URL:

https://eporner.com

Full analysis: https://app.any.run/tasks/9db1edc0-0656-4edc-a570-41fdbdeaa3ce
Verdict: Malicious activity
Analysis date: August 05, 2023, 13:01:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

82995A9239996FA63F761FB9001B2DC3

SHA1:

CF030A21F4351203C8C7989E8D3ACF1760FB2C00

SHA256:

8771B9F73A41623CF3C44522234552B415D6B056ECCF49AE16134C9C161F2F2E

SSDEEP:

3:N8AI:2t

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2396)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2396"C:\Program Files\Internet Explorer\iexplore.exe" "https://eporner.com"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
3716"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2396 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\user32.dll
Total events
13 521
Read events
13 447
Write events
72
Delete events
2

Modification events

(PID) Process:(2396) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(2396) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(2396) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(2396) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2396) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2396) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2396) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2396) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000004E010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2396) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2396) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
0
Suspicious files
18
Text files
35
Unknown types
0

Dropped files

PID
Process
Filename
Type
2396iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:2919B3BAF938D2E3CE1BD7DF60366AB9
SHA256:FF4A593993B067379AE88ECC2B0C7ECBE78877DE254B1EADF7DAA11737C79247
2396iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:ECE569A4ACDA79D6BA7B1AE5E9AD7080
SHA256:61D709D1334CC71531CBF0DB18906303F9CAAFFBBAA4C0B1A93A8A7358F0445C
3716iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6A63C8D61ABC5BE834CB445411E7C641binary
MD5:4E526055B67E5B22FE85FB4C35B183C0
SHA256:8135F5CFF69E6F656F9D69D16E5AF1A3AE18E97DB888456DEBD809A1A7288B41
2396iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
3716iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6E7B1B9757083E9277C238FD7C1D0DFEbinary
MD5:A81327E40C1FC995C3E51FC9DBB56813
SHA256:1F46BF194C98C56C078C9868BF13A783B7628A05CF170D5D95A1226217E11AE2
3716iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6E7B1B9757083E9277C238FD7C1D0DFEbinary
MD5:F58F21B7AA6ACA47B3CDF168546E9292
SHA256:6203CB61B6695FDB86D2F2A5AED76878A74D0D6139CDAD7B9B1DC9B00F6A2C7B
3716iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\ZFMM1VMI.txttext
MD5:2CE7D29EE5D2C98DAECE0C9FC3C9AF4C
SHA256:A9BCBE954ECC06D27F3ACFBA1D20CF96773C162B47E13EF89E9B122DED95629D
3716iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6A63C8D61ABC5BE834CB445411E7C641binary
MD5:6DDFAADB1291D0E07E11CE023BEDC9B7
SHA256:F692FA0638F462A8B251DB99AA20E9FCFA0F44A7F5D8CECF3EEA91143D990DB6
2396iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\favicon[2].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
3716iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FC2C6A00FFB949C84E31D2871F5B5A27binary
MD5:0E429278A8CA182AB7A61D07F8BB438F
SHA256:CBA57A384360F3BFD9AA8FFF66F5734EDFF1724CF4360ABC739A75CCFF42A52A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
39
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2396
iexplore.exe
GET
200
8.238.34.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6f779363de1e9f27
US
compressed
4.70 Kb
whitelisted
2396
iexplore.exe
GET
200
8.238.34.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1afcb890dfde423c
US
compressed
4.70 Kb
whitelisted
3716
iexplore.exe
GET
200
2.17.100.147:80
http://crl.swisssign.net/3C9E527903636F4F9C811BD328700C245AEAA587
unknown
der
17.9 Kb
malicious
1088
svchost.exe
GET
200
8.238.34.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?d3fe7d8d148f62e3
US
compressed
62.3 Kb
whitelisted
3716
iexplore.exe
GET
200
2.17.100.147:80
http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
unknown
binary
1.19 Kb
malicious
2396
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
1088
svchost.exe
GET
304
8.238.34.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?286a4fb2c787178f
US
compressed
62.3 Kb
whitelisted
2396
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
3716
iexplore.exe
GET
200
2.17.100.147:80
http://crl.swisssign.net/80F38FD9FC82688153C1E48B97501EA9F9C61CB5
unknown
binary
719 b
malicious
3716
iexplore.exe
GET
200
2.17.100.200:80
http://ocsp.swisssign.net/3C9E527903636F4F9C811BD328700C245AEAA587/MFUwUzBRME8wTTAJBgUrDgMCGgUABBS2MMFnCNyshlXShDoXM5fbPk2OZwQUPJ5SeQNjb0%2BcgRvTKHAMJFrqpYcCFBEK%2BetrhZ5On2JNiWRK0puiEpxc
DE
binary
3.08 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2640
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
3716
iexplore.exe
94.75.220.1:443
eporner.com
LeaseWeb Netherlands B.V.
NL
unknown
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3716
iexplore.exe
8.238.34.254:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
2396
iexplore.exe
104.126.37.128:443
www.bing.com
Akamai International B.V.
DE
suspicious
2396
iexplore.exe
8.238.34.254:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
2396
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3716
iexplore.exe
2.17.100.147:80
crl.swisssign.net
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
eporner.com
  • 94.75.220.1
whitelisted
ctldl.windowsupdate.com
  • 8.238.34.254
  • 67.27.235.254
  • 8.238.33.254
  • 8.248.117.254
  • 8.248.147.254
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.128
  • 104.126.37.139
  • 104.126.37.123
  • 104.126.37.178
  • 104.126.37.186
  • 104.126.37.144
  • 104.126.37.136
  • 104.126.37.137
  • 104.126.37.130
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
crl.swisssign.net
  • 2.17.100.147
  • 2.17.100.242
malicious
ocsp.swisssign.net
  • 2.17.100.243
  • 2.17.100.200
whitelisted
www.eporner.com
  • 94.75.220.43
  • 94.75.220.1
  • 94.75.220.45
  • 94.75.220.41
  • 94.75.220.4
  • 94.75.220.2
  • 94.75.220.5
  • 94.75.220.3
  • 94.75.220.44
  • 94.75.220.42
unknown
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://eporner.com