URL:

http://www.nurselabs.com

Full analysis: https://app.any.run/tasks/172ed2c7-9c2e-44e7-aff4-5d54acdb87db
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: October 10, 2019, 20:27:51
OS: Windows 10 Professional (build: 16299, 32 bit)
Tags:
adware
Indicators:
MD5:

E98F667CA7E39FE749CC66177B5C65E8

SHA1:

609F6B5ECD190830238DC72B5C53505F9526E0F7

SHA256:

8A12E186769893C4A8A2246D0FCEB6AFAE06C144CD9B6B589306CFD8875D9A20

SSDEEP:

3:N1KJS4ksWLKn:Cc4k7K

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 732)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2600)

    • Application launched itself

      • iexplore.exe (PID: 732)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2600)

    • Reads the software policy settings

      • iexplore.exe (PID: 2600)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
732"C:\Program Files\Internet Explorer\iexplore.exe" "http://www.nurselabs.com"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2600"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:732 CREDAT:9474 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.16299.15 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
649
Read events
577
Write events
72
Delete events
0

Modification events

(PID) Process:(732) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(732) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(732) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(732) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(732) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(732) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(732) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(732) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(732) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(732) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{77618271-EB9C-11E9-A549-5254004AAD11}
Value:
0
Executable files
0
Suspicious files
0
Text files
25
Unknown types
1

Dropped files

PID
Process
Filename
Type
2600iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\YT1LWHPF\registrar[1].jstext
MD5:—
SHA256:—
2600iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\JQW3SED2\home[1].csstext
MD5:—
SHA256:—
2600iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\JQW3SED2\main[1].csstext
MD5:—
SHA256:—
2600iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\YT1LWHPF\1RFSN5MK.htmhtml
MD5:—
SHA256:—
2600iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\VGQD2T4M\cookies[1].htmhtml
MD5:CD2E0E43980A00FB6A2742D3AFD803B8
SHA256:BD9DF047D51943ACC4BC6CF55D88EDB5B6785A53337EE2A0F74DD521AEDDE87D
2600iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\JQW3SED2\logo[1].htmhtml
MD5:CD2E0E43980A00FB6A2742D3AFD803B8
SHA256:BD9DF047D51943ACC4BC6CF55D88EDB5B6785A53337EE2A0F74DD521AEDDE87D
2600iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\VGQD2T4M\home[1].htmhtml
MD5:CD2E0E43980A00FB6A2742D3AFD803B8
SHA256:BD9DF047D51943ACC4BC6CF55D88EDB5B6785A53337EE2A0F74DD521AEDDE87D
2600iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\ZIQVVIF7\jquery.min[1].htmhtml
MD5:CD2E0E43980A00FB6A2742D3AFD803B8
SHA256:BD9DF047D51943ACC4BC6CF55D88EDB5B6785A53337EE2A0F74DD521AEDDE87D
2600iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\VGQD2T4M\main[1].htmhtml
MD5:CD2E0E43980A00FB6A2742D3AFD803B8
SHA256:BD9DF047D51943ACC4BC6CF55D88EDB5B6785A53337EE2A0F74DD521AEDDE87D
2600iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\ZIQVVIF7\jquery.min[1].jshtml
MD5:DDB84C1587287B2DF08966081EF063BF
SHA256:88171413FC76DDA23AB32BAA17B11E4FFF89141C633ECE737852445F1BA6C1BD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
31
DNS requests
16
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2600
iexplore.exe
GET
—
74.220.199.6:80
http://www.nurselabs.com/
US
—
—
malicious
—
—
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
2600
iexplore.exe
GET
200
209.126.127.231:80
http://cdn.dsultra.com/js/registrar.js
US
text
1.22 Kb
whitelisted
2600
iexplore.exe
GET
301
18.196.78.38:80
http://www.bluehost.com/media/shared/general/cookies.js
DE
html
178 b
whitelisted
2600
iexplore.exe
GET
301
18.196.78.38:80
http://www.bluehost.com/media/shared/info/index/_bh/home.css
DE
html
178 b
whitelisted
2600
iexplore.exe
GET
301
18.196.78.38:80
http://www.bluehost.com/media/shared/general/_bh/main.css
DE
html
178 b
whitelisted
2600
iexplore.exe
GET
301
18.196.78.38:80
http://www.bluehost.com/media/shared/info/index/_bh/logo.jpg
DE
html
178 b
whitelisted
2600
iexplore.exe
POST
200
209.126.127.231:80
http://mars.connectioncdn.com/f/stats.php
US
text
162 b
malicious
2600
iexplore.exe
GET
—
208.91.196.46:80
http://www.iyfubh.com/?dn=nurselabs.com&pid=9POJB64QD
VG
—
—
whitelisted
2600
iexplore.exe
GET
301
18.196.78.38:80
http://www.bluehost.com/media/shared/general/jquery/jquery.min.js
DE
html
178 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2600
iexplore.exe
74.220.199.6:80
www.nurselabs.com
Unified Layer
US
malicious
—
—
40.90.137.120:443
login.live.com
Microsoft Corporation
US
unknown
—
—
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2600
iexplore.exe
18.196.78.38:80
www.bluehost.com
Amazon.com, Inc.
DE
unknown
2600
iexplore.exe
209.126.127.231:80
cdn.dsultra.com
server4you Inc.
US
malicious
2600
iexplore.exe
18.196.78.38:443
www.bluehost.com
Amazon.com, Inc.
DE
unknown
2600
iexplore.exe
216.58.207.46:443
www.google-analytics.com
Google Inc.
US
whitelisted
2600
iexplore.exe
74.125.140.155:443
stats.g.doubleclick.net
Google Inc.
US
whitelisted
2600
iexplore.exe
208.91.196.46:80
www.iyfubh.com
Confluence Networks Inc
VG
malicious
2600
iexplore.exe
209.126.127.231:443
cdn.dsultra.com
server4you Inc.
US
malicious

DNS requests

Domain
IP
Reputation
www.nurselabs.com
  • 74.220.199.6
malicious
login.live.com
  • 40.90.137.120
  • 40.90.137.127
  • 40.90.23.247
whitelisted
self.events.data.microsoft.com
  • 52.114.158.91
  • 52.114.128.8
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
www.bluehost.com
  • 18.196.78.38
whitelisted
cdn.dsultra.com
  • 209.126.127.231
  • 209.126.103.59
whitelisted
mars.connectioncdn.com
  • 209.126.127.231
unknown
www.google-analytics.com
  • 216.58.207.46
whitelisted
www.iyfubh.com
  • 208.91.196.46
whitelisted
stats.g.doubleclick.net
  • 74.125.140.155
  • 74.125.140.157
  • 74.125.140.156
  • 74.125.140.154
whitelisted

Threats

PID
Process
Class
Message
1488
svchost.exe
A Network Trojan was detected
ET WEB_CLIENT Observed DNS Query to Malicious Cookie Monster Roulette JS Cookie Stealer Exfil Domain
2600
iexplore.exe
Misc activity
ADWARE [PTsecurity] InstantAccess
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://www.nurselabs.com