URL:

https://www.highperformancecpmnetwork.com/ynb0sbnmj2?key=84036a3671344a00376835b183a6d0d5

Full analysis: https://app.any.run/tasks/e8905db5-13fe-424e-a2d6-0daac1246628
Verdict: Malicious activity
Analysis date: March 31, 2021, 18:34:49
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

09331FAA7A025032548FB6D49F8E39C1

SHA1:

985D0245C49E69C80BA317C14A2E740DB9F75654

SHA256:

C9E41747D6AA1AA77A57A4565AB2E7C51AABF70678C70994DF724A2D567CBC9B

SSDEEP:

3:N8DSLPqAhCRSOTBKEk0S/EWYiBE:2OLRhCRS4nHS/EDiy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Reads internet explorer settings

      • iexplore.exe (PID: 2168)
      • iexplore.exe (PID: 3000)

    • Changes internet zones settings

      • iexplore.exe (PID: 2484)

    • Creates files in the user directory

      • iexplore.exe (PID: 2168)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2484)

    • Application launched itself

      • iexplore.exe (PID: 2484)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2484)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2484)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
3
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2168"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2484 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2484"C:\Program Files\Internet Explorer\iexplore.exe" "https://www.highperformancecpmnetwork.com/ynb0sbnmj2?key=84036a3671344a00376835b183a6d0d5"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3000"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2484 CREDAT:1447176 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
583
Read events
465
Write events
115
Delete events
3

Modification events

(PID) Process:(2484) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
2785830554
(PID) Process:(2484) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30877276
(PID) Process:(2484) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2484) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2484) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2484) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2484) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2484) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A5000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2484) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2484) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
0
Suspicious files
13
Text files
13
Unknown types
6

Dropped files

PID
Process
Filename
Type
2168iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\CabDA89.tmp —
MD5:—
SHA256:—
2168iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\TarDA8A.tmp —
MD5:—
SHA256:—
2484iexplore.exeC:\Users\admin\AppData\Local\Temp\CabE102.tmp —
MD5:—
SHA256:—
2484iexplore.exeC:\Users\admin\AppData\Local\Temp\TarE103.tmp —
MD5:—
SHA256:—
2168iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4der
MD5:50D07E64E3238DA3764E519781A4C457
SHA256:2D6E623CBDE0B5632DB298F854119721D4974159DA4125481674BFB41C61688E
2484iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver5411.tmp —
MD5:—
SHA256:—
2168iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2745F1B288B8F74D03DE537D8F6B0712binary
MD5:C958C5258F6DBEEC4B9D2266DD77DA34
SHA256:00D9D881C8D0CF3B51466DC5976F2CD16C3DF833904024E727E6BC46A13D730A
3000iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\errorPageStrings[1]text
MD5:E3E4A98353F119B80B323302F26B78FA
SHA256:9466D620DC57835A2475F8F71E304F54AEE7160E134BA160BAAE0F19E5E71E66
2168iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\0POLG3FP.txttext
MD5:95978718FCF84A8D6B5CD7CC8E72F250
SHA256:64E27C3C2638DA3D6DEA0213CEAF2C6469E67F89B32DBFE97BC25997E17BE3D5
2484iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:0DECD66D9D6F9C4B3C619D71026CC8DC
SHA256:12DCE1C28094394856748555DB410D74D7011BA4B1893BBFDF6A247999813B4C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
16
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2484
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
4.19 Kb
whitelisted
3000
iexplore.exe
GET
403
192.243.59.13:80
http://terraclicks.com/anonymous/
US
—
—
whitelisted
2168
iexplore.exe
GET
200
23.55.163.58:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgO%2FaHxuEgxyOXE1uI1B9%2FaBqA%3D%3D
US
der
503 b
shared
2484
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2484
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2484
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEA8aVkWYLIkXQFXHYN8Oxso%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2168
iexplore.exe
23.55.163.73:80
crl.identrust.com
Akamai International B.V.
US
unknown
2168
iexplore.exe
192.243.59.13:443
www.highperformancecpmnetwork.com
DataWeb Global Group B.V.
US
malicious
3000
iexplore.exe
192.243.59.13:80
www.highperformancecpmnetwork.com
DataWeb Global Group B.V.
US
malicious
2484
iexplore.exe
192.243.59.13:443
www.highperformancecpmnetwork.com
DataWeb Global Group B.V.
US
malicious
—
—
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
—
—
23.55.163.58:80
r3.o.lencr.org
Akamai International B.V.
US
unknown
—
—
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2484
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
—
—
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
www.highperformancecpmnetwork.com
  • 192.243.59.13
  • 192.243.59.20
  • 192.243.59.12
malicious
crl.identrust.com
  • 23.55.163.73
  • 23.55.163.57
whitelisted
api.bing.com
  • 13.107.13.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
r3.o.lencr.org
  • 23.55.163.58
  • 23.55.163.48
shared
terraclicks.com
  • 192.243.59.13
  • 192.243.59.12
  • 192.243.59.20
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.highperformancecpmnetwork.com/ynb0sbnmj2?key=84036a3671344a00376835b183a6d0d5