URL:

www.htx.com

Full analysis: https://app.any.run/tasks/59aca671-4c94-4141-891f-89235b13b37b
Verdict: Malicious activity
Analysis date: February 03, 2024, 04:44:49
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

B5ADC24F786619E3478EEA814EC32692

SHA1:

E1FB15668F5A2F3746FCED8D4B2C77F567C31384

SHA256:

2FD4CA388F58B90623447E467600BFDA09CC9D2DEA0FCA88BF8EA47200BD501C

SSDEEP:

3:ElZI:C2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 752)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
752"C:\Program Files\Internet Explorer\iexplore.exe" "www.htx.com"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3988"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:752 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
12 583
Read events
12 506
Write events
71
Delete events
6

Modification events

(PID) Process:(752) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(752) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(752) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(752) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(752) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(752) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(752) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(752) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(752) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(752) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
37
Text files
32
Unknown types
0

Dropped files

PID
Process
Filename
Type
3988iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:10326785D5452771F95E30BFBBD7374B
SHA256:BDD0510C10C9CED39C9FEE3656FB117F52D3DF53FBCA178886797EE89B88D810
3988iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\E5HLTQZC.htmhtml
MD5:E8171667CEB271E35FF336F0DCF594E7
SHA256:0C9526E3C77CBE8DB1C489F50F93D7F722DD8700053A3A17057E95299FA9CF04
3988iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\_buildManifest[1].jstext
MD5:BD5C2607D686EB1E7C6054A89F8CDCA6
SHA256:0459C83ECE557262B204A94A763E40084F8AE158F50F510ADC91F1295C2676B1
3988iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:7CB76763F4BD4F049DB6A502E7C19CFD
SHA256:3F6A54032F3C3D3F630A2256A4A99F985FF937DA1A43C6645485A4BED8AC8810
3988iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\framework-1d5f584e35fb8583[1].jstext
MD5:4BBEF1179CEEDE28646102D37310747A
SHA256:BC7EA78076A6F5F405FAC61454342150D7CA7616D269B1D0738CFCA3C265D25D
3988iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:F2E4492738C72B047EF8A221FC02D63D
SHA256:DE178C3BE65A23275BA5BECD63040401A2C1CEAF7F165220F6725C0627B71861
3988iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\2e4fe1edc8524040[1].csstext
MD5:DA25CA66717858AE09222C9E1B5968D8
SHA256:5C1276C3B7B13D5BBA9A8C1995A552B9E4BC6654CEE79026D45742A0E95B6ACE
3988iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\webpack-7aadbfa7fdfcc4de[1].jstext
MD5:7FE859733CC22F14D102DC208801F268
SHA256:C9A834C9128690F5FE64A154718C1D676FB63E074D8159504C1E440F77E79E84
3988iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\main-eb68dd5ea96f612f[1].jstext
MD5:D1C0CA1C5AFFAC15B2485CAC52F6EDEE
SHA256:655BFEAD8F7C670FBDB57E9701B2FBF1CE8C22CE5B72EF1E81DB7C1544EFB4A4
3988iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\287-7e42f152aec3cfab[1].jstext
MD5:10C260FE116F91C0953B71D7CDC93144
SHA256:2DD0E2B3F488991D6158545D6EFD56602A81D6F994BC91F708ED75A894664242
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
22
TCP/UDP connections
64
DNS requests
27
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3988
iexplore.exe
GET
301
172.64.147.118:80
http://www.htx.com/
US
—
—
unknown
3988
iexplore.exe
GET
304
23.32.238.201:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1e96081ee66de808
DE
—
—
unknown
3988
iexplore.exe
GET
200
142.250.186.35:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
binary
1.41 Kb
unknown
752
iexplore.exe
GET
304
23.32.238.201:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5565915fab5f2bac
DE
—
—
unknown
3988
iexplore.exe
GET
200
142.250.186.35:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
binary
724 b
unknown
3988
iexplore.exe
GET
200
142.250.186.35:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEE80yiW5Mf2wCipGbb3nZn0%3D
US
binary
471 b
unknown
3988
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEArbkgHwZRcUfHOxRUv3%2B00%3D
US
binary
471 b
unknown
3988
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
binary
471 b
unknown
3988
iexplore.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEQDr2FWbBTQtyLUmnQKqjRpG
US
binary
2.18 Kb
unknown
3988
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
US
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
3988
iexplore.exe
172.64.147.118:80
www.htx.com
CLOUDFLARENET
US
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3988
iexplore.exe
172.64.147.118:443
www.htx.com
CLOUDFLARENET
US
unknown
3988
iexplore.exe
23.32.238.201:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3988
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3988
iexplore.exe
104.18.39.62:443
hbg-fed-static-prd.hbfile.net
CLOUDFLARENET
—
unknown
3988
iexplore.exe
172.217.16.136:443
www.googletagmanager.com
GOOGLE
US
unknown
3988
iexplore.exe
18.165.183.47:443
hbg-prod-fed-public.hbfile.net
—
US
unknown

DNS requests

Domain
IP
Reputation
www.htx.com
  • 172.64.147.118
  • 104.18.40.138
unknown
ctldl.windowsupdate.com
  • 23.32.238.201
  • 23.32.238.178
  • 23.32.238.208
  • 23.32.238.219
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
hbg-fed-static-prd.hbfile.net
  • 104.18.39.62
  • 172.64.148.194
unknown
www.googletagmanager.com
  • 172.217.16.136
whitelisted
app-static-1306115679.file.myqcloud.com
  • 43.152.26.104
  • 43.152.26.221
  • 43.152.26.142
  • 43.152.26.58
  • 43.152.26.151
  • 43.152.44.160
  • 43.152.26.154
  • 43.152.26.197
unknown
hbg-prod-fed-public.hbfile.net
  • 18.165.183.47
  • 18.165.183.123
  • 18.165.183.63
  • 18.165.183.49
unknown
ocsp.pki.goog
  • 142.250.186.35
whitelisted
report.daumoon.com
  • 23.36.162.209
  • 23.36.162.223
unknown
connect.facebook.net
  • 157.240.0.6
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
www.htx.com