File name:

SynapseXBadBussinessScript.bat

Full analysis: https://app.any.run/tasks/a6e0bbe6-7bfa-4df3-a777-48a84dcc3d66
Verdict: Malicious activity
Analysis date: February 05, 2022, 16:27:38
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/plain
File info: ASCII text, with CRLF line terminators
MD5:

5728F29E06544ED7459FCD159EACCF32

SHA1:

37F4D525A28165349E787B3757D3E7ACE28F9816

SHA256:

1A56E85A263E7C68BA30EE91AF1D913371F1DE1E6FC11D33C118910AEB08DCCF

SSDEEP:

24:RXkmHQNOvJo1RV3JcviT/PMH1LwxItXImnOn:R0mHoORmVZcv+P61MxWIr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Checks supported languages

      • cmd.exe (PID: 1380)

    • Reads the computer name

      • cmd.exe (PID: 1380)

    • Starts Internet Explorer

      • cmd.exe (PID: 1380)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2004)
      • iexplore.exe (PID: 1988)
      • iexplore.exe (PID: 3868)
      • iexplore.exe (PID: 556)
      • iexplore.exe (PID: 2560)
      • iexplore.exe (PID: 3168)
      • iexplore.exe (PID: 3224)
      • iexplore.exe (PID: 3784)
      • iexplore.exe (PID: 3176)
      • iexplore.exe (PID: 476)
      • iexplore.exe (PID: 2676)
      • iexplore.exe (PID: 3616)
      • iexplore.exe (PID: 2460)
      • iexplore.exe (PID: 4464)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 4060)
      • iexplore.exe (PID: 3332)
      • iexplore.exe (PID: 2004)
      • iexplore.exe (PID: 468)
      • iexplore.exe (PID: 1988)
      • iexplore.exe (PID: 1956)
      • iexplore.exe (PID: 3868)
      • iexplore.exe (PID: 556)
      • iexplore.exe (PID: 3224)
      • iexplore.exe (PID: 2560)
      • iexplore.exe (PID: 3168)
      • iexplore.exe (PID: 2612)
      • iexplore.exe (PID: 3784)
      • iexplore.exe (PID: 476)
      • iexplore.exe (PID: 3176)
      • iexplore.exe (PID: 3616)
      • iexplore.exe (PID: 2676)
      • iexplore.exe (PID: 2460)
      • iexplore.exe (PID: 4464)

    • Checks supported languages

      • iexplore.exe (PID: 2612)
      • iexplore.exe (PID: 4060)
      • iexplore.exe (PID: 468)
      • iexplore.exe (PID: 3332)
      • iexplore.exe (PID: 2004)
      • iexplore.exe (PID: 1956)
      • iexplore.exe (PID: 1988)
      • iexplore.exe (PID: 3868)
      • iexplore.exe (PID: 2560)
      • iexplore.exe (PID: 556)
      • iexplore.exe (PID: 3168)
      • iexplore.exe (PID: 3224)
      • iexplore.exe (PID: 3784)
      • iexplore.exe (PID: 476)
      • iexplore.exe (PID: 3176)
      • iexplore.exe (PID: 3616)
      • iexplore.exe (PID: 2460)
      • iexplore.exe (PID: 2676)
      • iexplore.exe (PID: 4464)

    • Application launched itself

      • iexplore.exe (PID: 4060)
      • iexplore.exe (PID: 2612)
      • iexplore.exe (PID: 468)
      • iexplore.exe (PID: 3332)
      • iexplore.exe (PID: 1956)

    • Changes internet zones settings

      • iexplore.exe (PID: 4060)
      • iexplore.exe (PID: 2612)
      • iexplore.exe (PID: 468)
      • iexplore.exe (PID: 1956)
      • iexplore.exe (PID: 3332)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2004)
      • iexplore.exe (PID: 1988)
      • iexplore.exe (PID: 3868)
      • iexplore.exe (PID: 556)
      • iexplore.exe (PID: 2560)
      • iexplore.exe (PID: 3224)
      • iexplore.exe (PID: 3784)
      • iexplore.exe (PID: 3168)
      • iexplore.exe (PID: 3176)
      • iexplore.exe (PID: 3616)
      • iexplore.exe (PID: 476)
      • iexplore.exe (PID: 2612)
      • iexplore.exe (PID: 4060)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2004)
      • iexplore.exe (PID: 1988)
      • iexplore.exe (PID: 3868)
      • iexplore.exe (PID: 556)
      • iexplore.exe (PID: 2560)
      • iexplore.exe (PID: 3784)
      • iexplore.exe (PID: 3224)
      • iexplore.exe (PID: 3168)
      • iexplore.exe (PID: 3176)
      • iexplore.exe (PID: 476)
      • iexplore.exe (PID: 2612)
      • iexplore.exe (PID: 3616)
      • iexplore.exe (PID: 4060)

    • Reads internet explorer settings

      • iexplore.exe (PID: 556)
      • iexplore.exe (PID: 2560)
      • iexplore.exe (PID: 3868)
      • iexplore.exe (PID: 3224)
      • iexplore.exe (PID: 3784)
      • iexplore.exe (PID: 2004)
      • iexplore.exe (PID: 1988)
      • iexplore.exe (PID: 3616)
      • iexplore.exe (PID: 3168)
      • iexplore.exe (PID: 3176)
      • iexplore.exe (PID: 476)

