URL:

imagefap.com

Full analysis: https://app.any.run/tasks/bd2ab75e-4e0e-41f1-95dd-3033e5bb65f5
Verdict: Malicious activity
Analysis date: February 13, 2024, 16:14:07
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

CE6FB3F8E3B21E19635764E303753DCF

SHA1:

DB888994459FF1A77075D259FF29E114B27CB0E7

SHA256:

8D64B040262512EDCC5DF60D786A552005882EFE96F9755E1E98545908110314

SSDEEP:

3:JaEhdI:8EhK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3672)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3672"C:\Program Files\Internet Explorer\iexplore.exe" "imagefap.com"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3972"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3672 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
24 739
Read events
24 614
Write events
82
Delete events
43

Modification events

(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31088279
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31088279
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
0
Suspicious files
20
Text files
136
Unknown types
21

Dropped files

PID
Process
Filename
Type
3972iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\ad_loader[1].jstext
MD5:E3D440449CA2B7CDD03A347E8E9D4969
SHA256:72627AB7F3317387BADD834638E0CCA292E91A3000D1F3FC19BF8F73F93EF237
3972iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\MRB2XEJP.txttext
MD5:A9FA7103904CEBC52F5F64BF66C8650C
SHA256:FD42F10A24ECA54BEA9FB4C6A696DE44E983D53C1317625196EE96B89F5AAE16
3972iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\SRZUCU66.htmhtml
MD5:A3793FCA58D07B2853744DA03D016FBD
SHA256:2790B904445FFEC9428DA803A8C3929C79E58AED78148FB6CF96F5605C9CE2C4
3972iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\BBVNSSZO.txttext
MD5:DBF227E569DA62D3645F04D6D8461B09
SHA256:0693075D1C37BA4D985D1B76CCAC37D82F2A3BD6B56AD88DB04630393844E9D5
3972iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\29C17D2E18CA8047DF1F81EF80A5E685der
MD5:0020AC4231A8C119A930E29E73A7C75B
SHA256:60419EF4EFE980A726D4BE6AA30242A151D0417BB02A5DCF905BF808114DC451
3972iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\combine[2].jstext
MD5:D2AAAAD13BB2D524B2EB2B8F7B781E83
SHA256:EAA169879B703A3F3A9E51D62398B69C807B4F0B762B4CF9AAC58359618DD492
3972iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\29C17D2E18CA8047DF1F81EF80A5E685binary
MD5:A181995D2B6C2147240FDFD0EA5A061E
SHA256:D98A565B8495607776E23DA6B5F2768A53499CA507BD50D4230B39139AD8FA24
3972iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\button_register[1].jpgimage
MD5:074C98EA41AF70E2B2D3C54DD6991EDF
SHA256:C0F0C6FD0326A23848CD79F9F61A48FE227076F1F5A5195DC7B3BF2719E3FE70
3972iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:36A57011092F86BE13AC736E10312D3F
SHA256:2AFFA9370D221B2DECC41BEF0B87FD7E0748E50437371BDF169CC0BE3E7E81A9
3972iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\thumbnail_change[1].jstext
MD5:676F08DB9E2651A9617D1753354350CD
SHA256:6A5EF2DC83B8E42CFA5338CBFBFA123F27C43F1A93F1A5E556029E6467B85E31
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
61
DNS requests
26
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3972
iexplore.exe
GET
200
142.250.185.67:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEH6foCbCRVf8EqxKr8tu0Wo%3D
unknown
binary
471 b
unknown
3972
iexplore.exe
GET
200
184.24.77.54:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgP%2B2ki79eg%2F9OttP%2BR1B2Xa%2Fw%3D%3D
unknown
binary
503 b
unknown
3672
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?76ad697231f9b13b
unknown
—
—
unknown
3672
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?18014fff35250a83
unknown
—
—
unknown
3972
iexplore.exe
GET
301
46.166.189.210:80
http://imagefap.com/
unknown
html
169 b
unknown
3972
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?545e1839169dd0e6
unknown
—
—
unknown
3972
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f78d505714a595e3
unknown
—
—
unknown
3972
iexplore.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
unknown
binary
2.18 Kb
unknown
3972
iexplore.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
binary
1.42 Kb
unknown
3972
iexplore.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEEphmwZbrTgRKO%2F9L02qfLA%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3972
iexplore.exe
46.166.189.210:80
imagefap.com
NForce Entertainment B.V.
NL
unknown
3972
iexplore.exe
46.166.189.210:443
imagefap.com
NForce Entertainment B.V.
NL
unknown
3972
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
3972
iexplore.exe
172.64.149.23:80
ocsp.comodoca.com
CLOUDFLARENET
US
unknown
3972
iexplore.exe
104.18.38.233:80
ocsp.comodoca.com
CLOUDFLARENET
—
shared
3972
iexplore.exe
67.26.1.251:443
cdnl.moviefap.com
LEVEL3
US
unknown
3972
iexplore.exe
212.102.56.181:443
ads.exoclick.com
Datacamp Limited
DE
unknown
3972
iexplore.exe
8.248.149.249:443
cdn.imagefap.com
LEVEL3
US
unknown

DNS requests

Domain
IP
Reputation
imagefap.com
  • 46.166.189.210
whitelisted
www.imagefap.com
  • 46.166.189.210
malicious
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
ocsp.usertrust.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.sectigo.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ads.exoclick.com
  • 212.102.56.181
  • 212.102.56.178
  • 195.181.175.41
  • 156.146.33.138
  • 156.146.33.140
  • 195.181.170.18
unknown
cdn.imagefap.com
  • 8.248.149.249
  • 8.238.191.249
  • 67.27.159.249
unknown
cdnl.moviefap.com
  • 67.26.1.251
unknown
www.googletagmanager.com
  • 142.250.185.72
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
imagefap.com