URL:

https://es.pornhub.com/

Full analysis: https://app.any.run/tasks/fe0649f5-26c2-44cd-9d67-4b912f3d8131
Verdict: Malicious activity
Analysis date: February 24, 2024, 21:11:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
covid19
Indicators:
MD5:

6C53ECA77E899836464CDBCF92130A07

SHA1:

638590B453D1D12D3106A44EF282FA4822AF62F2

SHA256:

8D1DAFF4D0D297341D9D18F34A00BF07A613AB4FC6845F951E08B66203DA6530

SSDEEP:

3:N81gpSt:2ip6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Drops a (possible) Coronavirus decoy

      • iexplore.exe (PID: 2044)

    • Application launched itself

      • iexplore.exe (PID: 3700)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2044"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3700 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3700"C:\Program Files\Internet Explorer\iexplore.exe" "https://es.pornhub.com/"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
22 911
Read events
22 775
Write events
101
Delete events
35

Modification events

(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
34933936
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31090534
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
335093936
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31090534
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
24
Text files
171
Unknown types
17

Dropped files

PID
Process
Filename
Type
2044iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_A60A47F328D1536988B0DFE88D6D301Fder
MD5:5C3E61C2EE8EE460CAD058CB24403F58
SHA256:F70B79D9FF1F4DFF0778390CB37A58CC383C519CB195CA5289B0572DC98C016D
2044iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:F93E10C1E19F584CFC62612699655BB9
SHA256:B54F3104A69D57BC66AAF71E33DFA71C3C344598ACE36546E0D52BCAB4659140
2044iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\SRZUCU66.txttext
MD5:02B271A82A7198B2895585054FAAD3FE
SHA256:E8C6FDA93A95725EC0DF5BD77F668E25949C38FB0AECA573C8D48C14596F8B3F
2044iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\VEEDYNZT.txttext
MD5:87F1162070BCCD20A31D0C433E4E994A
SHA256:9A0764D3A0745039C650B056618768626C452BC716006073B82CC7D937FA234E
2044iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\M3H0U47Y.txttext
MD5:8BC5A980329EFDCBE76B95CC3AD2141B
SHA256:94D1F3B8DC59AE08A82216FCA5FBD09ABE7A05C2B663B0F048AA8561936C288D
2044iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_A60A47F328D1536988B0DFE88D6D301Fbinary
MD5:45E199DC8331C20D4DD382C11DC95201
SHA256:A7CE6A51DB5381F15A20D68F73923AFA3B74E2ED659F641D5C635970BFDCF89C
2044iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B1C7267527E2135ED2C5C2AE13A93217_7C467C3BFC77B0282FB30FDE34666973binary
MD5:6CC4C555145AE8639E46A7A55DC10F35
SHA256:F4F13C689FEA875972E8EB6F50BAA97F54F6380216AFBC611DD67BEFF9BB2809
2044iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\QGMUITWZ.htmhtml
MD5:47FA7C1809B5863DC60611F137942B62
SHA256:312FE33CAE56A71725C0D687A47CF896099411741F2985B105C20B49F3902202
2044iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B1C7267527E2135ED2C5C2AE13A93217_7C467C3BFC77B0282FB30FDE34666973der
MD5:F7383641B00263301E9560F2BF324EA1
SHA256:548A298B1DFE0519582648EB5F3F8C72645E322AC26D4D2F3F3750DB15A09A61
2044iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\N1X20SEY.txttext
MD5:E283AE49EE88D4127EAD476454B18A9A
SHA256:0EB08902F89AAC89BAAEDF9F74ED022C3E4D67C73CD24D12813A2DBDDD82627C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
25
TCP/UDP connections
64
DNS requests
24
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2044
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?545e1839169dd0e6
unknown
—
—
unknown
2044
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f78d505714a595e3
unknown
—
—
unknown
2044
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAsA6S1NbXMfyjBZx8seGIY%3D
unknown
binary
313 b
unknown
2044
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAwiVBgdbf36ZuJk48F6SLw%3D
unknown
binary
313 b
unknown
2044
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
binary
471 b
unknown
2044
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS%2Fm8vvceKzm40ZSHrPx1iFNU%2BPAgQUiiPrnmvX%2BTdd%2BW0hOXaaoWfeEKgCEA%2FN%2Bw%2BLlAVpJfASRkC5P3k%3D
unknown
binary
313 b
unknown
2044
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS%2Fm8vvceKzm40ZSHrPx1iFNU%2BPAgQUiiPrnmvX%2BTdd%2BW0hOXaaoWfeEKgCEAbtQuDQ0c3gzpS%2Bx4P2Z9I%3D
unknown
binary
312 b
unknown
2044
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAvTPwVJejdJm7x7948EZoA%3D
unknown
binary
471 b
unknown
2044
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAL%2FOdOFJp3T3HHo4ljm%2Fv4%3D
unknown
binary
471 b
unknown
2044
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEAL%2FOdOFJp3T3HHo4ljm%2Fv4%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2044
iexplore.exe
66.254.114.41:443
es.pornhub.com
REFLECTED
US
unknown
2044
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
2044
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2044
iexplore.exe
66.254.122.16:443
ei.phncdn.com
REFLECTED
US
unknown
2044
iexplore.exe
66.254.122.19:443
ei.phncdn.com
REFLECTED
US
unknown
2044
iexplore.exe
66.254.114.156:443
cdn1-smallimg.phncdn.com
REFLECTED
US
unknown
2044
iexplore.exe
142.250.186.72:443
www.googletagmanager.com
GOOGLE
US
unknown

DNS requests

Domain
IP
Reputation
es.pornhub.com
  • 66.254.114.41
malicious
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
ei.phncdn.com
  • 66.254.122.16
  • 66.254.122.17
  • 66.254.122.18
  • 66.254.122.19
  • 66.254.122.20
  • 66.254.122.21
  • 66.254.122.22
  • 66.254.122.23
whitelisted
static.trafficjunky.com
  • 66.254.122.19
  • 66.254.122.20
  • 66.254.122.21
  • 66.254.122.22
  • 66.254.122.23
  • 66.254.122.16
  • 66.254.122.17
  • 66.254.122.18
whitelisted
cdn1-smallimg.phncdn.com
  • 66.254.114.156
whitelisted
media.trafficjunky.net
  • 66.254.122.16
  • 66.254.122.17
  • 66.254.122.18
  • 66.254.122.19
  • 66.254.122.20
  • 66.254.122.21
  • 66.254.122.22
  • 66.254.122.23
whitelisted
www.googletagmanager.com
  • 142.250.186.72
whitelisted
hubt.pornhub.com
  • 216.18.168.30
whitelisted
ss.phncdn.com
  • 66.254.122.20
  • 66.254.122.21
  • 66.254.122.22
  • 66.254.122.23
  • 66.254.122.16
  • 66.254.122.17
  • 66.254.122.18
  • 66.254.122.19
whitelisted

Threats

PID
Process
Class
Message
2044
iexplore.exe
Not Suspicious Traffic
INFO [ANY.RUN] Global content delivery network (unpkg .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://es.pornhub.com/