URL:

https://mypornsnap.xyz/photos/faiza-khan

Full analysis: https://app.any.run/tasks/a88601eb-8d30-477d-b2cc-c21c41cba4ff
Verdict: Malicious activity
Analysis date: February 07, 2024, 10:39:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

AADB31505AFF5FA82720811E23519312

SHA1:

B11CE5201A206707158915D574F2D8FF6720CA96

SHA256:

735B471A22C9BD33E6DA654C58C3CF4212B9C5A1B9234270D6E9B0917EE498E0

SSDEEP:

3:N8L8yxskSL:2LbxF4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2476)

    • Reads the computer name

      • wmpnscfg.exe (PID: 2476)

    • Application launched itself

      • iexplore.exe (PID: 1264)

    • Checks supported languages

      • wmpnscfg.exe (PID: 2476)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
4
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe wmpnscfg.exe no specs iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
548"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1264 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1264"C:\Program Files\Internet Explorer\iexplore.exe" "https://mypornsnap.xyz/photos/faiza-khan"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2476"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3364"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1264 CREDAT:4003089 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
27 142
Read events
26 995
Write events
135
Delete events
12

Modification events

(PID) Process:(1264) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(1264) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(1264) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(1264) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1264) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1264) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1264) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1264) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1264) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1264) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
48
Text files
115
Unknown types
3

Dropped files

PID
Process
Filename
Type
548iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:C80366AB9B22CD38E23A2D336494B6C1
SHA256:8A42240502B0549370F3F93A55F42FCCB53A9D2C0A43BF5E571197917EE291CB
548iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab4F7E.tmpcompressed
MD5:AC05D27423A85ADC1622C714F2CB6184
SHA256:C6456E12E5E53287A547AF4103E0397CB9697E466CF75844312DC296D43D144D
548iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab4F7C.tmpcompressed
MD5:AC05D27423A85ADC1622C714F2CB6184
SHA256:C6456E12E5E53287A547AF4103E0397CB9697E466CF75844312DC296D43D144D
548iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\style[1].csstext
MD5:678E8331E7E5452E2353D3EF47576683
SHA256:8CAB143EA48B561E408D3AC2AD6DBECED0505389E6462C15BCBCC6DCF8190322
548iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\pu[1].jstext
MD5:53D99461E949F7267B80EA04550A8FAD
SHA256:B0C1A40452389ECDC530E7FC231BA4FCBB7273D7E29F9DFACA72DC5ECEB8DDA1
548iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:CBF094C7A9AD1AE795E858AEE59B1727
SHA256:390AB3C419D024195D1280D3822BA1EE39D75DBF9FC413A42EEA8B48991796EC
548iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:A548C9B72A423A02B1835DB0F54B569F
SHA256:EC5CED0BF540F630ECD1B6ACD30C8A64BED96ABC8859028C33C94B49CC970C52
548iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar4F7D.tmpcat
MD5:9C0C641C06238516F27941AA1166D427
SHA256:4276AF3669A141A59388BC56A87F6614D9A9BDDDF560636C264219A7EB11256F
548iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar4F7F.tmpbinary
MD5:9C0C641C06238516F27941AA1166D427
SHA256:4276AF3669A141A59388BC56A87F6614D9A9BDDDF560636C264219A7EB11256F
548iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\top[1].jstext
MD5:52552568D051AA1188D22687652696AC
SHA256:1A5F85C5560BB83A002F5A742E79998DF0A31F13C215828A1EFDA33E0BFA48B6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
25
TCP/UDP connections
108
DNS requests
34
Threats
17

