File name:

EmailAccessHere-32156676.exe

Full analysis: https://app.any.run/tasks/ee9569a2-0edd-4d6b-99de-3872462bf977
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: February 13, 2020, 18:56:04
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
adload
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

680F5A8A3B20D94203530926433BE5FB

SHA1:

FA0BC19EE45044870F99445253729620A00A94EE

SHA256:

88EEE6C692E3E4E2889F06F13145637C89332976CF7EAE0DA43147F5300FE574

SSDEEP:

24576:Wj6dxqHbgP7sj9TUzu+5taVIZ9QQ2MtP7iRi2p/U7S:+cq8P7g9gzwVIcQvP74xU7S

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Helper.exe (PID: 3012)
      • searchbar_5e459bed3ab73.exe (PID: 3988)
      • Search Bar.exe (PID: 1928)

    • Changes the autorun value in the registry

      • EmailAccessHere-32156676.exe (PID: 2564)
      • searchbar_5e459bed3ab73.exe (PID: 3988)

    • ADLOAD was detected

      • EmailAccessHere-32156676.exe (PID: 2564)

    • Loads dropped or rewritten executable

      • searchbar_5e459bed3ab73.exe (PID: 3988)

  • SUSPICIOUS

    • Changes the started page of IE

      • EmailAccessHere-32156676.exe (PID: 2564)

    • Creates a software uninstall entry

      • EmailAccessHere-32156676.exe (PID: 2564)
      • Search Bar.exe (PID: 1928)
      • searchbar_5e459bed3ab73.exe (PID: 3988)

    • Creates files in the user directory

      • Helper.exe (PID: 3012)
      • EmailAccessHere-32156676.exe (PID: 2564)
      • Search Bar.exe (PID: 1928)

    • Starts Internet Explorer

      • EmailAccessHere-32156676.exe (PID: 2564)
      • Search Bar.exe (PID: 1928)

    • Reads Internet Cache Settings

      • EmailAccessHere-32156676.exe (PID: 2564)
      • searchbar_5e459bed3ab73.exe (PID: 3988)
      • Search Bar.exe (PID: 1928)

    • Reads internet explorer settings

      • EmailAccessHere-32156676.exe (PID: 2564)
      • Search Bar.exe (PID: 1928)

    • Executable content was dropped or overwritten

      • EmailAccessHere-32156676.exe (PID: 2564)
      • IEXPLORE.EXE (PID: 916)
      • IEXPLORE.EXE (PID: 2904)
      • searchbar_5e459bed3ab73.exe (PID: 3988)

    • Changes IE settings (feature browser emulation)

      • Search Bar.exe (PID: 1928)

  • INFO

    • Reads Internet Cache Settings

      • IEXPLORE.EXE (PID: 916)
      • IEXPLORE.EXE (PID: 2904)
      • IEXPLORE.EXE (PID: 3672)

    • Changes internet zones settings

      • IEXPLORE.EXE (PID: 916)

    • Reads settings of System Certificates

      • EmailAccessHere-32156676.exe (PID: 2564)
      • IEXPLORE.EXE (PID: 916)
      • IEXPLORE.EXE (PID: 3672)

    • Reads internet explorer settings

      • IEXPLORE.EXE (PID: 2904)
      • IEXPLORE.EXE (PID: 3672)

    • Modifies the phishing filter of IE

      • IEXPLORE.EXE (PID: 916)

    • Creates files in the user directory

      • IEXPLORE.EXE (PID: 2904)
      • IEXPLORE.EXE (PID: 3672)

    • Application launched itself

      • IEXPLORE.EXE (PID: 916)

    • Adds / modifies Windows certificates

      • IEXPLORE.EXE (PID: 916)

