download:

splash.php

Full analysis: https://app.any.run/tasks/ae127b81-1745-43fb-9cfa-5d190bf4aa56
Verdict: No threats detected
Analysis date: November 18, 2018, 00:08:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/html
File info: HTML document, ASCII text, with very long lines
MD5:

0F78B8D6FBCF790ED1ED63C3E4AF5957

SHA1:

76AD594A1F710154CCCE1FFCF8592DD7108C6871

SHA256:

1B2406FF41EE7832AD13FC39D033979FF67220AC8B2608CB6E45BC7F2A6C7EFF

SSDEEP:

24:RUMW+Ei0MxCKEipYzX4zXaQvOmR6mRJ0BvUsmR6mRJi0ZLvro5pvJy+q4T:R/W+/fxCKDpYzX4zXXv9f0vwfdvyvJy2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Reads internet explorer settings

      • iexplore.exe (PID: 3380)
      • iexplore.exe (PID: 4088)
      • iexplore.exe (PID: 2220)
      • iexplore.exe (PID: 1252)
      • iexplore.exe (PID: 3276)

    • Changes internet zones settings

      • iexplore.exe (PID: 3020)

    • Creates files in the user directory

      • iexplore.exe (PID: 4088)
      • iexplore.exe (PID: 3020)
      • iexplore.exe (PID: 2220)

    • Reads Microsoft Office registry keys

      • iexplore.exe (PID: 3020)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3020)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2220)
      • iexplore.exe (PID: 1252)
      • iexplore.exe (PID: 3276)
      • iexplore.exe (PID: 3380)
      • iexplore.exe (PID: 4088)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3020)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3020)

    • Application launched itself

      • iexplore.exe (PID: 3020)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.html | HyperText Markup Language (100)

EXIF

HTML

Refresh: 2; url=http://syndication.exosrv.com/splash.php?idzone=2792946&type=8&sub=4&p=http%3A%2F%2Fopenload.co&tested=2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
6
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
1252"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3020 CREDAT:203009C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2220"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3020 CREDAT:137482C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3020"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\splash.php.htmlC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3276"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3020 CREDAT:203010C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3380"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3020 CREDAT:79873C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
4088"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3020 CREDAT:137473C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
1 381
Read events
1 155
Write events
222
Delete events
4

Modification events

(PID) Process:(3020) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3020) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3020) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3020) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(3020) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3020) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000069000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3020) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{15964459-EAC6-11E8-A67C-5254004AAD11}
Value:
0
(PID) Process:(3020) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(3020) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
3
(PID) Process:(3020) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E2070B0000001200000008002100C301
Executable files
0
Suspicious files
3
Text files
321
Unknown types
14

