File name:

fuck_niggers_10.hta

Full analysis: https://app.any.run/tasks/039dc32a-0ab9-484d-992a-4bf327191cec
Verdict: Malicious activity
Analysis date: May 18, 2025, 03:29:35
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: text/html
File info: HTML document, ASCII text, with very long lines (496), with no line terminators
MD5:

5CD418A305DCD6C77DE94484690ABEEF

SHA1:

D39CEFCE933556A5B54FEB63D9C8EDACFB7AAE61

SHA256:

B76033213E847D0DC2FD6DF84B792632569C82E61E49235945C6634B78D3342A

SSDEEP:

12:kxvsCk9cE3MotZjo/XU86lJEa/cqANFt6EWe+EFWDrcxYI:kbxw8/k86ga/JANFkEEEFWXTI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    No suspicious indicators.
  • INFO

    • Reads the computer name

      • identity_helper.exe (PID: 8624)
      • ielowutil.exe (PID: 4172)
    • Application launched itself

      • msedge.exe (PID: 7404)
    • Reads Internet Explorer settings

      • mshta.exe (PID: 6044)
    • Reads Environment values

      • identity_helper.exe (PID: 8624)
    • Manual execution by a user

      • msedge.exe (PID: 8952)
    • Checks supported languages

      • identity_helper.exe (PID: 8624)
      • ielowutil.exe (PID: 4172)
    • Reads the software policy settings

      • slui.exe (PID: 780)
    • Local mutex for internet shortcut management

      • iexplore.exe (PID: 6656)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.html | HyperText Markup Language (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
181
Monitored processes
48
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start mshta.exe no specs ielowutil.exe no specs iexplore.exe iexplore.exe no specs iexplore.exe sppextcomobj.exe no specs slui.exe msedge.exe msedge.exe no specs iexplore.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs slui.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
780"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1660"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6656 CREDAT:9476 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2616"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5692 --field-trial-handle=2424,i,8447176556650607699,2578684011700803164,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4172"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -EmbeddingC:\Program Files (x86)\Internet Explorer\ielowutil.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Low-Mic Utility Tool
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\ielowutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
4696"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5796 --field-trial-handle=2424,i,8447176556650607699,2578684011700803164,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4896C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exesvchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4988"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6656 CREDAT:9474 /prefetch:2C:\Program Files (x86)\Internet Explorer\iexplore.exeiexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5204"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5684 --field-trial-handle=2424,i,8447176556650607699,2578684011700803164,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5260"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2424,i,8447176556650607699,2578684011700803164,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5332"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5884 --field-trial-handle=2424,i,8447176556650607699,2578684011700803164,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
13 013
Read events
12 923
Write events
84
Delete events
6

Modification events

(PID) Process:(6656) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Suggested Sites
Operation:writeName:DataStreamEnabledState
Value:
0
(PID) Process:(6656) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Suggested Sites
Operation:writeName:MigrationTime
Value:
DB847CA30259DA01
(PID) Process:(6656) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:DisableFirstRunCustomize
Value:
1
(PID) Process:(6656) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:IE10RunOncePerInstallCompleted
Value:
1
(PID) Process:(6656) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:IE10RunOnceCompletionTime
Value:
DB847CA30259DA01
(PID) Process:(6656) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:IEAppEolNotificationLastShownTimeStamp
Value:
5C5D2518A5C7DB01
(PID) Process:(6656) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6656) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6656) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6656) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
Executable files
6
Suspicious files
169
Text files
40
Unknown types
0