    • Changes settings of System certificates

      • IEXPLORE.EXE (PID: 916)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:12:06 09:00:26+01:00
PEType: PE32
LinkerVersion: 14.16
CodeSize: 321536
InitializedDataSize: 921600
UninitializedDataSize: -
EntryPoint: 0x2cc53
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 5.5.0.1
ProductVersionNumber: 5.5.0.1
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: SpringTech (Cayman) Ltd.
FileVersion: 5.5.0.1
InternalName: IENewTab
LegalCopyright: Copyright (C) 2019 SpringTech (Cayman) Ltd.
OriginalFileName: IENewTab
ProductName: IENewTab
ProductVersion: 5.5.0.1

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 06-Dec-2019 08:00:26
Detected languages:
  • English - United States
CompanyName: SpringTech (Cayman) Ltd.
FileVersion: 5.5.0.1
InternalName: IENewTab
LegalCopyright: Copyright (C) 2019 SpringTech (Cayman) Ltd.
OriginalFilename: IENewTab
ProductName: IENewTab
ProductVersion: 5.5.0.1

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000110

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 06-Dec-2019 08:00:26
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0004E747
0x0004E800
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.58811
.rdata
0x00050000
0x00018D46
0x00018E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.18081
.data
0x00069000
0x00002CA0
0x00001E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.11519
.rsrc
0x0006C000
0x000C0DE8
0x000C0E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.4347
.reloc
0x0012D000
0x0000441C
0x00004600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.55213

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.3298
822
UNKNOWN
English - United States
RT_MANIFEST
2
3.47151
1384
UNKNOWN
English - United States
RT_ICON
3
3.91708
744
UNKNOWN
English - United States
RT_ICON
4
3.91366
2216
UNKNOWN
English - United States
RT_ICON
5
4.02252
3752
UNKNOWN
English - United States
RT_ICON
6
3.62911
1640
UNKNOWN
English - United States
RT_ICON
7
3.25755
296
UNKNOWN
English - United States
RT_ICON
8
3.47151
1384
UNKNOWN
English - United States
RT_ICON
9
3.91708
744
UNKNOWN
English - United States
RT_ICON
10
3.91366
2216
UNKNOWN
English - United States
RT_ICON

