URL:

http://45.87.149.34.bc.googleusercontent.com

Full analysis: https://app.any.run/tasks/d3a5945c-3ed1-4b9f-aef3-cbdbeb1e13cb
Verdict: Malicious activity
Analysis date: September 04, 2023, 17:03:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

0B67FCB1657AA2C290CFBC898FAE3193

SHA1:

0A1233D969E6752E8274ECD8C5C96461BD292AFE

SHA256:

7086E8C65B145F5637DA70C971FE66E92C2D54E994F8FD46023E0AC0DEDDB6CC

SSDEEP:

3:N1KGU6pPALtGTn:CGhmGT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2968)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2356"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2968 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\kernel32.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\version.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\iertutil.dll
2968"C:\Program Files\Internet Explorer\iexplore.exe" "http://45.87.149.34.bc.googleusercontent.com"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
12 278
Read events
12 208
Write events
70
Delete events
0

Modification events

(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
21
Text files
32
Unknown types
0

Dropped files

PID
Process
Filename
Type
2356iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\angular-translate.min[1].jstext
MD5:A4D0977836CA8A1C8B6001C029A89B9B
SHA256:55C1FFFB51C6B05E29856C66261FA59FB12393A8E1BB37D5FFB656E2EB387C09
2356iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\conductAllInScope[1]text
MD5:0E84E84CEFE7EC71D48BB27DE0622273
SHA256:CEF5B6D7128FE5E4DDBA4F17D651AE7F2028731E55D344460096693F82A57DB0
2356iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\530dee22-e3c1-4e9f-bf62-c31d510d9656[1].woffwoff
MD5:567300859C426DB066074400B555DF23
SHA256:1E1AC677A9E917935DCD25CA6300C1F038C1FCC3CB82EC79EB64A844E16FA828
2356iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\d5af76d8-a90b-4527-b3a3-182207cc3250[1].woffbinary
MD5:0B9A9504A08D898A26A0D02F04F2D893
SHA256:2ACDE04CDB6F5E78EB8B5C2E29655DEBCCAFFCCF1E9D884F9CCF8B87FE0B28BF
2356iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\fontFace[1].csstext
MD5:338855569759CA44A0734EC4435BCBD0
SHA256:9CD04D1A84368FA539B48CC09D3721091127B9EB2858FF5E4863D6C127CCEDAE
2356iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\8ac9e38d-29c6-41ea-8e47-4ae4d2b1a4e1[1].woffbinary
MD5:A94D80AC65FF1DE7D5BD5FB2F3AB0B63
SHA256:BED9E7DF863BF3B78564D4DF95EDC0C581E5ADA78CB3381198E734AC1D9539D8
2356iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\app[1].jshtml
MD5:79BE6F7DFFA8E49B2CE5B0C87E84FF0C
SHA256:B33F1EFE3FD9E02A76F3A3C2E399B255A7E8F1E108F84ECBFFF99B19A04EED83
2356iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\logo[1].pngimage
MD5:2366E2603CEFFBB40899C84FDD580C5B
SHA256:695BCD07565A83117E56FE384126D53CB925B94207EAF2433107E8A08ACCB498
2356iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\835e7b4f-b524-4374-b57b-9a8fc555fd4e[1].woffwoff
MD5:9941151F32E4CDB4E70693301624FC5E
SHA256:8C26539E6ACA64BCD4AFF9BF12FA1DA8F23469AE4AA0371DCB74EA8B5FC612D5
2356iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\link-arrow[1].pngimage
MD5:B07091E19BB41899BBF382B3594E2243
SHA256:94D2B592EB2933B57771C61BE58EE1DE20D8AE2BAF778657317449A2851C14CE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
30
TCP/UDP connections
36
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2356
iexplore.exe
GET
200
34.96.106.200:80
http://static.parastorage.com/services/third-party/angular-translate/1.1.1/angular-translate.min.js
unknown
text
2.29 Kb
unknown
2356
iexplore.exe
GET
200
34.96.106.200:80
http://static.parastorage.com/services/third-party/fonts/Helvetica/fontFace.css
unknown
text
3.11 Kb
unknown
2356
iexplore.exe
GET
200
34.96.106.200:80
http://static.parastorage.com/services/wix-public/1.719.0/styles/error-pages/styles.css
unknown
text
3.11 Kb
unknown
2356
iexplore.exe
GET
200
34.96.106.200:80
http://static.parastorage.com/services/third-party/angularjs/1.2.28/i18n/angular-locale_en.js
unknown
text
866 b
unknown
2356
iexplore.exe
GET
200
34.96.106.200:80
http://static.parastorage.com/services/third-party/jquery/2.0.3/jquery.min.js
unknown
text
28.6 Kb
unknown
2356
iexplore.exe
GET
200
34.96.106.200:80
http://static.parastorage.com/services/third-party/fonts/Helvetica/Fonts/bcf54343-d033-41ee-bbd7-2b77df3fe7ba.woff
unknown
woff
46.2 Kb
unknown
2356
iexplore.exe
GET
200
34.96.106.200:80
http://static.parastorage.com/services/wix-public/1.719.0/scripts/error-pages/locale/messages_en.js
unknown
text
1.94 Kb
unknown
2356
iexplore.exe
GET
200
34.96.106.200:80
http://static.parastorage.com/services/third-party/angularjs/1.2.28/angular.min.js
unknown
text
39.0 Kb
unknown
2356
iexplore.exe
GET
200
34.96.106.200:80
http://static.parastorage.com/services/wix-public/1.719.0/scripts/error-pages/app.js
unknown
html
5.79 Kb
unknown
2356
iexplore.exe
GET
200
34.96.106.200:80
http://static.parastorage.com/services/third-party/fonts/Helvetica/Fonts/d5af76d8-a90b-4527-b3a3-182207cc3250.woff
unknown
woff
55.1 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2356
iexplore.exe
34.149.87.45:80
45.87.149.34.bc.googleusercontent.com
GOOGLE
US
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
2356
iexplore.exe
34.96.106.200:80
static.parastorage.com
GOOGLE
US
unknown
2356
iexplore.exe
151.101.1.84:80
www.wix.com
FASTLY
US
unknown
3284
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2968
iexplore.exe
104.126.37.160:443
www.bing.com
Akamai International B.V.
DE
unknown
2968
iexplore.exe
104.126.37.179:443
www.bing.com
Akamai International B.V.
DE
unknown
2968
iexplore.exe
152.199.19.161:443
r20swj13mr.microsoft.com
EDGECAST
US
whitelisted
2968
iexplore.exe
67.27.235.126:80
ctldl.windowsupdate.com
LEVEL3
US
unknown

DNS requests

Domain
IP
Reputation
45.87.149.34.bc.googleusercontent.com
  • 34.149.87.45
unknown
static.parastorage.com
  • 34.96.106.200
shared
www.wix.com
  • 151.101.1.84
  • 151.101.65.84
  • 151.101.129.84
  • 151.101.193.84
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.160
  • 104.126.37.179
  • 104.126.37.146
  • 104.126.37.168
  • 104.126.37.154
  • 104.126.37.152
  • 104.126.37.171
  • 104.126.37.170
  • 104.126.37.177
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
ctldl.windowsupdate.com
  • 67.27.235.126
  • 8.253.207.120
  • 67.27.159.126
  • 8.241.122.254
  • 8.241.11.254
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
ieonline.microsoft.com
  • 204.79.197.200
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://45.87.149.34.bc.googleusercontent.com