URL:

https://www.bing.com/aclk?ld=e8dmpPxgbQ7KutyOz9R-ZKHjVUCUzotYqdKIu19vWOsCIegBZ8-ji9UJmLOVzvv4Xa7W78kM_zugerh9EjRQ0mn0zJgi5grb-hllGUMIFGp9OVqCukC_yEGzQEfg3G0qZ7d6jvFZ8G5M1YmDdS_kiOCxRZsX1dM7JAkkNQ9X0UKhcg8raOQi2BzeP74aPRvKh3lbhaEQ&u=aHR0cHMlM2ElMmYlMmZ3d3cubXloZXJpdGFnZS5jb20lM2YxJTNkMSUyNnV0bV9zb3VyY2UlM2RwcGNfYmluZyUyNnV0bV9tZWRpdW0lM2RjcGMlMjZ1dG1fY2FtcGFpZ24lM2RtaF9iaW5nLXNlYXJjaF91c19lbl9kZXNfd2ViX2V4YWN0X3dlYl9teWhlcml0YWdlLWRvbWFpbiUyNnV0bV9jb250ZW50JTNkNzMzMjM3OTE1NDk5NTQlMjZ1dG1fdGVybSUzZG15aGVyaXRhZ2UlMjUyMGNvbSUyNnRyX2NhbXBfaWQlM2QyNjg1MjU5OTElMjZ0cl9hZF9ncm91cCUzZG15aGVyaXRhZ2Vfc2l0ZV9pJTI2dHJfYWdfaWQlM2QxMTczMTc5Mzg3NTIwMDk3JTI2dHJfZGV2aWNlJTNkYyUyNnRyX2FjY291bnQlM2RGMTA3OVY4UyUyNm1zY2xraWQlM2RlOWNlNmE5NjE5YjcxNzQ5NDY4ODBlMTEwMTc2MGFmNA&rlid=e9ce6a9619b7174946880e1101760af4&ntb=1

Full analysis: https://app.any.run/tasks/37a46ec2-3cb0-4628-baf8-2b3225f9bdba
Verdict: Malicious activity
Analysis date: June 23, 2023, 16:08:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

4A0F297C1A1494207A56536A1328801F

SHA1:

A977D52E1E31C2913820E7AE6A8E4A2A8636A8E1

SHA256:

A4C22B5A8D0CFF5B0ABC456DE6EDFB78B244B9CA94BEEC30FD7D314C76D51824

SSDEEP:

24:2PRYtavaNYkFPeRZfC/+wCdDMwCAxoXuA8:wRYiMFMRZ6CxPCAe+A8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 1160)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
1160"C:\Program Files\Internet Explorer\iexplore.exe" "https://www.bing.com/aclk?ld=e8dmpPxgbQ7KutyOz9R-ZKHjVUCUzotYqdKIu19vWOsCIegBZ8-ji9UJmLOVzvv4Xa7W78kM_zugerh9EjRQ0mn0zJgi5grb-hllGUMIFGp9OVqCukC_yEGzQEfg3G0qZ7d6jvFZ8G5M1YmDdS_kiOCxRZsX1dM7JAkkNQ9X0UKhcg8raOQi2BzeP74aPRvKh3lbhaEQ&u=aHR0cHMlM2ElMmYlMmZ3d3cubXloZXJpdGFnZS5jb20lM2YxJTNkMSUyNnV0bV9zb3VyY2UlM2RwcGNfYmluZyUyNnV0bV9tZWRpdW0lM2RjcGMlMjZ1dG1fY2FtcGFpZ24lM2RtaF9iaW5nLXNlYXJjaF91c19lbl9kZXNfd2ViX2V4YWN0X3dlYl9teWhlcml0YWdlLWRvbWFpbiUyNnV0bV9jb250ZW50JTNkNzMzMjM3OTE1NDk5NTQlMjZ1dG1fdGVybSUzZG15aGVyaXRhZ2UlMjUyMGNvbSUyNnRyX2NhbXBfaWQlM2QyNjg1MjU5OTElMjZ0cl9hZF9ncm91cCUzZG15aGVyaXRhZ2Vfc2l0ZV9pJTI2dHJfYWdfaWQlM2QxMTczMTc5Mzg3NTIwMDk3JTI2dHJfZGV2aWNlJTNkYyUyNnRyX2FjY291bnQlM2RGMTA3OVY4UyUyNm1zY2xraWQlM2RlOWNlNmE5NjE5YjcxNzQ5NDY4ODBlMTEwMTc2MGFmNA&rlid=e9ce6a9619b7174946880e1101760af4&ntb=1"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3612"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1160 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
13 938
Read events
13 785
Write events
151
Delete events
2

Modification events

(PID) Process:(1160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(1160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(1160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(1160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
1
Suspicious files
30
Text files
65
Unknown types
0