Imports

ADVAPI32.dll
GDI32.dll
KERNEL32.dll
OLEACC.dll
OLEAUT32.dll
PSAPI.DLL
SHELL32.dll
SHLWAPI.dll
USER32.dll
VERSION.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
8
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start #ADLOAD emailaccesshere-32156676.exe iexplore.exe iexplore.exe helper.exe no specs searchbar_5e459bed3ab73.exe search bar.exe iexplore.exe no specs iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
916"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://search.hemailaccesshere.com/?ap=appfocus1&uid=10a917c5-567a-4403-8544-f324a7369f17&i_id=email_spt__1.30&uc=20200213&source=d-ccc4-lp0-cp_6645210473-bb8-iei-msnC:\Program Files\Internet Explorer\IEXPLORE.EXE
EmailAccessHere-32156676.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1928"C:\Users\admin\AppData\Local\Search Bar\Search Bar.exe" /firstrunC:\Users\admin\AppData\Local\Search Bar\Search Bar.exe
searchbar_5e459bed3ab73.exe
User:
admin
Company:
Better Cloud Solutions LTD
Integrity Level:
MEDIUM
Description:
Desktop web search
Exit code:
0
Version:
3.6.0.1
Modules
Images
c:\users\admin\appdata\local\search bar\search bar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2564"C:\Users\admin\AppData\Local\Temp\EmailAccessHere-32156676.exe" C:\Users\admin\AppData\Local\Temp\EmailAccessHere-32156676.exe
explorer.exe
User:
admin
Company:
SpringTech (Cayman) Ltd.
Integrity Level:
MEDIUM
Exit code:
0
Version:
5.5.0.1
Modules
Images
c:\users\admin\appdata\local\temp\emailaccesshere-32156676.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wininet.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
2852"C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://results.hemailaccesshere.com/s?uid=27253d93-bf9e-4c33-81d7-c9e2791de316&uc=20200213&source=d-ccc4-lp0-cp_6645210473-bb8-iei-msn_v1-ietyp-sbe-ab&i_id=email_&ap=appfocus694C:\Program Files\Internet Explorer\IEXPLORE.EXE—Search Bar.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2904"C:\Program Files\Internet Explorer\IEXPLORE.EXE" SCODEF:916 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\IEXPLORE.EXE
IEXPLORE.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3012"C:\Users\admin\AppData\Roaming\{28e56cfb-e30e-4f66-85d8-339885b726b8}\Helper.exe" http:%2F%2Fsearch.hemailaccesshere.com%2F%3Fap=appfocus1%26uid=10a917c5-567a-4403-8544-f324a7369f17%26i_id=email_spt__1.30%26uc=20200213%26source=d-ccc4-lp0-cp_6645210473-bb8-iei-msn-su 21600 falseC:\Users\admin\AppData\Roaming\{28e56cfb-e30e-4f66-85d8-339885b726b8}\Helper.exe—EmailAccessHere-32156676.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.0.0.5
Modules
Images
c:\users\admin\appdata\roaming\{28e56cfb-e30e-4f66-85d8-339885b726b8}\helper.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wininet.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3672"C:\Program Files\Internet Explorer\IEXPLORE.EXE" SCODEF:916 CREDAT:1053978 /prefetch:2C:\Program Files\Internet Explorer\IEXPLORE.EXE
IEXPLORE.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3988"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\searchbar_5e459bed3ab73.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\searchbar_5e459bed3ab73.exe
IEXPLORE.EXE
User:
admin
Company:
Better Cloud Solutions LTD
Integrity Level:
MEDIUM
Description:
Desktop web search
Exit code:
0
Version:
3.6.0.1
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\6z2bcoul\searchbar_5e459bed3ab73.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
Total events
5 920
Read events
2 202
Write events
2 525
Delete events
1 193

Modification events

(PID) Process:(2564) EmailAccessHere-32156676.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2564) EmailAccessHere-32156676.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A1000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2564) EmailAccessHere-32156676.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2564) EmailAccessHere-32156676.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2564) EmailAccessHere-32156676.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2564) EmailAccessHere-32156676.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2564) EmailAccessHere-32156676.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(916) IEXPLORE.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
1546696146
(PID) Process:(916) IEXPLORE.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30794399
(PID) Process:(2564) EmailAccessHere-32156676.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A2000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
Executable files
10
Suspicious files
97
Text files
167
Unknown types
51