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
548
iexplore.exe
GET
304
23.32.238.144:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?26bc83074cde97bc
unknown
—
—
unknown
548
iexplore.exe
GET
200
23.32.238.144:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?5da2680ebcdcdef2
unknown
compressed
65.2 Kb
unknown
548
iexplore.exe
GET
304
23.32.238.144:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f324de6a56943962
unknown
—
—
unknown
548
iexplore.exe
GET
200
23.32.238.144:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?d7a4c83e7f191cf0
unknown
compressed
65.2 Kb
unknown
548
iexplore.exe
GET
200
184.24.77.165:80
http://ocsp.buypass.com/MEowSDBGMEQwQjAJBgUrDgMCGgUABBRyx0WAUkki6aW2LiOMsWzYh0At3gQUyYB34GKSgvVGnPO690zD3rijrTkCCTL6CDdr8jwgEw%3D%3D
unknown
binary
1.66 Kb
unknown
548
iexplore.exe
GET
200
72.246.169.163:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
548
iexplore.exe
GET
200
184.24.77.165:80
http://ocsp.buypass.com/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBRtM4uveV6ZwbCQeKmCxreldZfyFwQUJ1Kkby0qq0CTkOzWacv%2BfGE7fEICCwpsP15%2BTh1hKmii
unknown
binary
1.66 Kb
unknown
548
iexplore.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/rootr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHUeP1PjGFkz6V8I7O6tApc%3D
unknown
binary
1.41 Kb
unknown
548
iexplore.exe
GET
200
184.25.51.82:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgOMeuh4DIofs%2BSIVziC%2BgCgyA%3D%3D
unknown
binary
503 b
unknown
548
iexplore.exe
GET
200
184.24.77.165:80
http://ocsp.buypass.com/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBRtM4uveV6ZwbCQeKmCxreldZfyFwQUJ1Kkby0qq0CTkOzWacv%2BfGE7fEICCwpyp3olhpQDJlzy
unknown
binary
1.66 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
548
iexplore.exe
104.167.222.231:443
mypornsnap.xyz
DEDIOUTLET-NETWORKS
US
unknown
548
iexplore.exe
23.32.238.144:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
548
iexplore.exe
72.246.169.163:80
x1.c.lencr.org
AKAMAI-AS
DE
unknown
548
iexplore.exe
172.240.108.68:443
novemberassimilate.com
—
US
unknown
548
iexplore.exe
104.167.222.233:443
snxxx.top
DEDIOUTLET-NETWORKS
US
unknown
548
iexplore.exe
104.167.222.232:443
snxxx.xyz
DEDIOUTLET-NETWORKS
US
unknown
548
iexplore.exe
212.117.190.201:443
ku42hjr2e.com
—
LU
unknown
548
iexplore.exe
104.167.222.234:443
snxxx.cc
DEDIOUTLET-NETWORKS
US
unknown
548
iexplore.exe
104.167.222.235:443
snxxx.fun
DEDIOUTLET-NETWORKS
US
unknown

DNS requests

Domain
IP
Reputation
mypornsnap.xyz
  • 104.167.222.231
unknown
ctldl.windowsupdate.com
  • 23.32.238.144
  • 2.19.198.57
  • 23.32.238.113
  • 23.32.238.154
  • 2.19.198.51
  • 2.19.198.64
whitelisted
x1.c.lencr.org
  • 72.246.169.163
whitelisted
novemberassimilate.com
  • 172.240.108.68
  • 172.240.108.84
  • 172.240.108.76
  • 192.243.59.20
  • 172.240.108.92
  • 192.243.59.12
  • 172.240.253.132
malicious
snxxx.cc
  • 104.167.222.234
unknown
snxxx.top
  • 104.167.222.233
unknown
snxxx.xyz
  • 104.167.222.232
unknown
snxxx.fun
  • 104.167.222.235
unknown
ku42hjr2e.com
  • 212.117.190.201
unknown
ocsp.buypass.com
  • 184.24.77.165
  • 184.24.77.150
whitelisted

Threats

PID
Process
Class
Message
548
iexplore.exe
Potentially Bad Traffic
ET HUNTING Observed Let's Encrypt Certificate for Suspicious TLD (.xyz)
548
iexplore.exe
Potentially Bad Traffic
ET HUNTING Observed Let's Encrypt Certificate for Suspicious TLD (.xyz)
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
548
iexplore.exe
Potentially Bad Traffic
ET HUNTING Observed Let's Encrypt Certificate for Suspicious TLD (.xyz)
548
iexplore.exe
Potentially Bad Traffic
ET HUNTING Observed Let's Encrypt Certificate for Suspicious TLD (.xyz)
548
iexplore.exe
Potentially Bad Traffic
ET HUNTING Observed Let's Encrypt Certificate for Suspicious TLD (.xyz)
548
iexplore.exe
Potentially Bad Traffic
ET HUNTING Observed Let's Encrypt Certificate for Suspicious TLD (.xyz)
548
iexplore.exe
Potentially Bad Traffic
ET HUNTING Observed Let's Encrypt Certificate for Suspicious TLD (.xyz)
548
iexplore.exe
Potentially Bad Traffic
ET HUNTING Observed Let's Encrypt Certificate for Suspicious TLD (.xyz)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://mypornsnap.xyz/photos/faiza-khan