URL:

https://click.microsoftstoreemail.com/?qs=5543552c9d7cd906ff0f38950b6e3202156f9e874a0f816fce434c3c37f3bcb05d44cdf53a4671c71b6f698a3bd1b92569211eaf5edf75ec7e15d7835a9b2a3c

Full analysis: https://app.any.run/tasks/cf2650b1-b20f-42a0-9fe7-ba2448e0d451
Verdict: Malicious activity
Analysis date: January 08, 2024, 23:02:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

ACC6F6D53DBAED2F8941EBC628AD3F8C

SHA1:

15513B31C704B523629487BA7C7904F3045F21CA

SHA256:

7688B0F8A0701E999DC6695AC6205C6EDA257B7644E111F6DE97538862B2E465

SSDEEP:

3:N8UEIMAKRwRMlSsKnFRW0DXQWWFNDMHB4g18ihFmLDXSzFHe:2UEyuwrsKrWSQRFNDM6uhCGF+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 120)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
120"C:\Program Files\Internet Explorer\iexplore.exe" "https://click.microsoftstoreemail.com/?qs=5543552c9d7cd906ff0f38950b6e3202156f9e874a0f816fce434c3c37f3bcb05d44cdf53a4671c71b6f698a3bd1b92569211eaf5edf75ec7e15d7835a9b2a3c"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1056"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:120 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
9 872
Read events
9 808
Write events
62
Delete events
2

Modification events

(PID) Process:(120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
15
Text files
59
Unknown types
0

Dropped files

PID
Process
Filename
Type
1056iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
1056iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:A60BCFE0AB30454546414E9AF74EB9A5
SHA256:5E2E6A51F9DA0E6F1EE17E6F2FED2E601DAEF02DC6D8F92F9169D1C3883F0C9E
1056iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_A30EA9B4E1BC5DBF09A8EF399E086D27binary
MD5:5B178F0C4E56436A96010FB8933E07CA
SHA256:3BDBABD0EFA3D9763951F9EAE0100942015DE7D4E0C95F3AC1F04A2C5C9EB36D
1056iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04der
MD5:0B86A20F993E251CAD670D9608798311
SHA256:8E74F589D6E2F77FF166D07F17B943D207B8F98CA921E068321FA48B3F7C0677
1056iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_A30EA9B4E1BC5DBF09A8EF399E086D27binary
MD5:84E6BEA22B158F69F6D01AAEAE28E34D
SHA256:D907E0757B147210BF8335774826A8079CA013F2AAD80256052BDE89C9135339
1056iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04binary
MD5:87FEFA2C178C9B828FBED17E1D420A4F
SHA256:3F0C5E1467299DBAFE16C81156C6D9B84F7EB16F5E5FF07F51BEF3B08932CD36
1056iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E573CDF4C6D731D56A665145182FD759_CCC46B947E135AA96F173D1DC0946047binary
MD5:D3954394CF481E4C7443F88F4E6F65A1
SHA256:3FF99D0586CC4484E2199572AE5CC5EB050BD421392EC5663C60F21DDA88FA3D
1056iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E573CDF4C6D731D56A665145182FD759_CCC46B947E135AA96F173D1DC0946047binary
MD5:FB3A4C7B3DCD9A45274F5CE108784F02
SHA256:26583D94DBC9F21E2750BEB0D08ECCC095F16C94D9131EB83577BBCCF7B9503B
1056iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\default.min.ACSHASH76dadbfe7f1ac2c5727072e9fff534fe[1].csstext
MD5:76DADBFE7F1AC2C5727072E9FFF534FE
SHA256:FA86F4F7BC62EA87233DC0A167CD69E1C1A5F051527BDE545DE811F1FC09BDA3
1056iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\site.min.ACSHASHc033b611d87d511847501ade7913431f[1].csstext
MD5:C033B611D87D511847501ADE7913431F
SHA256:077F44F97FD72895582436A74517EB4C08A342E8C8EC1D2A672B0F92B32B1C46
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
38
DNS requests
27
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1056
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2f131cf452408714
unknown
compressed
4.66 Kb
unknown
1056
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAo1CNVcKSsBffitZcAP9%2BQ%3D
unknown
binary
471 b
unknown
120
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?85105a2067e5fff2
unknown
—
—
unknown
1056
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEA7Sle5D0UEn141S7hBwa4g%3D
unknown
binary
471 b
unknown
1056
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
binary
471 b
unknown
120
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
312 b
unknown
1056
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1056
iexplore.exe
13.111.145.222:443
click.microsoftstoreemail.com
EXACT-7
US
unknown
1056
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
1056
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1056
iexplore.exe
184.30.21.171:443
www.microsoft.com
AKAMAI-AS
DE
unknown
120
iexplore.exe
104.126.37.144:443
www.bing.com
Akamai International B.V.
DE
unknown
120
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
120
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
click.microsoftstoreemail.com
  • 13.111.145.222
malicious
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.144
  • 104.126.37.136
  • 104.126.37.171
  • 104.126.37.178
  • 104.126.37.163
  • 104.126.37.131
  • 104.126.37.130
  • 104.126.37.145
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
cdn-dynmedia-1.microsoft.com
  • 104.126.37.161
  • 104.126.37.185
whitelisted
web.vortex.data.microsoft.com
  • —
unknown
img-prod-cms-rt-microsoft-com.akamaized.net
  • 2.21.20.148
  • 2.21.20.144
whitelisted
c.s-microsoft.com
  • 184.30.17.142
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://click.microsoftstoreemail.com/?qs=5543552c9d7cd906ff0f38950b6e3202156f9e874a0f816fce434c3c37f3bcb05d44cdf53a4671c71b6f698a3bd1b92569211eaf5edf75ec7e15d7835a9b2a3c