URL:

https://stripchat.com/urblonde

Full analysis: https://app.any.run/tasks/e77fb1eb-dcce-456d-801c-9cb34798a4e0
Verdict: Malicious activity
Analysis date: November 01, 2023, 04:48:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
SHA1:

1C27331CC832FE21F58CD2F57E680A1CE58E39B0

SHA256:

61FC63E99C2C752B6FEBF950F498051ABCA85CA6B2726E62AA6B1BFC97CFE04A

SSDEEP:

3:N8ckaGKKPL2:2cLKy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 1812)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
300"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1812 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1812"C:\Program Files\Internet Explorer\iexplore.exe" "https://stripchat.com/urblonde"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
15 790
Read events
15 725
Write events
63
Delete events
2

Modification events

(PID) Process:(1812) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(1812) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(1812) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(1812) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1812) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1812) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1812) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1812) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1812) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1812) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
35
Suspicious files
11
Text files
46
Unknown types
0

Dropped files

PID
Process
Filename
Type
300iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\U2WLBB2S.txttext
MD5:ED30BF824400EF0DC27DCF32C108A40D
SHA256:274FEC356483C62B89985742B8010451B80C1D4EA142614948B5B62CDE141A33
300iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
300iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:947E4F16C47960895DFE4E8DBBAD83C0
SHA256:3DC6830B4D1FF3A78C8458643C104682C4905C3DA982051DE5C8958246FF5673
300iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\8YDOSRLJ.txttext
MD5:DC139AE1D1F326E744F27059F9761FCB
SHA256:3865B2F531758C71F2E5A1A6E638C9707B34BBE110A4D4BF097ADC6DED13769B
300iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\RM9063P6.txttext
MD5:878EDD34320B147CC5D61D6AC6EE1B49
SHA256:35CC6E301744854F974B646752C06A4BCCA469D80D5EF5C05BA73D89D6CA4673
300iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:A016B8727C105822AAD83AF8344C0DB3
SHA256:3052CDE9C3E7DD8487C99D8870C4180BF369AD93FDDBB660279E05DF6CFFAC4E
300iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\A8KU04S1.txttext
MD5:281B0578748859600722744AEFA26564
SHA256:793191DE0E8B20B85F3062F45893CFFD92C576DF99C3FE5E6B5942D4DCCB2E5E
300iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\PE70JEI9.txttext
MD5:94286B3A68E968CDB82F708AB71C385A
SHA256:8BDE74CD43FD7DFDA8F2136B0DC3EBA39D717C66B88FB83CAE0A4BC032E9E555
300iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\ERE69H1J.txttext
MD5:8ACA815F7E7DDCBE17457AC8386F514D
SHA256:E3946A194F770B7080776074AD898F61FDD232A896A1811AE251E87A8C62D970
300iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\IMB32IE9.txttext
MD5:137E6BC6F714DF726A7B8123EB80626E
SHA256:D251403F77ECD1DBE343FF816FF72CDDEB3DFC42FA0D6B59E6A90DFF62C44B2B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
28
DNS requests
10
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
300
iexplore.exe
GET
200
67.27.159.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?9fd49ee1f50b7922
unknown
compressed
4.66 Kb
unknown
300
iexplore.exe
GET
200
67.27.159.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5495137de89cafc2
unknown
compressed
4.66 Kb
unknown
300
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
unknown
binary
1.47 Kb
unknown
1812
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
313 b
unknown
1812
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
300
iexplore.exe
104.18.63.130:443
—
CLOUDFLARENET
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
300
iexplore.exe
67.27.159.126:80
ctldl.windowsupdate.com
LEVEL3
US
malicious
300
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
300
iexplore.exe
104.18.63.124:443
assets.strpst.com
CLOUDFLARENET
—
unknown
2656
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1812
iexplore.exe
104.18.63.124:443
assets.strpst.com
CLOUDFLARENET
—
unknown
1812
iexplore.exe
23.36.162.68:443
www.bing.com
Akamai International B.V.
DE
unknown
1812
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
ctldl.windowsupdate.com
  • 67.27.159.126
  • 67.27.158.126
  • 8.253.95.249
  • 8.253.95.120
  • 8.241.122.126
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
assets.strpst.com
  • 104.18.63.124
  • 104.18.63.132
unknown
static-cdn.strpst.com
  • 104.18.63.124
  • 104.18.63.132
unknown
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 23.36.162.68
  • 23.36.162.71
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://stripchat.com/urblonde