URL:

https://analyticalconsumables-my.sharepoint.com/:o:/g/personal/peter_hermans_analyticalconsumables_onmicrosoft_com/Egk1kCphkgZOiXYoCB4jBEEBsw0j9bNWn9D0No3yIEp6-A?e=e8Tf39

Full analysis: https://app.any.run/tasks/bb5acb5e-5a7d-4fd4-a5dc-dea38c62fb17
Verdict: Malicious activity
Analysis date: October 05, 2022, 01:22:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

DEA8FA3146AFF84049A3740C312051BC

SHA1:

D560541B1D3DD7AF15E5A4F149A950EE8A297D2D

SHA256:

6AD6DA4815A58D7BA06D9D1076E6ED2EF7102EB30C72A7F073F5FFD2E9E93153

SSDEEP:

3:N8Pcq8QWQ3AW19N+ArL5+KVFSV0y6BE6LU8QWQ3AWdyKRcGK3gYOCiM9CnemkHrG:2PJOQwW19N+AfN40y6BxLUOQwWQucGKK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • iexplore.exe (PID: 1288)
      • iexplore.exe (PID: 3936)
      • MicrosoftEdgeSetup.exe (PID: 1608)

    • Application was dropped or rewritten from another process

      • MicrosoftEdgeSetup.exe (PID: 1608)
      • MicrosoftEdgeUpdate.exe (PID: 3604)
      • MicrosoftEdgeUpdateSetup.exe (PID: 3032)
      • MicrosoftEdgeUpdate.exe (PID: 3732)
      • MicrosoftEdgeUpdate.exe (PID: 328)
      • MicrosoftEdgeUpdate.exe (PID: 3472)
      • MicrosoftEdgeUpdate.exe (PID: 1988)
      • MicrosoftEdgeUpdate.exe (PID: 2864)
      • MicrosoftEdgeUpdate.exe (PID: 1716)
      • MicrosoftEdgeUpdate.exe (PID: 3964)

    • Loads dropped or rewritten executable

      • MicrosoftEdgeUpdate.exe (PID: 3604)
      • MicrosoftEdgeUpdate.exe (PID: 3732)
      • MicrosoftEdgeUpdate.exe (PID: 328)
      • MicrosoftEdgeUpdate.exe (PID: 3472)
      • MicrosoftEdgeUpdate.exe (PID: 1988)
      • MicrosoftEdgeUpdate.exe (PID: 2864)
      • MicrosoftEdgeUpdate.exe (PID: 1716)

    • Loads the Task Scheduler COM API

      • MicrosoftEdgeUpdate.exe (PID: 3732)

    • Changes settings of System certificates

      • MicrosoftEdgeUpdate.exe (PID: 1988)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2068)
      • iexplore.exe (PID: 1288)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 1288)
      • iexplore.exe (PID: 3936)
      • MicrosoftEdgeSetup.exe (PID: 1608)

    • Drops a file with a compile date too recent

      • iexplore.exe (PID: 1288)
      • iexplore.exe (PID: 3936)
      • MicrosoftEdgeSetup.exe (PID: 1608)

    • Checks supported languages

      • MicrosoftEdgeSetup.exe (PID: 1608)
      • MicrosoftEdgeUpdate.exe (PID: 3604)
      • MicrosoftEdgeUpdateSetup.exe (PID: 3032)
      • MicrosoftEdgeUpdate.exe (PID: 3732)
      • MicrosoftEdgeUpdate.exe (PID: 328)
      • MicrosoftEdgeUpdate.exe (PID: 3472)
      • MicrosoftEdgeUpdate.exe (PID: 1988)
      • MicrosoftEdgeUpdate.exe (PID: 1716)
      • MicrosoftEdgeUpdate.exe (PID: 2864)
      • MicrosoftEdgeUpdate.exe (PID: 3964)

    • Reads the computer name

      • MicrosoftEdgeUpdate.exe (PID: 3604)
      • MicrosoftEdgeUpdate.exe (PID: 3732)
      • MicrosoftEdgeUpdate.exe (PID: 328)
      • MicrosoftEdgeUpdate.exe (PID: 1988)
      • MicrosoftEdgeUpdate.exe (PID: 2864)
      • MicrosoftEdgeUpdate.exe (PID: 1716)
      • MicrosoftEdgeUpdate.exe (PID: 3964)