Dropped files

PID
Process
Filename
Type
3020iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico —
MD5:—
SHA256:—
3020iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
4088iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@exosrv[2].txt —
MD5:—
SHA256:—
3020iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF36C68AD12400F339.TMP —
MD5:—
SHA256:—
4088iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@faptitans[1].txt —
MD5:—
SHA256:—
4088iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U2ZG9DE0\faptitans_com[1].txt —
MD5:—
SHA256:—
3380iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012018111820181119\index.datdat
MD5:65491C56AB63E531BB3CF6A1E501CE2E
SHA256:87867BEF9E73F71FE639CAE15A690E82BA6DBF97DFA545ADE90617DD7F97330E
4088iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\titans-orig-4[1].htmhtml
MD5:BE1646771D05DBBE6544D0C2ABFF2DA6
SHA256:1C873F811BF8EC3B849DB85307965FE1D0C391AA56235BB1F132F6F7AB673982
4088iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@exosrv[1].txttext
MD5:2E63C37BDFC9A5271AAF2A7CADF4E08B
SHA256:E52F930BC1269936605BAD781036D9DD0AD73A58C61BBA5E5EEA72754D281D67
4088iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\awpx_click[1].jstext
MD5:CB327E68DD36B7EB3220A5F9BD278D8B
SHA256:E7C47EDCD7ED481DEE6D5B703221F4FEE9C34BC23A133BB70FB7876D6946F870
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
67
DNS requests
28
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4088
iexplore.exe
GET
302
95.211.229.247:80
http://syndication.exosrv.com/splash.php?idzone=2792946&type=8&sub=4&p=http%3A%2F%2Fopenload.co&tested=2
NL
—
—
whitelisted
3020
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
4088
iexplore.exe
GET
200
204.155.159.27:80
http://welcome.faptitans.com/landing/titans-orig-4.html?pid=37&sid=696224&s2s=oodNbVHNbRHNLZHPRQ7M5nT2XT3U1unouunrpsdVTLbO51UtrqZnTOodK6V0rqKabqZbqHT2WS1UzunssntmldK6Z0rpXSuldM6V0rpXOo100l1ptqlnoo3slp4rzloo3o1u4nutndS4ItwfBz2j1C5zpXB9gA--
US
html
1.09 Kb
unknown
4088
iexplore.exe
GET
200
204.155.147.176:80
http://ln.gamesrevenue.com/px1.js
US
text
8.28 Kb
suspicious
4088
iexplore.exe
GET
200
104.37.178.1:80
http://cdn.welcome.pussysaga.com/grevenue/js/exit.js
US
text
931 b
malicious
4088
iexplore.exe
GET
307
23.111.224.1:80
http://r.remarketingpixel.com/px.gif?akey=42c6f09dc9e74035608496705631ef5d
NL
—
—
whitelisted
4088
iexplore.exe
GET
200
104.37.178.1:80
http://cdn.welcome.pussysaga.com/awpx_click.js
US
text
671 b
malicious
4088
iexplore.exe
GET
200
104.37.178.1:80
http://cdn.welcome.faptitans.com/landing/bg/bg-orig-04.jpg
US
image
268 Kb
malicious
4088
iexplore.exe
GET
200
185.70.212.108:80
http://tracker.ero-advertising.com/tracking/rtpixel.php?id=268&uid=88428
NL
binary
20 b
suspicious
4088
iexplore.exe
GET
200
95.211.229.246:80
http://main.exoclick.com/tag.php?goal=d463e4eafcfd7a2c779b390efdb813cf
NL
binary
20 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2220
iexplore.exe
172.217.168.14:80
—
Google Inc.
US
whitelisted
3020
iexplore.exe
104.37.178.1:80
cdn.welcome.pussysaga.com
ISPrime, Inc.
US
malicious
2220
iexplore.exe
216.58.215.228:443
www.google.com
Google Inc.
US
whitelisted
2220
iexplore.exe
216.58.215.228:80
www.google.com
Google Inc.
US
whitelisted
3020
iexplore.exe
216.58.215.228:443
www.google.com
Google Inc.
US
whitelisted
2220
iexplore.exe
172.217.168.3:443
www.gstatic.com
Google Inc.
US
whitelisted
3020
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
4088
iexplore.exe
95.211.229.247:80
syndication.exosrv.com
LeaseWeb Netherlands B.V.
NL
suspicious
4088
iexplore.exe
204.155.159.27:80
welcome.faptitans.com
WZ Communications Inc.
US
unknown
4088
iexplore.exe
204.155.147.176:80
ln.gamesrevenue.com
WZ Communications Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
syndication.exosrv.com
  • 95.211.229.247
whitelisted
welcome.faptitans.com
  • 204.155.159.27
unknown
ln.gamesrevenue.com
  • 204.155.147.176
suspicious
cdn.welcome.pussysaga.com
  • 104.37.178.1
malicious
main.exoclick.com
  • 95.211.229.246
whitelisted
tracker.ero-advertising.com
  • 185.70.212.108
  • 185.70.212.109
suspicious
r.remarketingpixel.com
  • 23.111.224.1
  • 23.111.224.2
whitelisted
cdn.welcome.faptitans.com
  • 104.37.178.1
malicious
landcdn.sexgangsters.com
  • 104.37.178.1
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
splash.php