URL:

web.archive.org/web/20040905000458/lastmeasure.com

Full analysis: https://app.any.run/tasks/42e52e46-6156-447e-a733-4afc9eb572dd
Verdict: Malicious activity
Analysis date: December 06, 2023, 03:36:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

C91610EE23D1544CA5728895305D5521

SHA1:

2EA1306F6522AA943F167ACB76983563B79C500D

SHA256:

8717C426481C1D8CAE108C4DF4B587EC0CDC6E7AA8DB6A82209B82D6DB0CD6FE

SSDEEP:

3:fEhXJevRpEf:f+X8Ef

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 1864)

    • Checks supported languages

      • wmpnscfg.exe (PID: 3176)

    • Reads the computer name

      • wmpnscfg.exe (PID: 3176)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3176)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
3
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1864"C:\Program Files\Internet Explorer\iexplore.exe" "web.archive.org/web/20040905000458/lastmeasure.com"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3028"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1864 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3176"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
20 413
Read events
20 348
Write events
63
Delete events
2

Modification events

(PID) Process:(1864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(1864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(1864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(1864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
10
Text files
26
Unknown types
1

Dropped files

PID
Process
Filename
Type
3028iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\lastmeasure-ghostwords[1].pngimage
MD5:9B61F2268B23D81C2682DF8D4C23180C
SHA256:DD70BBE4F5BD03998350826E8433E3AA8160212B550DB6446BC119D1A65CE0AE
3028iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\analytics[1].jstext
MD5:CBC1B007EB7DE0B65EDA9EF00E069EBE
SHA256:A1F3D3BE0AF279C2DA371163D037A3D46569453A855CF91ACECA0F3695C57017
3028iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\gnaa[1].pngimage
MD5:DE8C2448611E49F721BD47E417A4B51B
SHA256:B24D4D860215C902A3000E49ADBC0CB279EF7ADF3B6E187160ABD4679976D150
3028iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\index[1].csstext
MD5:54B75D620B99BD33AD67CFBAB4F42C63
SHA256:D358E214C6C2DBF63F3DDA18FAD3808EDAA7A5586743728A45ECC271663EEE30
3028iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\lastmeasure[1].htmhtml
MD5:5ABE0B0824F839BFCA882EB1085FE603
SHA256:047863E7BFEF58C1F9E4B39E4835117BD8D4C91AF040F4BA552EB36993C87235
3028iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2Dbinary
MD5:45FEE3C8EB693621C57FB8ABD3D810A4
SHA256:69BD6653A15A044F2FC3E6E844E23973071CD09C1B707D33FA6C76149DBE4283
3028iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:C55D23EA1407B6DA3274EC9BDC89D78B
SHA256:51E2EDD36C51D27293A31C36F6B2EB28A35F58465D24CAD2D28BA0B13DAFC409
3028iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2Dder
MD5:B5DE5485E6D134EF5508B02F6B882216
SHA256:10294E6495CBE4AB4BD5AAA6A67FDFCFC7169BA4D66A6F08786E57A9A418A394
3028iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\wm_tb_prv_on[1].pngimage
MD5:A4F0D56855C698DD583529AF88E28D42
SHA256:5D09C087A37CEB85DDBD9B25C0F8D94FD4CF0A22E5579AAF679908E7F095D62F
3028iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
34
TCP/UDP connections
38
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3028
iexplore.exe
GET
302
207.241.237.3:80
http://web.archive.org/web/20040905000458/lastmeasure.com
unknown
—
—
unknown
3028
iexplore.exe
GET
302
207.241.237.3:80
http://web.archive.org/web/20040905000458im_/http://lastmeasure.com/images/lmlogo/lastmeasure-ghostwords.png
unknown
—
—
unknown
3028
iexplore.exe
GET
302
207.241.237.3:80
http://web.archive.org/web/20040905000458im_/http://lastmeasure.com/images/gnaa.png
unknown
—
—
unknown
3028
iexplore.exe
GET
200
207.241.224.2:80
http://archive.org/includes/analytics.js?v=cf34f82
unknown
text
5.01 Kb
unknown
3028
iexplore.exe
GET
302
207.241.237.3:80
http://web.archive.org/web/20040905000458im_/http://lastmeasure.com/images/valid-xhtml10.png
unknown
—
—
unknown
3028
iexplore.exe
GET
200
207.241.237.3:80
http://web.archive.org/web/20040803021148cs_/http://www.lastmeasure.com/index.css
unknown
text
919 b
unknown
3028
iexplore.exe
GET
200
207.241.237.3:80
http://web.archive.org/web/20050207142402im_/http://lastmeasure.com/images/gnaa.png
unknown
image
2.04 Kb
unknown
3028
iexplore.exe
GET
200
207.241.237.3:80
http://web.archive.org/web/20041205065633im_/http://www.lastmeasure.com/images/valid-xhtml10.png
unknown
image
2.36 Kb
unknown
3028
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e90117ea99140de1
unknown
compressed
4.66 Kb
unknown
3028
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?992050f6f6632977
unknown
compressed
4.66 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3028
iexplore.exe
207.241.237.3:80
web.archive.org
INTERNET-ARCHIVE
US
unknown
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3028
iexplore.exe
207.241.224.2:80
archive.org
INTERNET-ARCHIVE
US
malicious
3028
iexplore.exe
207.241.237.2:443
web-static.archive.org
INTERNET-ARCHIVE
US
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3028
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
3028
iexplore.exe
192.124.249.23:80
ocsp.godaddy.com
SUCURI-SEC
US
unknown
3028
iexplore.exe
207.241.224.2:443
archive.org
INTERNET-ARCHIVE
US
malicious

DNS requests

Domain
IP
Reputation
web.archive.org
  • 207.241.237.3
whitelisted
archive.org
  • 207.241.224.2
whitelisted
web-static.archive.org
  • 207.241.237.2
unknown
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.godaddy.com
  • 192.124.249.23
  • 192.124.249.36
  • 192.124.249.24
  • 192.124.249.41
  • 192.124.249.22
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 2.23.209.187
  • 2.23.209.130
whitelisted
analytics.archive.org
  • 207.241.225.195
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
web.archive.org/web/20040905000458/lastmeasure.com