    • Creates a directory in Program Files

      • MicrosoftEdgeUpdateSetup.exe (PID: 3032)
      • MicrosoftEdgeUpdate.exe (PID: 3732)
      • MicrosoftEdgeUpdate.exe (PID: 1716)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 3732)

    • Creates files in the program directory

      • MicrosoftEdgeUpdate.exe (PID: 3732)
      • MicrosoftEdgeUpdateSetup.exe (PID: 3032)

    • Disables SEHOP

      • MicrosoftEdgeUpdate.exe (PID: 3732)

    • Creates a software uninstall entry

      • MicrosoftEdgeUpdate.exe (PID: 3732)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdate.exe (PID: 3472)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 1988)
      • MicrosoftEdgeUpdate.exe (PID: 3964)

    • Executed as Windows Service

      • MicrosoftEdgeUpdate.exe (PID: 1716)

    • Application launched itself

      • MicrosoftEdgeUpdate.exe (PID: 1716)

    • Creates files in the Windows directory

      • MicrosoftEdgeUpdate.exe (PID: 3964)

    • Adds / modifies Windows certificates

      • MicrosoftEdgeUpdate.exe (PID: 1988)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 3936)
      • iexplore.exe (PID: 2068)
      • iexplore.exe (PID: 1288)

    • Changes internet zones settings

      • iexplore.exe (PID: 3936)

    • Reads the computer name

      • iexplore.exe (PID: 3936)
      • iexplore.exe (PID: 1288)
      • iexplore.exe (PID: 2068)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2068)
      • iexplore.exe (PID: 1288)
      • iexplore.exe (PID: 3936)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2068)
      • iexplore.exe (PID: 3936)
      • iexplore.exe (PID: 1288)
      • MicrosoftEdgeUpdate.exe (PID: 1988)
      • MicrosoftEdgeUpdate.exe (PID: 3964)

    • Application launched itself

      • iexplore.exe (PID: 3936)

    • Creates files in the user directory

      • iexplore.exe (PID: 1288)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2068)
      • iexplore.exe (PID: 1288)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3936)

    • Dropped object may contain Bitcoin addresses

      • MicrosoftEdgeSetup.exe (PID: 1608)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
13
Malicious processes
11
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start iexplore.exe iexplore.exe iexplore.exe microsoftedgesetup.exe microsoftedgeupdate.exe no specs microsoftedgeupdatesetup.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdate.exe

Process information

PID
CMD
Path
Indicators
Parent process
328"C:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvcC:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.167.21
Modules
Images
c:\program files\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
1288"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3936 CREDAT:3151112 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\kernel32.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
1608"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\MicrosoftEdgeSetup.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\MicrosoftEdgeSetup.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update Setup
Exit code:
0
Version:
1.3.167.21
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\microsoftedgesetup.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
1716"C:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svcC:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.167.21
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\program files\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\rpcrt4.dll
1988"C:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNjcuMjEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNjcuMjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RDU1NDZFQzgtQUVDNS00ODAzLUE3OEQtRDg0RTNGOTQxNzE2fSIgdXNlcmlkPSJ7QjJCRjY2MEUtQUIyNy00QjRFLUI1RjYtOTE3RDRFRENEODJDfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezcwMTFEMkU0LUJFNUMtNEEwRi1CNENBLUVDQTk2M0ZCNkVFQn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI0IiBwaHlzbWVtb3J5PSIzIiBkaXNrX3R5cGU9IjAiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjYuMS43NjAxLjI0NTQ2IiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing4NiIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREVMTCIgcHJvZHVjdF9uYW1lPSJERUxMIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjE2Ny4yMSIgbGFuZz0iZW4iIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5NDg2MTUyMzQzIiBpbnN0YWxsX3RpbWVfbXM9IjExNTEiLz48L2FwcD48L3JlcXVlc3Q-C:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.167.21
Modules
Images
c:\program files\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
2068"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3936 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2864"C:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&usagestats=1&lang=en" /installsource taggedmi /sessionid "{D5546EC8-AEC5-4803-A78D-D84E3F941716}"C:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.167.21
Modules
Images
c:\program files\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
3032"C:\Users\admin\AppData\Local\Temp\EU6BD5.tmp\MicrosoftEdgeUpdateSetup.exe" /installsource taggedmi /install "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&usagestats=1&lang=en" /installelevated /nomitagC:\Users\admin\AppData\Local\Temp\EU6BD5.tmp\MicrosoftEdgeUpdateSetup.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update Setup
Exit code:
0
Version:
1.3.167.21
Modules
Images
c:\users\admin\appdata\local\temp\eu6bd5.tmp\microsoftedgeupdatesetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
3472"C:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserverC:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.167.21
Modules
Images
c:\program files\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
3604C:\Users\admin\AppData\Local\Temp\EU6BD5.tmp\MicrosoftEdgeUpdate.exe /installsource taggedmi /install "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&usagestats=1&lang=en"C:\Users\admin\AppData\Local\Temp\EU6BD5.tmp\MicrosoftEdgeUpdate.exe—MicrosoftEdgeSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.167.21
Modules
Images
c:\users\admin\appdata\local\temp\eu6bd5.tmp\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\rpcrt4.dll
Total events
25 071
Read events
24 335
Write events
721
Delete events
15

