URL:

https://eporner.com

Full analysis: https://app.any.run/tasks/9db1edc0-0656-4edc-a570-41fdbdeaa3ce
Verdict: Malicious activity
Analysis date: August 05, 2023, 13:01:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

82995A9239996FA63F761FB9001B2DC3

SHA1:

CF030A21F4351203C8C7989E8D3ACF1760FB2C00

SHA256:

8771B9F73A41623CF3C44522234552B415D6B056ECCF49AE16134C9C161F2F2E

SSDEEP:

3:N8AI:2t

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2396)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2396"C:\Program Files\Internet Explorer\iexplore.exe" "https://eporner.com"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
3716"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2396 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\user32.dll
Total events
13 521
Read events
13 447
Write events
72
Delete events
2

Modification events

(PID) Process:(2396) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(2396) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(2396) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(2396) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2396) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2396) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2396) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2396) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000004E010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2396) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2396) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
0
Suspicious files
18
Text files
35
Unknown types
0

Dropped files

PID
Process
Filename
Type
2396iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
2396iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:6FC0BAE12EAE79FFE95BA1991163455B
SHA256:4DFC3098C6231EB8D3BF933F81E61D61CA885C2C33AD137C7C5BA2234137EE17
3716iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FC2C6A00FFB949C84E31D2871F5B5A27binary
MD5:0E429278A8CA182AB7A61D07F8BB438F
SHA256:CBA57A384360F3BFD9AA8FFF66F5734EDFF1724CF4360ABC739A75CCFF42A52A
2396iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:2919B3BAF938D2E3CE1BD7DF60366AB9
SHA256:FF4A593993B067379AE88ECC2B0C7ECBE78877DE254B1EADF7DAA11737C79247
3716iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6A63C8D61ABC5BE834CB445411E7C641binary
MD5:6DDFAADB1291D0E07E11CE023BEDC9B7
SHA256:F692FA0638F462A8B251DB99AA20E9FCFA0F44A7F5D8CECF3EEA91143D990DB6
3716iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FC2C6A00FFB949C84E31D2871F5B5A27binary
MD5:FFEAE69F6CA4783427D5217FEB365547
SHA256:7A2B10ACDA0A6B1AD44C7464D0FEE0AC0E872C9975A09B3991F6C3C20B1A77AC
2396iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\versionlist.xmlxml
MD5:CBD0581678FA40F0EDCBC7C59E0CAD10
SHA256:159BD4343F344A08F6AF3B716B6FA679859C1BD1D7030D26FF5EF0255B86E1D9
2396iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verE172.tmpxml
MD5:CBD0581678FA40F0EDCBC7C59E0CAD10
SHA256:159BD4343F344A08F6AF3B716B6FA679859C1BD1D7030D26FF5EF0255B86E1D9
3716iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6E7B1B9757083E9277C238FD7C1D0DFEbinary
MD5:F58F21B7AA6ACA47B3CDF168546E9292
SHA256:6203CB61B6695FDB86D2F2A5AED76878A74D0D6139CDAD7B9B1DC9B00F6A2C7B
3716iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6E7B1B9757083E9277C238FD7C1D0DFEbinary
MD5:A81327E40C1FC995C3E51FC9DBB56813
SHA256:1F46BF194C98C56C078C9868BF13A783B7628A05CF170D5D95A1226217E11AE2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
39
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3716
iexplore.exe
GET
200
2.17.100.147:80
http://crl.swisssign.net/5B257B96A465517EB839F3C078665EE83AE7F0EE
unknown
binary
1.19 Kb
malicious
2396
iexplore.exe
GET
200
8.238.34.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1afcb890dfde423c
US
compressed
4.70 Kb
whitelisted
3716
iexplore.exe
GET
200
2.17.100.147:80
http://crl.swisssign.net/80F38FD9FC82688153C1E48B97501EA9F9C61CB5
unknown
binary
719 b
malicious
2396
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
3716
iexplore.exe
GET
200
2.17.100.147:80
http://crl.swisssign.net/3C9E527903636F4F9C811BD328700C245AEAA587
unknown
der
17.9 Kb
malicious
2396
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
1088
svchost.exe
GET
200
8.238.34.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?d3fe7d8d148f62e3
US
compressed
62.3 Kb
whitelisted
3716
iexplore.exe
GET
200
8.238.33.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e92ff5a5ad0006fb
US
compressed
4.70 Kb
whitelisted
2396
iexplore.exe
GET
200
8.238.34.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6f779363de1e9f27
US
compressed
4.70 Kb
whitelisted
1088
svchost.exe
GET
304
8.238.34.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?286a4fb2c787178f
US
compressed
62.3 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2640
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3716
iexplore.exe
94.75.220.1:443
eporner.com
LeaseWeb Netherlands B.V.
NL
unknown
3716
iexplore.exe
8.238.34.254:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
—
—
192.168.100.255:138
—
—
—
whitelisted
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2396
iexplore.exe
8.238.34.254:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
3716
iexplore.exe
2.17.100.147:80
crl.swisssign.net
Akamai International B.V.
DE
unknown
2396
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3716
iexplore.exe
67.27.235.254:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious

DNS requests

Domain
IP
Reputation
eporner.com
  • 94.75.220.1
whitelisted
ctldl.windowsupdate.com
  • 8.238.34.254
  • 67.27.235.254
  • 8.238.33.254
  • 8.248.117.254
  • 8.248.147.254
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.128
  • 104.126.37.139
  • 104.126.37.123
  • 104.126.37.178
  • 104.126.37.186
  • 104.126.37.144
  • 104.126.37.136
  • 104.126.37.137
  • 104.126.37.130
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
crl.swisssign.net
  • 2.17.100.147
  • 2.17.100.242
malicious
ocsp.swisssign.net
  • 2.17.100.243
  • 2.17.100.200
whitelisted
www.eporner.com
  • 94.75.220.43
  • 94.75.220.1
  • 94.75.220.45
  • 94.75.220.41
  • 94.75.220.4
  • 94.75.220.2
  • 94.75.220.5
  • 94.75.220.3
  • 94.75.220.44
  • 94.75.220.42
unknown
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://eporner.com