URL:

http://chrome.haifti.com

Full analysis: https://app.any.run/tasks/4387c5cd-dc20-493b-8d43-0d70aa1f3bbf
Verdict: Malicious activity
Analysis date: July 11, 2023, 01:00:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

7C21D23503B89E963B98C60A6DDB22B0

SHA1:

CC3615C8753FF9935CDE4760992FAE1BEF2B0784

SHA256:

C694EF9D19EF256B4E0D751D9D06237A2B2B059946E27AC5504D058352602D19

SSDEEP:

3:N1KdNXK9aCqLKn:CvK9a+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2548)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2548"C:\Program Files\Internet Explorer\iexplore.exe" "http://chrome.haifti.com"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2984"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2548 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
14 702
Read events
14 581
Write events
121
Delete events
0

Modification events

(PID) Process:(2548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(2548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(2548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(2548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
26
Text files
49
Unknown types
0

Dropped files

PID
Process
Filename
Type
2984iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A053CFB63FC8E6507871752236B5CCD5_3514B5AB133BD3CBCDE8073D08A60F15binary
MD5:BB9C4FE3FBF12E018D38CE572700B147
SHA256:E2955B98AD7A311A51A5C3A9165AEBD9D36BC5BBC5E2DC28C3DDD4525E44032A
2984iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_786387CC77858B88BA3234B304062475binary
MD5:F6B7831DA5514BC21F66FD1BE5BFA1B5
SHA256:7C7AAF7951EF73093C4C6B9F5B9D20CDD69EC816FFF8F3D29952018C2F632138
2548iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
2984iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_786387CC77858B88BA3234B304062475binary
MD5:7B20D9519AE54F42C8D100D2C4132A18
SHA256:7898C1A7C4854C8D6F6F811674D4873E6270E34CF4CECCB61ADECA6EE9B99D8A
2984iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96Cbinary
MD5:BC93C0BD5A69FF485F84D8626882DBB4
SHA256:B7BBCD167FABAC1751A689C1880A505B6D3629433EC5E6D33C6317C68D421F53
2548iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
2548iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
2548iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:53B6CC2DAC71E482DDCE7015EB1F39AE
SHA256:13BCB84C80A94EC5CDB7AAB09395D05C8E872806C21B334939267CDEEE2C483E
2984iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CF14D1855652602540DFCFECD21854DB_54521312AB285FAB0D767B82BC18E22Dbinary
MD5:0AD0C37327DFD49A9E08A3E9F4589332
SHA256:C2F638C34313194EC7FF150B39B131311C460C0B1AC2F7325409AED8E13B82CC
2984iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96Cbinary
MD5:AC9EFBECA7578CC70F0452F5E42D42F7
SHA256:1176D4CC9FF600FFD61E5D1B1C0829F102B9BE3A46E82BD9621BF959D34A7E54
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
52
DNS requests
31
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2984
iexplore.exe
GET
200
95.140.236.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?9ef1c7ff60da4ee2
GB
compressed
4.70 Kb
whitelisted
2548
iexplore.exe
GET
200
95.140.236.128:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?98e2f73fad3d5e41
GB
compressed
4.70 Kb
whitelisted
2548
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
2984
iexplore.exe
GET
403
121.199.50.121:80
http://chrome.haifti.com/
CN
html
635 b
suspicious
2984
iexplore.exe
GET
200
104.18.21.226:80
http://ocsp2.globalsign.com/gsorganizationvalsha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQMnk2cPe3vhNiR6XLHz4QGvBl7BwQUlt5h8b0cFilTHMDMfTuDAEDmGnwCDEcTfiQheoN0LZw7cg%3D%3D
US
binary
1.42 Kb
whitelisted
2984
iexplore.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCCwQAAAAAAURO8EJH
US
der
1.41 Kb
whitelisted
2984
iexplore.exe
GET
200
95.140.236.128:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0fc55c9a1b3df56f
GB
compressed
4.70 Kb
whitelisted
2984
iexplore.exe
GET
200
104.18.21.226:80
http://ocsp2.globalsign.com/gsorganizationvalsha2g2/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQMnk2cPe3vhNiR6XLHz4QGvBl7BwQUlt5h8b0cFilTHMDMfTuDAEDmGnwCDApF3uCVWl8vRXf3Tg%3D%3D
US
der
1.42 Kb
whitelisted
2984
iexplore.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/rootr1/ME8wTTBLMEkwRzAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDkcHsQGaDFetObPhfan5
US
binary
1.41 Kb
whitelisted
2984
iexplore.exe
GET
200
104.18.21.226:80
http://ocsp2.globalsign.com/gsorganizationvalsha2g3/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBSVLM6m9XSaK2pXyc357yFJVjgNwQQUaIa4fXrZbUlrhy8YixU0bNe0eg4CDGVJsoaQPJtGemBbhw%3D%3D
US
der
1.43 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2984
iexplore.exe
106.11.249.99:80
batit.aliyun.com
Hangzhou Alibaba Advertising Co.,Ltd.
CN
unknown
—
—
239.255.255.250:1900
—
—
—
whitelisted
2984
iexplore.exe
47.88.198.69:443
www.aliyun.com
Alibaba US Technology Co., Ltd.
SG
unknown
2984
iexplore.exe
95.140.236.128:80
ctldl.windowsupdate.com
LLNW
US
malicious
2548
iexplore.exe
95.140.236.128:80
ctldl.windowsupdate.com
LLNW
US
malicious
2548
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2548
iexplore.exe
104.126.37.145:443
www.bing.com
Akamai International B.V.
DE
suspicious
2984
iexplore.exe
95.140.236.0:80
ctldl.windowsupdate.com
LLNW
US
whitelisted
2984
iexplore.exe
163.181.92.252:443
g.alicdn.com
Zhejiang Taobao Network Co.,Ltd
DE
unknown
2984
iexplore.exe
104.18.21.226:80
ocsp.globalsign.com
CLOUDFLARENET
—
shared

DNS requests

Domain
IP
Reputation
chrome.haifti.com
  • 121.199.50.121
suspicious
batit.aliyun.com
  • 106.11.249.99
suspicious
www.aliyun.com
  • 47.88.198.69
  • 47.88.251.189
  • 47.74.138.66
  • 47.88.128.4
  • 47.88.198.68
suspicious
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.145
  • 104.126.37.131
whitelisted
ctldl.windowsupdate.com
  • 95.140.236.0
  • 95.140.236.128
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
ocsp.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted
ocsp2.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted
cn.aliyun.com
  • 163.181.92.231
  • 163.181.92.225
  • 163.181.92.232
  • 163.181.92.227
  • 163.181.92.228
  • 163.181.92.230
  • 163.181.92.226
  • 163.181.92.229
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://chrome.haifti.com