URL:

http://uflash.tv

Full analysis: https://app.any.run/tasks/dfd52e0b-871b-4b6e-8529-a93a030c5fcf
Verdict: Malicious activity
Analysis date: August 24, 2023, 19:37:05
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

2155BD69734F3CA0D5B4DF3823892997

SHA1:

ACA61D7413747F15CEAE6535A402C2166199DFB9

SHA256:

F86614A8AC232119862983ECFC4F6635B88FF514E75187FBBE64AB37E1C82EF8

SSDEEP:

3:N1KLRTn:C9Tn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2968)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
2
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
2340"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2968 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2968"C:\Program Files\Internet Explorer\iexplore.exe" "http://uflash.tv"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
18 931
Read events
18 866
Write events
65
Delete events
0

Modification events

(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2968) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
17
Text files
106
Unknown types
1

Dropped files

PID
Process
Filename
Type
2340iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\955R81JG.htmhtml
MD5:16A5105037823AE84823B4B7B38CA791
SHA256:BBC51193DEC86C08BA7031E71B6C4074133FAFAC0E4076296EFEDF9168B992F6
2340iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\jquery.fancybox[1].csstext
MD5:D6B02F6578597B65F36F68913E0E40E8
SHA256:3A7CF33AED2E14E09207F2FBC386987F9B45D976A5F6D9079F206C8285293E7F
2340iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\jquery.hoverIntent.minified[1].jstext
MD5:6AB651CEDA51EA3DA7D53435FB428333
SHA256:4D8F84729F2BB3EECCDE4957C1CE7C46251F6A7148EC7FD9CA73403BA6CB07D5
2340iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\jquery.fancybox-buttons[1].csstext
MD5:5D99B237217A53F9FC5890C829E92EED
SHA256:09FD5E02CDC76ABC66FFED9F7354997E29FD524A0911FC6278FFDF3CD188CA52
2340iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\lightbox_me_pop[1].jstext
MD5:41D09845A1EAD1D84B62D0609E6843BB
SHA256:F422EE0DD0D2E1AE5CFFC0C2EF81AD9F6D728AAE63AB43BDB3DA47BBA29AA2E0
2340iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\icon-header[1].pngimage
MD5:18A1B0449D222287215F6283C49BA13F
SHA256:B8CA0E8BD2266014138536D47BA4035F821383D056EB4B29798849A9464C118E
2340iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:B6A4528E5D2038904B2487AF4BE122ED
SHA256:194B8F90FEFBC3D8DDDBCAE187F17640DD80C53EA3C11D9C93D61860759F0512
2340iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
2340iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\1[3].jpgimage
MD5:10FA00D48022622484DB3DEE39FFAF50
SHA256:267D27B6091712E2055FE6E1011D6E64CBDF7643AC272E8D5F512B35E1AC33F0
2340iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\jquery.avs-0.2[1].jstext
MD5:D38E742F92DD56AFCEEE87BACE881A95
SHA256:40FACEDB75079705808CE42BB45A6C0C4D46977EAAE843808CFD80343C6E9502
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
73
TCP/UDP connections
57
DNS requests
21
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2340
iexplore.exe
GET
200
209.95.46.75:80
http://www.uflash.tv/
US
compressed
8.61 Kb
unknown
2340
iexplore.exe
GET
200
209.95.46.75:80
http://www.uflash.tv/templates/frontend/default/js/jquery-1.7.2.min.js
US
html
32.9 Kb
unknown
2340
iexplore.exe
GET
200
209.95.46.75:80
http://www.uflash.tv/media/videos/tmb/22868/1.jpg
US
image
12.0 Kb
unknown
2340
iexplore.exe
GET
200
209.95.46.75:80
http://www.uflash.tv/templates/frontend/default/css/style.css?v00016
US
text
14.4 Kb
unknown
2340
iexplore.exe
GET
200
209.95.46.75:80
http://www.uflash.tv/templates/frontend/default/js/jquery.livequery.pack.js
US
text
1.38 Kb
unknown
2340
iexplore.exe
GET
200
209.95.46.75:80
http://www.uflash.tv/media/videos/tmb/25047/1.jpg
US
image
10.6 Kb
unknown
2340
iexplore.exe
GET
200
8.253.204.249:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d2573a55f5d86ec8
US
compressed
4.70 Kb
whitelisted
2340
iexplore.exe
GET
200
209.95.46.75:80
http://www.uflash.tv/templates/frontend/default/js/lightbox_me_pop.js?v=0001
US
text
2.86 Kb
unknown
2340
iexplore.exe
GET
200
209.95.46.75:80
http://www.uflash.tv/templates/frontend/default/js/jquery.effects.js
US
text
1.20 Kb
unknown
2340
iexplore.exe
GET
200
209.95.46.75:80
http://www.uflash.tv/templates/frontend/default/js/fancybox/jquery.fancybox.css?v=2.0.6
US
text
1.15 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3284
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2340
iexplore.exe
142.250.185.104:443
www.googletagmanager.com
GOOGLE
US
suspicious
2340
iexplore.exe
216.58.206.35:80
ocsp.pki.goog
GOOGLE
US
whitelisted
2340
iexplore.exe
142.250.185.78:443
www.google-analytics.com
GOOGLE
US
whitelisted
2340
iexplore.exe
8.253.204.249:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
2340
iexplore.exe
104.18.15.101:80
ocsp.comodoca.com
CLOUDFLARENET
—
whitelisted
2340
iexplore.exe
216.239.32.36:443
region1.google-analytics.com
GOOGLE
US
suspicious
2968
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2340
iexplore.exe
185.94.237.64:80
poweredby.jads.co
Mojohost B.v.
NL
suspicious
2968
iexplore.exe
8.253.204.249:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious

DNS requests

Domain
IP
Reputation
www.uflash.tv
  • 209.95.46.75
unknown
poweredby.jads.co
  • 185.94.237.64
whitelisted
www.googletagmanager.com
  • 142.250.185.104
whitelisted
js.juicyads.com
  • 13.249.9.29
  • 13.249.9.75
  • 13.249.9.43
  • 13.249.9.90
whitelisted
ctldl.windowsupdate.com
  • 8.253.204.249
  • 8.241.123.254
  • 67.26.139.254
  • 67.27.233.254
  • 67.27.157.126
whitelisted
ocsp.comodoca.com
  • 104.18.15.101
  • 104.18.14.101
whitelisted
ocsp.pki.goog
  • 216.58.206.35
whitelisted
ocsp.usertrust.com
  • 104.18.15.101
  • 104.18.14.101
whitelisted
ocsp.sectigo.com
  • 104.18.15.101
  • 104.18.14.101
whitelisted
www.google-analytics.com
  • 142.250.185.78
whitelisted

Threats

PID
Process
Class
Message
2340
iexplore.exe
Generic Protocol Command Decode
SURICATA HTTP gzip decompression failed
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://uflash.tv