Dropped files

PID
Process
Filename
Type
916IEXPLORE.EXEC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2904IEXPLORE.EXEC:\Users\admin\AppData\Local\Temp\Low\CabA3CA.tmp —
MD5:—
SHA256:—
2904IEXPLORE.EXEC:\Users\admin\AppData\Local\Temp\Low\TarA3CB.tmp —
MD5:—
SHA256:—
2904IEXPLORE.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\54ZO6J47.txt —
MD5:—
SHA256:—
2564EmailAccessHere-32156676.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\main[1]html
MD5:—
SHA256:—
2564EmailAccessHere-32156676.exeC:\Users\admin\AppData\Roaming\{28e56cfb-e30e-4f66-85d8-339885b726b8}\Helper.exeexecutable
MD5:—
SHA256:—
2904IEXPLORE.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6A2279C2CA42EBEE26F14589F0736E50der
MD5:—
SHA256:—
2904IEXPLORE.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6A2279C2CA42EBEE26F14589F0736E50binary
MD5:—
SHA256:—
2904IEXPLORE.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894der
MD5:—
SHA256:—
2904IEXPLORE.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_93E4B2BA79A897B3100CCB27F2D3BF4Fder
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
73
TCP/UDP connections
133
DNS requests
49
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2904
IEXPLORE.EXE
GET
302
52.202.120.236:80
http://search.hemailaccesshere.com/?ap=appfocus1&uid=10a917c5-567a-4403-8544-f324a7369f17&i_id=email_spt__1.30&uc=20200213&source=d-ccc4-lp0-cp_6645210473-bb8-iei-msn
US
html
300 b
unknown
2564
EmailAccessHere-32156676.exe
GET
200
52.7.11.87:80
http://www.browser-tech.com/impression.do?domain=hemailaccesshere.com&implementation_id=email_spt__1.30&offer_id=_iei_&source=d-ccc4-lp0-cp_6645210473-bb8-iei&sub_id=20200213&traffic_source=appfocus1&user_id=10a917c5-567a-4403-8544-f324a7369f17&useragent=Mozilla%2F5.0+(Windows+NT+6.1%3B+WOW64%3B+Trident%2F7.0%3B+rv%3A11.0)+like+Gecko&ts=1581620182&sgn=7c746a1d3dabf194c1ac4fcac3f30cd33de9bd92&subid2=11.0.9600.17843&event=ex_accepted
US
text
1.70 Kb
shared
2564
EmailAccessHere-32156676.exe
GET
200
52.7.11.87:80
http://www.browser-tech.com/impression.do?domain=hemailaccesshere.com&implementation_id=email_spt__1.30&offer_id=_iei_&source=d-ccc4-lp0-cp_6645210473-bb8-iei&sub_id=20200213&traffic_source=appfocus1&user_id=10a917c5-567a-4403-8544-f324a7369f17&useragent=Mozilla%2F5.0+(Windows+NT+6.1%3B+WOW64%3B+Trident%2F7.0%3B+rv%3A11.0)+like+Gecko&ts=1581620182&sgn=7c746a1d3dabf194c1ac4fcac3f30cd33de9bd92&subid2=11.0.9600.17843&event=ex_executed
US
text
1.70 Kb
shared
2904
IEXPLORE.EXE
GET
200
143.204.208.108:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D
US
der
1.39 Kb
shared
2904
IEXPLORE.EXE
GET
200
13.35.254.89:80
http://ocsp.sca1b.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEAjegK%2BuR8LDg8C9tUgNGEk%3D
US
der
471 b
whitelisted
2904
IEXPLORE.EXE
GET
200
216.58.207.67:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
2904
IEXPLORE.EXE
GET
200
13.35.254.89:80
http://ocsp.sca1b.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQz9arGHWbnBV0DFzpNHz4YcTiFDQQUWaRmBlKge5WSPKOUByeWdFv5PdACEAjegK%2BuR8LDg8C9tUgNGEk%3D
US
der
471 b
whitelisted
2564
EmailAccessHere-32156676.exe
GET
200
52.7.11.87:80
http://www.browser-tech.com/impression.do?domain=hemailaccesshere.com&implementation_id=email_spt__1.30&offer_id=_iei_&source=d-ccc4-lp0-cp_6645210473-bb8-iei&sub_id=20200213&traffic_source=appfocus1&user_id=10a917c5-567a-4403-8544-f324a7369f17&useragent=Mozilla%2F5.0+(Windows+NT+6.1%3B+WOW64%3B+Trident%2F7.0%3B+rv%3A11.0)+like+Gecko&ts=1581620182&sgn=7c746a1d3dabf194c1ac4fcac3f30cd33de9bd92&subid2=11.0.9600.17843&event=ex_installed
US
text
1.70 Kb
shared
2564
EmailAccessHere-32156676.exe
GET
200
52.7.11.87:80
http://www.browser-tech.com/impression.do?domain=hemailaccesshere.com&implementation_id=email_spt__1.30&offer_id=_iei_&source=d-ccc4-lp0-cp_6645210473-bb8-iei&sub_id=20200213&traffic_source=appfocus1&user_id=10a917c5-567a-4403-8544-f324a7369f17&useragent=Mozilla%2F5.0+(Windows+NT+6.1%3B+WOW64%3B+Trident%2F7.0%3B+rv%3A11.0)+like+Gecko&ts=1581620182&sgn=7c746a1d3dabf194c1ac4fcac3f30cd33de9bd92&subid2=11.0.9600.17843&event=ex_set_hp
US
text
1.70 Kb
shared
2564
EmailAccessHere-32156676.exe
GET
200
52.7.11.87:80
http://www.browser-tech.com/ies/api.cgi?act=postStat&cx=-1&cy=-1&id=32156676&rf=1&ver=5.5.0.1&proto=1
US
text
1.70 Kb
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2904
IEXPLORE.EXE
52.202.120.236:443
search.hemailaccesshere.com
Amazon.com, Inc.
US
unknown
2904
IEXPLORE.EXE
13.35.254.76:80
o.ss2.us
—
US
malicious
2904
IEXPLORE.EXE
52.202.120.236:80
search.hemailaccesshere.com
Amazon.com, Inc.
US
unknown
2564
EmailAccessHere-32156676.exe
52.7.11.87:80
www.browser-tech.com
Amazon.com, Inc.
US
malicious
916
IEXPLORE.EXE
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
—
—
13.35.254.224:80
s.ss2.us
—
US
suspicious
—
—
13.35.254.41:80
ocsp.rootg2.amazontrust.com
—
US
whitelisted
2904
IEXPLORE.EXE
54.154.183.37:443
appfocus.go2cloud.org
Amazon.com, Inc.
IE
suspicious
2904
IEXPLORE.EXE
13.35.254.89:80
ocsp.sca1b.amazontrust.com
—
US
whitelisted
—
—
143.204.208.108:80
ocsp.rootca1.amazontrust.com
—
US
whitelisted