Modification events

(PID) Process:(3936) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3936) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
18541408
(PID) Process:(3936) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30988377
(PID) Process:(3936) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
318703908
(PID) Process:(3936) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30988377
(PID) Process:(3936) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3936) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3936) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3936) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3936) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
103
Suspicious files
13
Text files
62
Unknown types
12

Dropped files

PID
Process
Filename
Type
3936iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442der
MD5:—
SHA256:—
2068iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_1941775A515122A167E3FBACF08992E1binary
MD5:—
SHA256:—
2068iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
2068iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
2068iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\BrowserSupport[1].htmhtml
MD5:—
SHA256:—
2068iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_1941775A515122A167E3FBACF08992E1der
MD5:—
SHA256:—
3936iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442binary
MD5:—
SHA256:—
3936iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\imagestore\f7ruq93\imagestore.datbinary
MD5:—
SHA256:—
1288iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776der
MD5:—
SHA256:—
1288iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\ef-a24652[1].csstext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
70
DNS requests
30
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1288
iexplore.exe
GET
—
104.18.20.226:80
http://ocsp2.globalsign.com/rootr3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCEHr7M35ZTSPHb9t8TGKb2tY%3D
US
—
—
whitelisted
1288
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
US
der
471 b
whitelisted
3936
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
1288
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
—
—
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D
US
der
471 b
whitelisted
1288
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA9bw6F2y3ieICDHiTyBZ7Q%3D
US
der
1.47 Kb
whitelisted
2068
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEA8XGkjG8iOAkhjNLtbdwOg%3D
US
der
471 b
whitelisted
1288
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D
US
der
471 b
whitelisted
1288
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
1288
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1288
iexplore.exe
2.16.106.74:443
statics-marketingsites-neu-ms-com.akamaized.net
Akamai International B.V.
DE
whitelisted
2068
iexplore.exe
13.107.138.9:443
analyticalconsumables-my.sharepoint.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
suspicious
2068
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
3936
iexplore.exe
204.79.197.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3936
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
3936
iexplore.exe
13.107.138.9:443
analyticalconsumables-my.sharepoint.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
suspicious
1288
iexplore.exe
2.18.233.62:443
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1288
iexplore.exe
152.199.19.160:443
ajax.aspnetcdn.com
EDGECAST
US
whitelisted
1288
iexplore.exe
2.16.106.112:443
mwf-service.akamaized.net
Akamai International B.V.
DE
whitelisted
1288
iexplore.exe
13.107.246.65:443
wcpstatic.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
analyticalconsumables-my.sharepoint.com
  • 13.107.136.9
  • 13.107.138.9
suspicious
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
www.microsoft.com
  • 2.18.233.62
whitelisted
assets.adobedtm.com
  • 2.18.232.23
whitelisted
polyfill.io
  • 151.101.65.26
  • 151.101.1.26
  • 151.101.129.26
  • 151.101.193.26
whitelisted
ajax.aspnetcdn.com
  • 152.199.19.160
whitelisted
statics-marketingsites-neu-ms-com.akamaized.net
  • 2.16.106.74
  • 2.16.106.96
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://analyticalconsumables-my.sharepoint.com/:o:/g/personal/peter_hermans_analyticalconsumables_onmicrosoft_com/Egk1kCphkgZOiXYoCB4jBEEBsw0j9bNWn9D0No3yIEp6-A?e=e8Tf39