File name:

IDM.6.41.b.6.kuyhAa.Me.zip

Full analysis: https://app.any.run/tasks/1d6acf1a-bdf7-472e-b888-157116acbc86
Verdict: Malicious activity
Analysis date: November 18, 2023, 14:09:47
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

0C8B3D98D53ACF1D91C51D6E90BD0F69

SHA1:

0D07E9D1A687C051038DF5ED187C8D2A22FBA17C

SHA256:

2996715BFB4E60F7806C999EF805A6576DD290AE46109F988E892CB1BE99342B

SSDEEP:

196608:aZHoB3CFU5Ho0bkszT5f8E/IH/pG2SY8s/JQA:agjookMT5f8E/E0zYZ/CA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Creates a writable file the system directory

      • rundll32.exe (PID: 4036)

    • Starts NET.EXE for service management

      • net.exe (PID: 3708)
      • Uninstall.exe (PID: 4064)

    • Drops the executable file immediately after the start

      • IDMan.exe (PID: 3900)

    • Actions looks like stealing of personal data

      • IDMan.exe (PID: 1272)

  • SUSPICIOUS

    • Starts application with an unusual extension

      • idman641build6.kuyhAa.exe (PID: 3688)

    • Reads settings of System Certificates

      • IDMan.exe (PID: 3900)
      • IDMan.exe (PID: 1272)

    • Reads the Internet Settings

      • IDMan.exe (PID: 3900)
      • IDM1.tmp (PID: 3644)
      • Uninstall.exe (PID: 4064)
      • runonce.exe (PID: 4088)
      • IDMan.exe (PID: 1272)
      • IDMan.exe (PID: 856)

    • Creates/Modifies COM task schedule object

      • IDMan.exe (PID: 3900)
      • Uninstall.exe (PID: 4064)

    • The process creates files with name similar to system file names

      • IDM1.tmp (PID: 3644)

    • Reads security settings of Internet Explorer

      • IDMan.exe (PID: 3900)
      • IDMan.exe (PID: 1272)

    • Checks Windows Trust Settings

      • IDMan.exe (PID: 3900)
      • IDMan.exe (PID: 1272)

    • Uses RUNDLL32.EXE to load library

      • Uninstall.exe (PID: 4064)

    • Creates or modifies Windows services

      • Uninstall.exe (PID: 4064)

    • Drops a system driver (possible attempt to evade defenses)

      • rundll32.exe (PID: 4036)

  • INFO

    • Checks supported languages

      • IDM1.tmp (PID: 3644)
      • idman641build6.kuyhAa.exe (PID: 3688)
      • IDMan.exe (PID: 3900)
      • idmBroker.exe (PID: 3916)
      • Uninstall.exe (PID: 4064)
      • MediumILStart.exe (PID: 1576)
      • IDMan.exe (PID: 1272)
      • IEMonitor.exe (PID: 1876)
      • IDMan.exe (PID: 856)
      • IEMonitor.exe (PID: 3052)
      • wmpnscfg.exe (PID: 3488)

    • Create files in a temporary directory

      • idman641build6.kuyhAa.exe (PID: 3688)
      • IDM1.tmp (PID: 3644)
      • IDMan.exe (PID: 3900)
      • IDMan.exe (PID: 1272)
      • IDMan.exe (PID: 856)

    • Manual execution by a user

      • idman641build6.kuyhAa.exe (PID: 3480)
      • idman641build6.kuyhAa.exe (PID: 3688)
      • firefox.exe (PID: 3892)
      • wmpnscfg.exe (PID: 3488)
      • IDMan.exe (PID: 856)
      • taskmgr.exe (PID: 3088)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3448)
      • rundll32.exe (PID: 4036)
      • dllhost.exe (PID: 2868)

    • Reads the machine GUID from the registry

      • IDM1.tmp (PID: 3644)
      • IDMan.exe (PID: 3900)
      • MediumILStart.exe (PID: 1576)
      • IDMan.exe (PID: 1272)
      • wmpnscfg.exe (PID: 3488)
      • IDMan.exe (PID: 856)

    • Creates files in the program directory

      • IDM1.tmp (PID: 3644)
      • IDMan.exe (PID: 3900)

