
  • 172.67.8.22
unknown
ocsp.digicert.com
  • 93.184.220.29
whitelisted
fonts.googleapis.com
  • 172.217.18.106
whitelisted
cdn.sellix.io
  • 104.22.4.33
  • 172.67.8.22
  • 104.22.5.33
unknown
www.googletagmanager.com
  • 172.217.23.168
whitelisted
ocsp.pki.goog
  • 172.217.23.99
whitelisted
fonts.gstatic.com
  • 172.217.23.99
whitelisted
api.bing.com
  • 13.107.13.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.google-analytics.com
  • 172.217.18.14
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://sellix.io/OWkeys