Dropped files

PID
Process
Filename
Type
3612iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:B4CF4F6DB7372E7B6AA7618CCE3F9737
SHA256:E1898185690BA249B29EFCC4FDE2D8217FD2086B5990065C7427086CA7679327
3612iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
3612iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:E681A1FC5936A81C5F0406E81EB316E1
SHA256:2BB778FCCEFFF488E949AFF1A0CDC41532AEAA75ED8828BA8CB93F1E0A6DD686
1160iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
3612iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:150EFED1F28E9817B30B542E6E943302
SHA256:44473E97B821D7BB64F0EA01F166DAC23C04DC81114A91B2169E0B7991A33D0B
1160iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:6DEE3AE636DF31BCB5D47C4CEC094A0D
SHA256:FEC803E0FC969C2174F4C3B0EC1CA2A22B05663B413982CD2B334EA3F2DFB17F
1160iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:C40138CF817F94B85BEA6C0DF95C831C
SHA256:178ADB698D7A88D7570F030B16994F56F9F003653CC00F6B19B62B109AEAB6AD
1160iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
1160iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\urlblockindex[1].binbinary
MD5:FA518E3DFAE8CA3A0E495460FD60C791
SHA256:775853600060162C4B4E5F883F9FD5A278E61C471B3EE1826396B6D129499AA7
1160iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
98
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3612
iexplore.exe
GET
200
108.138.2.173:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
binary
2.02 Kb
whitelisted
1160
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
3612
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
binary
1.47 Kb
whitelisted
3612
iexplore.exe
GET
200
18.66.107.194:80
http://crl.rootg2.amazontrust.com/rootg2.crl
US
binary
713 b
whitelisted
3612
iexplore.exe
GET
200
52.222.250.42:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D
US
binary
1.39 Kb
shared
1160
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D
US
binary
471 b
whitelisted
3612
iexplore.exe
GET
200
18.66.107.194:80
http://crl.rootca1.amazontrust.com/rootca1.crl
US
binary
651 b
whitelisted
3612
iexplore.exe
GET
200
52.222.250.185:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
US
binary
1.51 Kb
whitelisted
1160
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D
US
binary
471 b
whitelisted
3612
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?bc64329c8f00bbdc
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3612
iexplore.exe
2.23.209.187:443
—
Akamai International B.V.
GB
suspicious
820
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3612
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
3612
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1160
iexplore.exe
2.23.209.187:443
—
Akamai International B.V.
GB
suspicious
1160
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted
1160
iexplore.exe
2.23.209.130:443
—
Akamai International B.V.
GB
malicious
1160
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3612
iexplore.exe
45.60.13.42:443
www.myheritage.com
INCAPSULA
US
suspicious

DNS requests

Domain
IP
Reputation
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
www.myheritage.com
  • 45.60.13.42
suspicious
cf.mhcache.com
  • 108.138.7.37
  • 108.138.7.70
  • 108.138.7.63
  • 108.138.7.59
malicious
www.google.com
  • 172.217.16.196
malicious
o.ss2.us
  • 108.138.2.173
  • 108.138.2.195
  • 108.138.2.107
  • 108.138.2.10
whitelisted
ocsp.rootg2.amazontrust.com
  • 52.222.250.174
  • 52.222.250.42
  • 52.222.250.112
  • 52.222.250.185
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.bing.com/aclk?ld=e8dmpPxgbQ7KutyOz9R-ZKHjVUCUzotYqdKIu19vWOsCIegBZ8-ji9UJmLOVzvv4Xa7W78kM_zugerh9EjRQ0mn0zJgi5grb-hllGUMIFGp9OVqCukC_yEGzQEfg3G0qZ7d6jvFZ8G5M1YmDdS_kiOCxRZsX1dM7JAkkNQ9X0UKhcg8raOQi2BzeP74aPRvKh3lbhaEQ&u=aHR0cHMlM2ElMmYlMmZ3d3cubXloZXJpdGFnZS5jb20lM2YxJTNkMSUyNnV0bV9zb3VyY2UlM2RwcGNfYmluZyUyNnV0bV9tZWRpdW0lM2RjcGMlMjZ1dG1fY2FtcGFpZ24lM2RtaF9iaW5nLXNlYXJjaF91c19lbl9kZXNfd2ViX2V4YWN0X3dlYl9teWhlcml0YWdlLWRvbWFpbiUyNnV0bV9jb250ZW50JTNkNzMzMjM3OTE1NDk5NTQlMjZ1dG1fdGVybSUzZG15aGVyaXRhZ2UlMjUyMGNvbSUyNnRyX2NhbXBfaWQlM2QyNjg1MjU5OTElMjZ0cl9hZF9ncm91cCUzZG15aGVyaXRhZ2Vfc2l0ZV9pJTI2dHJfYWdfaWQlM2QxMTczMTc5Mzg3NTIwMDk3JTI2dHJfZGV2aWNlJTNkYyUyNnRyX2FjY291bnQlM2RGMTA3OVY4UyUyNm1zY2xraWQlM2RlOWNlNmE5NjE5YjcxNzQ5NDY4ODBlMTEwMTc2MGFmNA&rlid=e9ce6a9619b7174946880e1101760af4&ntb=1