DNS requests

Domain
IP
Reputation
www.browser-tech.com
  • 52.7.11.87
  • 18.210.55.222
shared
search.hemailaccesshere.com
  • 52.202.120.236
  • 52.6.18.44
unknown
o.ss2.us
  • 13.35.254.76
  • 13.35.254.205
  • 13.35.254.216
  • 13.35.254.192
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
s.ss2.us
  • 13.35.254.224
  • 13.35.254.215
  • 13.35.254.143
  • 13.35.254.173
whitelisted
ocsp.rootg2.amazontrust.com
  • 13.35.254.41
  • 13.35.254.226
  • 13.35.254.57
  • 13.35.254.52
whitelisted
ocsp.rootca1.amazontrust.com
  • 143.204.208.108
  • 143.204.208.192
  • 143.204.208.90
  • 143.204.208.23
shared
ocsp.sca1b.amazontrust.com
  • 13.35.254.89
  • 13.35.254.29
  • 13.35.254.90
  • 13.35.254.113
whitelisted
appfocus.go2cloud.org
  • 54.154.183.37
  • 34.245.243.239
  • 52.214.251.189
shared

Threats

PID
Process
Class
Message
2564
EmailAccessHere-32156676.exe
A Network Trojan was detected
ET MALWARE MSIL/Adload.AT Beacon
2564
EmailAccessHere-32156676.exe
A Network Trojan was detected
ET MALWARE MSIL/Adload.AT Beacon
2564
EmailAccessHere-32156676.exe
A Network Trojan was detected
ET MALWARE MSIL/Adload.AT Beacon
2564
EmailAccessHere-32156676.exe
A Network Trojan was detected
ET MALWARE MSIL/Adload.AT Beacon
2564
EmailAccessHere-32156676.exe
A Network Trojan was detected
ET MALWARE MSIL/Adload.AT Beacon
3988
searchbar_5e459bed3ab73.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
3988
searchbar_5e459bed3ab73.exe
Misc activity
SUSPICIOUS [PTsecurity] HTTP header - Sometimes used by hostile installer
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
EmailAccessHere-32156676.exe