Dropped files

PID
Process
Filename
Type
6656iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF1D70E8558C817A1C.TMPbinary
MD5:2FF92697AAAB800996527AF88062D954
SHA256:A2909E61C0DEB6C9C5B9C02C39EB614BFAA9FE1E42CAD3275FDFF9D0F002B8C6
1660iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\8SFCICQF\arrows[1].pngimage
MD5:0CB2E5165DC9324EB462199F04E1FFA9
SHA256:67DFF0AAD873050F12609885F2264417CCDD0D438311000A704C89F0865F7865
1660iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA0E581ABAB923313BBAD105DEC35C16binary
MD5:9C7441920C52117B884475B3CC0000BC
SHA256:2B598BA8E056FC516D8903E3477F8FBB8F9DC2D8D82AF321D2E494FD714BC93A
1660iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\0CBLTDI3\sale_form[1].jstext
MD5:64F809E06446647E192FCE8D1EC34E09
SHA256:F52CBD664986AD7ED6E71C448E2D31D1A16463E4D9B7BCA0C6BE278649CCC4F3
1660iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\SG5UMOCJ\UP53X9NI.htmhtml
MD5:0311B009A873292040B4C39E3A694DDF
SHA256:42D80EFC59883A6DEFF2274DF7DF0D65B3FC6A543BD7D0115BF5BB7B558FA1F9
1660iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751binary
MD5:E192462F281446B5D1500D474FBACC4B
SHA256:F1BA9F1B63C447682EBF9DE956D0DA2A027B1B779ABEF9522D347D3479139A60
1660iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656binary
MD5:51B16CD826C07DAD3E0B42AE0B6E9465
SHA256:FAA10E40007F35F4502A3E0A4842C4F7723B0DF3120A0E686BE8A8F4E1BDD702
7404msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF10ccc8.TMP
MD5:
SHA256:
7404msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old
MD5:
SHA256:
7404msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF10cd83.TMP
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
34
TCP/UDP connections
101
DNS requests
97
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
1660
iexplore.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
1660
iexplore.exe
GET
200
3.167.227.86:80
http://r11.c.lencr.org/84.crl
unknown
whitelisted
1660
iexplore.exe
GET
200
76.223.26.96:80
http://ww3.daftar.site/?subid1=40cdf775-3397-11f0-9b62-0bc06849b362
unknown
unknown
1660
iexplore.exe
GET
200
18.66.145.213:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D
unknown
whitelisted
1660
iexplore.exe
GET
200
185.53.178.30:80
http://c.parkingcrew.net/scripts/sale_form.js
unknown
whitelisted
6656
iexplore.exe
GET
200
76.223.26.96:80
http://ww3.daftar.site/favicon.ico
unknown
unknown
1660
iexplore.exe
GET
200
18.66.121.69:80
http://d38psrni17bvxu.cloudfront.net/themes/cleanPeppermintBlack_657d9013/img/arrows.png
unknown
whitelisted
1660
iexplore.exe
GET
200
76.223.26.96:80
http://ww3.daftar.site/munin/a/tr/browserjs?domain=daftar.site&toggle=browserjs&uid=MTc0NzUzODk4NC40OTU3OjkyMGE0NjMxNTRlMDNjMWU4ODY1OTUxNzBjYjFiNGYxZTY5ZDY5YjdmODQzNzk4YjQ3MmVhNTEzZmMzOGVlZmQ6NjgyOTU0Mjg3OTA1Nw%3D%3D
unknown
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
whitelisted
4
System
192.168.100.255:138
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1660
iexplore.exe
216.245.197.44:443
daftar.site
LIMESTONENETWORKS
US
unknown
1660
iexplore.exe
69.192.161.44:80
x1.c.lencr.org
AKAMAI-AS
DE
whitelisted
1660
iexplore.exe
3.167.227.86:80
r11.c.lencr.org
US
whitelisted
1660
iexplore.exe
76.223.26.96:80
ww3.daftar.site
AMAZON-02
US
unknown
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
google.com
  • 142.250.186.142
whitelisted
daftar.site
  • 216.245.197.44
unknown
x1.c.lencr.org
  • 69.192.161.44
whitelisted
r11.c.lencr.org
  • 3.167.227.86
  • 3.167.227.115
  • 3.167.227.5
  • 3.167.227.60
whitelisted
ww3.daftar.site
  • 76.223.26.96
  • 13.248.148.254
unknown
client.wns.windows.com
  • 172.211.123.249
whitelisted
euob.astarsbuilding.com
  • 65.9.66.27
  • 65.9.66.31
  • 65.9.66.105
  • 65.9.66.122
unknown

Threats

PID
Process
Class
Message
1660
iexplore.exe
Misc activity
ET INFO Observed ZeroSSL SSL/TLS Certificate
1660
iexplore.exe
Misc activity
ET INFO Observed ZeroSSL SSL/TLS Certificate
7664
msedge.exe
Misc activity
ET INFO Observed ZeroSSL SSL/TLS Certificate
7664
msedge.exe
Misc activity
ET INFO Observed ZeroSSL SSL/TLS Certificate
No debug info