URL:

linkr.it

Full analysis: https://app.any.run/tasks/a61e7a2a-80af-4c5e-ae93-557ad64fce31
Verdict: Malicious activity
Analysis date: March 24, 2024, 15:23:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

F23611E693D456C4CC7BCC42B83C4773

SHA1:

A9C51C76E08391615FEC569C34BE8817C6F3CACD

SHA256:

2416AB3A87F6E941C300D8766AE8926D9DFC58E6CD4CF1337878D5B17D42DCD1

SSDEEP:

3:IOoR:IOoR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 120)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
120"C:\Program Files\Internet Explorer\iexplore.exe" "linkr.it"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2580"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:120 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
15 563
Read events
15 347
Write events
181
Delete events
35

Modification events

(PID) Process:(120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31096319
(PID) Process:(120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31096319
(PID) Process:(120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
14
Text files
37
Unknown types
9

Dropped files

PID
Process
Filename
Type
2580iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAder
MD5:68759899356942A8F2DE235B5DF5D2CA
SHA256:FDA9FA71EFECD76A2CC5D20E6832AB850F86CAB1CFAF39815EF50EAA867F10E4
2580iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_45E3C223BCF135987E4038FB6B0DBA13binary
MD5:28AF8D046847CAB7BBCDB495E65A3A0A
SHA256:1AD50A769F770E43BFDAA7D4C1A25131D3AEB30033B70F77291D1E27357B9B26
2580iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_45E3C223BCF135987E4038FB6B0DBA13binary
MD5:037AE8164352CA91E80AD33054D1906D
SHA256:07C018EB07002663D5248DAA8A65EAF587955E3DB45735E7E3AC9CB13D7D664E
2580iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\76FFB649A953EC7FB622C159BC958D08_FE3366BFB2AA955800AE363369E1FD71binary
MD5:EC2BDA1FF770D7F243241464B4E5597E
SHA256:3FE6402C6E20ECA3CBDE51A43AD57617482C4A9E7CE9A94003F58024D97846A8
2580iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B8C81F9F021284E705D654F80C5EB7C6_9FF84D25E9B69A79739BD1C5E0BDBE5Fbinary
MD5:C72145340121158D6727C271C3F6BFCE
SHA256:B6B27C686D4C105230D24C75260BA124C931861614648060019DB3B60388DB72
2580iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B8C81F9F021284E705D654F80C5EB7C6_9FF84D25E9B69A79739BD1C5E0BDBE5Fbinary
MD5:1C404DB90FD7203F30D06BB2DC38D14F
SHA256:4ABF5AE0D14F57C02935DCFF9B891955B211BA04F3EC7482D1FE30405B311972
2580iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\K8H09DRP.htmhtml
MD5:89EC2103ACF6F81166C9E5C7B8A4892E
SHA256:A37F8115A36924156275DDF801E662B51EF740E868A51F300EFD05A57AC5852A
2580iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\chunk-vendors.215cdcb3[1].csstext
MD5:0806D557638CADC2991E4F29C535355D
SHA256:E7F59C636B141666A6BA120C8EAECBFF11F734ED13E6FBE4DC1BCE9EEA83F51E
2580iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:268808F7C7ABE350F2F03B240E010AAD
SHA256:3CA4A79015F9694B89B6DA1408815F61005271FB14D7DF54424C4BF510BD8E9A
2580iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:76748547EC78D3AA6BBE63BC4E9FD44C
SHA256:3F55EB2C8BE06068B2449FD0F09D638E46F988F97A96F3CC3494448F70C72F34
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
39
DNS requests
17
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2580
iexplore.exe
GET
301
34.149.124.255:80
http://linkr.it/
unknown
—
—
unknown
2580
iexplore.exe
GET
304
184.24.77.199:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?92967c53a8c0ec29
unknown
—
—
unknown
2580
iexplore.exe
GET
200
172.217.16.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
2580
iexplore.exe
GET
200
172.217.16.131:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIAjrICMzZli2TN25s%3D
unknown
binary
724 b
unknown
2580
iexplore.exe
GET
200
172.217.16.131:80
http://ocsp.pki.goog/s/gts1d4/9GUPy_q6V8k/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSMBFDqU0NJQdZdEGU3bkhj0FoRrQQUJeIYDrJXkZQq5dRdhpCD3lOzuJICEFFgsl7VKHV5Cramw56Hh4Y%3D
unknown
binary
471 b
unknown
2580
iexplore.exe
GET
200
172.217.16.131:80
http://ocsp.pki.goog/s/gts1d4/UGWQK98B6mI/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSMBFDqU0NJQdZdEGU3bkhj0FoRrQQUJeIYDrJXkZQq5dRdhpCD3lOzuJICEF1MODOpzWGTCUk0x6lARbk%3D
unknown
binary
471 b
unknown
2580
iexplore.exe
GET
200
172.217.16.131:80
http://ocsp.pki.goog/s/gts1d4/jHL3Mn6QlG8/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSMBFDqU0NJQdZdEGU3bkhj0FoRrQQUJeIYDrJXkZQq5dRdhpCD3lOzuJICEQCTfm1Q1KhAghLcXHXGrUX6
unknown
binary
472 b
unknown
2580
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
unknown
binary
1.47 Kb
unknown
120
iexplore.exe
GET
304
184.24.77.199:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e55f0cb727843010
unknown
—
—
unknown
120
iexplore.exe
GET
304
184.24.77.199:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?aeb32cb922858c96
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
2580
iexplore.exe
34.149.124.255:80
linkr.it
GOOGLE
US
unknown
2580
iexplore.exe
34.149.124.255:443
linkr.it
GOOGLE
US
unknown
2580
iexplore.exe
184.24.77.199:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
2580
iexplore.exe
172.217.16.131:80
ocsp.pki.goog
GOOGLE
US
whitelisted
2580
iexplore.exe
34.111.117.231:443
www.linkr.it
GOOGLE
US
unknown
2580
iexplore.exe
104.22.24.131:443
embed.tawk.to
CLOUDFLARENET
—
unknown
2580
iexplore.exe
34.120.72.66:443
cdn.static.linkr.bio
GOOGLE-CLOUD-PLATFORM
US
unknown

DNS requests

Domain
IP
Reputation
linkr.it
  • 34.149.124.255
malicious
ctldl.windowsupdate.com
  • 184.24.77.199
  • 184.24.77.207
  • 184.24.77.193
  • 184.24.77.181
  • 184.24.77.186
  • 184.24.77.182
whitelisted
ocsp.pki.goog
  • 172.217.16.131
whitelisted
www.linkr.it
  • 34.111.117.231
unknown
embed.tawk.to
  • 104.22.24.131
  • 172.67.38.66
  • 104.22.25.131
whitelisted
cdn.static.linkr.bio
  • 34.120.72.66
unknown
ocsp.digicert.com
  • 192.229.221.95
whitelisted
va.tawk.to
  • 104.22.24.131
  • 104.22.25.131
  • 172.67.38.66
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.168
  • 104.126.37.184
  • 104.126.37.155
  • 104.126.37.139
  • 104.126.37.171
  • 104.126.37.153
  • 104.126.37.154
  • 104.126.37.161
  • 104.126.37.160
whitelisted

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query for .to TLD
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query for .to TLD
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
linkr.it