    • Creates files in the user directory

      • iexplore.exe (PID: 556)
      • iexplore.exe (PID: 3168)
      • iexplore.exe (PID: 2560)
      • iexplore.exe (PID: 2004)
      • iexplore.exe (PID: 1988)
      • iexplore.exe (PID: 3868)
      • iexplore.exe (PID: 3224)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
58
Monitored processes
20
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start cmd.exe no specs iexplore.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe no specs iexplore.exe no specs iexplore.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
468"C:\Program Files\Internet Explorer\iexplore.exe" https://hentaihaven.xxx/C:\Program Files\Internet Explorer\iexplore.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\iertutil.dll
476"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:4060 CREDAT:3413266 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
556"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:4060 CREDAT:595205 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1380C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\SynapseXBadBussinessScript.bat" "C:\Windows\system32\cmd.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1956"C:\Program Files\Internet Explorer\iexplore.exe" https://hentaihaven.xxx/C:\Program Files\Internet Explorer\iexplore.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
1988"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:4060 CREDAT:595203 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\iertutil.dll
2004"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:4060 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2460"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3332 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2560"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:4060 CREDAT:464134 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2612"C:\Program Files\Internet Explorer\iexplore.exe" https://hentaihaven.xxx/C:\Program Files\Internet Explorer\iexplore.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
26 934
Read events
26 557
Write events
376
Delete events
1

Modification events

(PID) Process:(4060) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(4060) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(4060) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30939821
(PID) Process:(4060) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(4060) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30939821
(PID) Process:(4060) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4060) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4060) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4060) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(4060) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
2
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
3868iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\359K4TPT.htmhtml
MD5:F4BCE1D437A943B00E7B796FC083B8B1
SHA256:95E490EBB06046EC459D8C79A801F042FD2AF74EBED8C643E4CF3E76AF44623B
2560iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\L5TAE5AD.htmhtml
MD5:F230107BDDC097E745A2538E5E945B20
SHA256:A93E385972D32686529A20C7F1FDB9034E5AD7312313DA953E61053DB30C5B20
3868iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\GZPAC1LX.htmhtml
MD5:32066D6E37E6BDA2846B381B0A65C412
SHA256:A384AB9A518ABFC74DA0FB49A0561C8728E57DD7E1E1B532308E64596F1FEB44
2560iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\G63JYUJD.htmhtml
MD5:495D24884931F597EF6F8D2A9D1BF047
SHA256:22276E4E1B95A93B51DCBD08F52FAD37D15385D1FC9CBBDECB418FC5BBA9F6E9
2004iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\FE1G0IN6.htmhtml
MD5:6C5E4865DF3CDC4CC1DD2A3449F9430D
SHA256:107DC51E3F9C6761AC10BFCDD51C4A6C9FB63A895C204333BDD9EFCCCEAFB46B
2004iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:8C27DFA645426B90D4B1EFB9F5F58542
SHA256:FDA15D552F1B981F75B02E463B751D742EB57994374A5DA8A7925F7413E2D647
2004iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
60
TCP/UDP connections
1 135
DNS requests
39
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3868
iexplore.exe
GET
200
23.32.238.201:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a6a21862450821ac
US
compressed
4.70 Kb
whitelisted
3868
iexplore.exe
GET
200
23.32.238.201:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?72c316476c43f3ec
US
compressed
4.70 Kb
whitelisted
556
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
2560
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
1988
iexplore.exe
GET
304
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
—
—
whitelisted
2004
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
2004
iexplore.exe
GET
200
23.32.238.201:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8d6eb47dd6da4078
US
compressed
4.70 Kb
whitelisted
3868
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
1988
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
1988
iexplore.exe
GET
200
23.32.238.201:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a6e73307e5de00dc
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2004
iexplore.exe
104.21.235.106:443
hentaihaven.xxx
Cloudflare Inc
US
suspicious
1988
iexplore.exe
104.21.235.106:443
hentaihaven.xxx
Cloudflare Inc
US
suspicious
3868
iexplore.exe
104.21.235.106:443
hentaihaven.xxx
Cloudflare Inc
US
suspicious
2004
iexplore.exe
23.32.238.201:80
ctldl.windowsupdate.com
XO Communications
US
suspicious
2560
iexplore.exe
104.21.235.106:443
hentaihaven.xxx
Cloudflare Inc
US
suspicious
556
iexplore.exe
104.21.235.106:443
hentaihaven.xxx
Cloudflare Inc
US
suspicious
3224
iexplore.exe
104.21.235.106:443
hentaihaven.xxx
Cloudflare Inc
US
suspicious
3168
iexplore.exe
104.21.235.106:443
hentaihaven.xxx
Cloudflare Inc
US
suspicious
1988
iexplore.exe
23.32.238.201:80
ctldl.windowsupdate.com
XO Communications
US
suspicious
3868
iexplore.exe
23.32.238.201:80
ctldl.windowsupdate.com
XO Communications
US
suspicious

DNS requests

Domain
IP
Reputation
hentaihaven.xxx
  • 104.21.235.106
  • 104.21.235.105
suspicious
ctldl.windowsupdate.com
  • 23.32.238.201
  • 23.32.238.178
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
a.realsrv.com
  • 205.185.216.42
  • 205.185.216.10
whitelisted
www.googletagmanager.com
  • 172.217.23.104
whitelisted
www.google.com
  • 142.250.181.228
malicious
static.cloudflareinsights.com
  • 104.16.94.65
  • 104.16.95.65
whitelisted
x1.c.lencr.org
  • 23.45.105.185
whitelisted
cdnjs.cloudflare.com
  • 104.16.19.94
  • 104.16.18.94
whitelisted
ocsp.pki.goog
  • 142.250.185.131
whitelisted

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET POLICY DNS Query For XXX Adult Site Top Level Domain
1988
iexplore.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SynapseXBadBussinessScript.bat