URL:

https://chaturbate.com/

Full analysis: https://app.any.run/tasks/1e323931-4c7b-4442-afcc-b3b4cd2eba5d
Verdict: Malicious activity
Analysis date: November 27, 2020, 04:40:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

C661E5CFA3B7C217954300D067ECFAE1

SHA1:

7C1F10343E174EB3D0171A2C1FE2AC4E7E207158

SHA256:

F6FBB333F61F6B220502998BDE89C639135D77B087CA8B7AD4CE03344E58A3A5

SSDEEP:

3:N8QtEa3:2Q2W

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3592)

    • Executed via COM

      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3072)

    • Reads the computer name

      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3072)

    • Creates files in the user directory

      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3072)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 3548)
      • iexplore.exe (PID: 3592)

    • Checks supported languages

      • iexplore.exe (PID: 3548)
      • iexplore.exe (PID: 3592)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3592)

    • Application launched itself

      • iexplore.exe (PID: 3548)

    • Creates files in the user directory

      • iexplore.exe (PID: 3592)

    • Changes internet zones settings

      • iexplore.exe (PID: 3548)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3592)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3592)

    • Reads CPU info

      • iexplore.exe (PID: 3592)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe no specs iexplore.exe flashutil32_26_0_0_131_activex.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3072C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe� Flash� Player Installer/Uninstaller 26.0 r0
Exit code:
0
Version:
26,0,0,131
Modules
Images
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\macromed\flash\flashutil32_26_0_0_131_activex.exe
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
3548"C:\Program Files\Internet Explorer\iexplore.exe" "https://chaturbate.com/"C:\Program Files\Internet Explorer\iexplore.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\msctf.dll
3592"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3548 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\msctf.dll
c:\windows\system32\imm32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
c:\windows\system32\normaliz.dll
c:\windows\system32\usp10.dll
c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
5 522
Read events
5 466
Write events
56
Delete events
0

Modification events

(PID) Process:(3548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30852215
(PID) Process:(3548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\WindowsSearch
Operation:writeName:UpgradeTime
Value:
7481718A77C4D601
(PID) Process:(3548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(3548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{C7F322FB-306A-11EB-9A22-12A9866C77DE}
Value:
0
(PID) Process:(3548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A7000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3548) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
Executable files
0
Suspicious files
4
Text files
172
Unknown types
29

Dropped files

PID
Process
Filename
Type
3592iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\8L5O1PL6.txttext
MD5:532BA0D879E604073DC0A5F3CCE762A6
SHA256:236472234D38E7507ABC4F28FA87EDE36CC68F6E86B0058D96D102B7391E9A5F
3592iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_592839A8569F831D0F2306AE4BB5C24Bbinary
MD5:02C179DDFF3FC93768EEC9DB7505FFB5
SHA256:C0A904AC48E5D39CF5A7B84366DF3780B30F47D34711DBFECE6479B127BB537C
3592iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\douxtease[1].jpgimage
MD5:F063CEE4B80370652384645DBE3DE666
SHA256:11DF4BE43F5214B4C858F59339CD96441877EBF4EFA6C9368EC5737F1C612699
3592iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\RUJ2Z9F9.txttext
MD5:A81FE082007E616F478ED660813F28CD
SHA256:D4C95C3A5B22776FD58420CC3EA0F4CD49151FC9BBA70425E41E1944533360E2
3592iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\AE8P3HN9.txttext
MD5:AA71E096B2B5FCE928C9F863798E8256
SHA256:3B63DE09F13315E39785F58E02FA0FA4CBCBF84EF2D517AAEDB2DD26E72AD6CC
3592iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\VC0JYRAN.txttext
MD5:1F753972A1A85CC512280430F84182C7
SHA256:D6F52624E6C0FA2E18C798857DF6C5C0D5A3D220AEFBBD65F5999020CD6DBA20
3592iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\EJ9LNWPL.txttext
MD5:3BCC95CA8002AC2DD010721A786FAF7F
SHA256:91EFA68B5F6EF5FF77C933E8231E3F8E5F2AA770DC305988025EAA6D782A81D9
3592iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\VQO4F55R.txttext
MD5:8DA398C5E02C54B36FEB654C968C8C2C
SHA256:C0E01B8471D068F9D055B975F874A644ABFA58BA1B9F3FA90D4D52396303EE38
3592iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\api[1].jstext
MD5:45F4F76A6767B7506D3CDBB7517DBADC
SHA256:3E46BFFB5F4BD8C42E67E417D2BBB3740EB7474E65C16E0053E736237380D77F
3592iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\W6TKRC4R.htmhtml
MD5:E7A086462663A35C331B96E3032B768B
SHA256:261BE609906AC8D1B8492BCA00EBF61D1BD8AE24E40E3CA9D4D01808875571AE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
21
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3592
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEArLKLpGXuU5CHZ0cPPNxhI%3D
US
der
471 b
whitelisted
3592
iexplore.exe
GET
200
172.217.23.99:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
3592
iexplore.exe
GET
200
172.217.23.99:80
http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEFcLuT0XSrlKAgAAAACAVZE%3D
US
der
471 b
whitelisted
3592
iexplore.exe
GET
200
172.217.23.99:80
http://ocsp.pki.goog/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEFcLuT0XSrlKAgAAAACAVZE%3D
US
der
471 b
whitelisted
3592
iexplore.exe
GET
200
172.217.23.99:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3592
iexplore.exe
104.19.149.122:443
cdn.exoticads.com
Cloudflare Inc
US
unknown
3592
iexplore.exe
172.217.23.99:80
ocsp.pki.goog
Google Inc.
US
whitelisted
—
—
104.18.101.40:443
chaturbate.com
Cloudflare Inc
US
unknown
3592
iexplore.exe
104.18.101.40:443
chaturbate.com
Cloudflare Inc
US
unknown
—
—
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3592
iexplore.exe
104.16.94.42:443
ssl-ccstatic.highwebmedia.com
Cloudflare Inc
US
unknown
3592
iexplore.exe
172.217.22.110:443
www.google-analytics.com
Google Inc.
US
whitelisted
—
—
104.16.94.42:443
ssl-ccstatic.highwebmedia.com
Cloudflare Inc
US
unknown
—
—
104.19.241.83:443
roomimg.stream.highwebmedia.com
Cloudflare Inc
US
unknown
3592
iexplore.exe
104.19.241.83:443
roomimg.stream.highwebmedia.com
Cloudflare Inc
US
unknown

DNS requests

Domain
IP
Reputation
chaturbate.com
  • 104.18.101.40
  • 104.18.100.40
suspicious
ocsp.digicert.com
  • 93.184.220.29
whitelisted
ssl-ccstatic.highwebmedia.com
  • 104.16.94.42
  • 104.16.93.42
unknown
roomimg.stream.highwebmedia.com
  • 104.19.241.83
  • 104.19.242.83
unknown
cdn.exoticads.com
  • 104.19.149.122
  • 104.19.148.122
unknown
www.google-analytics.com
  • 172.217.22.110
whitelisted
ocsp.pki.goog
  • 172.217.23.99
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://chaturbate.com/