URL:

https://w15.mangafreak.net

Full analysis: https://app.any.run/tasks/5c38c341-26a0-4b32-8cdf-532418a68c93
Verdict: Malicious activity
Analysis date: October 25, 2023, 09:45:38
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

2174AE5948C948B5BAC84270AA9F07F6

SHA1:

6B29EB92187FD1D4DEE09ACABD75C105F08A51AF

SHA256:

911C36916BA0F291A2581D29D54F871CBDE888C0322266485FFADE200996AE32

SSDEEP:

3:N8qhChn/0n:2qU9/0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 1904)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
1904"C:\Program Files\Internet Explorer\iexplore.exe" "https://w15.mangafreak.net"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2828"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1904 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
20 149
Read events
20 074
Write events
73
Delete events
2

Modification events

(PID) Process:(1904) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(1904) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(1904) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(1904) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1904) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1904) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1904) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1904) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000056010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1904) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1904) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
0
Suspicious files
46
Text files
266
Unknown types
0

Dropped files

PID
Process
Filename
Type
2828iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:5029D3E57EDBE148EC2C5F5616A9D5C9
SHA256:1EB73B64A9EADB412EF30D0291435061B36D7D86F42D9432844470D02FF88A72
2828iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\VFF26WPU.htmhtml
MD5:9CB7BCACBE3448AB302C6EFFE6ABD42A
SHA256:59E39304C7175D49C216342297FBD0A3020016BBD0B4BF99A5AA980C5E4ADB96
2828iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\custom_tooltip[1].csstext
MD5:0C2288286917CDE2C8B44921AE944382
SHA256:EFB2F6B63A98DAD7D8CD032E1EA167F825310A0914A10E0DB1B13DA888F4821C
2828iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
2828iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\style[1].csstext
MD5:ED6EF70FAB03F63E0FAD6699B41495CF
SHA256:87811C9C8A799EF6D5AD55AAFF7403BDFFE04A311CCF638154ED73463BA94046
2828iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\search[1].jstext
MD5:A646B7441D828636D3A239935F47F0EE
SHA256:74142C2EC18399D0EC5C915C17C435A7814A6C37A18C8532C1D7F5EC1FAE1A6E
2828iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\responsiveslides.min[1].jshtml
MD5:04F1B2AC39E762CD516CB359755C8CC6
SHA256:1F306DB5A9C29477ACDD6B78D57734F0AA7936A1FA9B9BA8BD36204BA12AAF40
2828iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\custom_tooltip[1].jstext
MD5:0746A170DDD567EC0787219EA5BD8DB7
SHA256:EA88081C1E86A44227E6EF4D8F65B0A5151235AD90A7F8F8D787049ED15E4E87
2828iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\70x100[1].jpgimage
MD5:114EB6C1FDA4827879BBB3A0A2212A91
SHA256:25D1D5DA029BCD6FEEACBE89B739C303E86232CEF8D3E7EEA13E1C8C67E8ABE6
2828iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:3D26A105E1876B9A0A2D10A234D2FA6B
SHA256:1C04455F4F0586333E4EEFE8FBC709DC318843C295A3F1243C7915932215D80F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
24
TCP/UDP connections
62
DNS requests
31
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2828
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
unknown
binary
1.47 Kb
unknown
2828
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?44b7f016ec3320f4
unknown
compressed
4.66 Kb
unknown
2828
iexplore.exe
GET
200
172.217.169.195:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFCjJ1PwkYAi7fE%3D
unknown
binary
724 b
unknown
2828
iexplore.exe
GET
200
172.217.169.195:80
http://ocsp.pki.goog/gts1c3/MFAwTjBMMEowSDAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCDx9GnoHWsw4QZ9qW7IsCPg%3D%3D
unknown
binary
470 b
unknown
2828
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?92f371e0bdaf0179
unknown
compressed
61.6 Kb
unknown
2828
iexplore.exe
GET
200
23.212.210.158:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
2828
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?67784c5218ee4f7b
unknown
compressed
61.6 Kb
unknown
2828
iexplore.exe
GET
200
172.217.169.195:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC97L2V6ExuqQrJuoyaj3td
unknown
binary
472 b
unknown
2828
iexplore.exe
GET
200
172.217.169.195:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQC97L2V6ExuqQrJuoyaj3td
unknown
binary
472 b
unknown
2828
iexplore.exe
GET
200
184.24.77.185:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgQ046Ej6DAH%2Bd2iT%2B%2Bzb8XnMw%3D%3D
unknown
binary
503 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2828
iexplore.exe
104.26.4.92:443
images.mangafreak.net
CLOUDFLARENET
US
unknown
2828
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted
2828
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2828
iexplore.exe
172.217.169.106:443
ajax.googleapis.com
GOOGLE
US
whitelisted
2828
iexplore.exe
172.217.17.142:443
apis.google.com
GOOGLE
US
whitelisted
2828
iexplore.exe
104.21.69.41:443
cdn.siteswithcontent.com
CLOUDFLARENET
—
unknown
2828
iexplore.exe
104.26.5.92:443
images.mangafreak.net
CLOUDFLARENET
US
unknown
2828
iexplore.exe
172.217.169.195:80
ocsp.pki.goog
GOOGLE
US
whitelisted
2828
iexplore.exe
142.250.187.136:443
www.googletagmanager.com
GOOGLE
US
unknown
2828
iexplore.exe
192.243.59.12:443
fibberestimate.com
DataWeb Global Group B.V.
US
unknown

DNS requests

Domain
IP
Reputation
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
apis.google.com
  • 172.217.17.142
whitelisted
ajax.googleapis.com
  • 172.217.169.106
whitelisted
cdn.siteswithcontent.com
  • 104.21.69.41
  • 172.67.204.22
malicious
images.mangafreak.net
  • 104.26.5.92
  • 104.26.4.92
  • 172.67.73.96
unknown
ocsp.pki.goog
  • 172.217.169.195
whitelisted
fibberestimate.com
  • 192.243.59.12
  • 173.233.137.36
  • 192.243.59.13
  • 173.233.137.44
  • 192.243.61.225
  • 173.233.139.164
  • 192.243.61.227
  • 173.233.137.60
  • 173.233.137.52
  • 192.243.59.20
unknown
www.googletagmanager.com
  • 142.250.187.136
whitelisted
cm.mgid.com
  • 104.19.132.76
  • 104.19.130.76
  • 104.19.133.76
  • 104.19.131.76
  • 104.19.129.76
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://w15.mangafreak.net