    • Reads the computer name

      • IDMan.exe (PID: 3900)
      • IDM1.tmp (PID: 3644)
      • Uninstall.exe (PID: 4064)
      • MediumILStart.exe (PID: 1576)
      • IDMan.exe (PID: 1272)
      • IEMonitor.exe (PID: 1876)
      • wmpnscfg.exe (PID: 3488)
      • IDMan.exe (PID: 856)

    • Creates files or folders in the user directory

      • IDM1.tmp (PID: 3644)
      • IDMan.exe (PID: 3900)
      • IDMan.exe (PID: 1272)

    • Application launched itself

      • firefox.exe (PID: 3892)
      • firefox.exe (PID: 4044)

    • Creates files in the driver directory

      • rundll32.exe (PID: 4036)

    • Reads the time zone

      • runonce.exe (PID: 4088)

    • Checks proxy server information

      • IDMan.exe (PID: 1272)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2022:12:03 05:56:40
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: IDM.6.41.b.6.kuyhAa.Me/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
80
Monitored processes
32
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs idman641build6.kuyhaa.exe no specs idman641build6.kuyhaa.exe idm1.tmp no specs idmbroker.exe no specs idman.exe firefox.exe no specs uninstall.exe no specs firefox.exe no specs firefox.exe rundll32.exe no specs runonce.exe no specs grpconv.exe no specs net.exe no specs net1.exe no specs mediumilstart.exe no specs firefox.exe no specs firefox.exe no specs idman.exe iemonitor.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs wmpnscfg.exe no specs firefox.exe no specs firefox.exe no specs taskmgr.exe no specs Copy/Move/Rename/Delete/Link Object no specs idman.exe no specs iemonitor.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
608"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4044.0.174610699\1253650564" -parentBuildID 20230710165010 -prefsHandle 1120 -prefMapHandle 1112 -prefsLen 28523 -prefMapSize 244195 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0cec4591-e526-4732-9cb9-93e9ee98d943} 4044 "\\.\pipe\gecko-crash-server-pipe.4044" 1192 d6a8ca0 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
1
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
680"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4044.7.123600962\100977427" -childID 6 -isForBrowser -prefsHandle 2092 -prefMapHandle 1992 -prefsLen 29366 -prefMapSize 244195 -jsInitHandle 924 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ce3e244-6888-444f-ba3d-3753afc0776f} 4044 "\\.\pipe\gecko-crash-server-pipe.4044" 2376 217b6e00 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
856"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4044.3.539058290\878515058" -childID 2 -isForBrowser -prefsHandle 2936 -prefMapHandle 2928 -prefsLen 34225 -prefMapSize 244195 -jsInitHandle 924 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4baeb056-833d-4790-b0c4-df23362cfd87} 4044 "\\.\pipe\gecko-crash-server-pipe.4044" 2948 1f39bc90 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
856"C:\Program Files\Internet Download Manager\IDMan.exe" C:\Program Files\Internet Download Manager\IDMan.exe—explorer.exe
User:
admin
Company:
Tonec Inc.
Integrity Level:
MEDIUM
Description:
Internet Download Manager (IDM)
Exit code:
0
Version:
6, 41, 6, 2
Modules
Images
c:\program files\internet download manager\idman.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1272"C:\Program Files\Internet Download Manager\IDMan.exe" -EmbeddingC:\Program Files\Internet Download Manager\IDMan.exe
svchost.exe
User:
admin
Company:
Tonec Inc.
Integrity Level:
MEDIUM
Description:
Internet Download Manager (IDM)
Exit code:
3489660927
Version:
6, 41, 6, 2
Modules
Images
c:\program files\internet download manager\idman.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1576"C:\Program Files\Internet Download Manager\MediumILStart.exe"C:\Program Files\Internet Download Manager\MediumILStart.exe—IDMan.exe
User:
admin
Company:
Internet Download Manager, Tonec Inc.
Integrity Level:
MEDIUM
Description:
IDM module
Exit code:
0
Version:
6, 35, 9, 1
Modules
Images
c:\program files\internet download manager\mediumilstart.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1876"C:\Program Files\Internet Download Manager\IEMonitor.exe"C:\Program Files\Internet Download Manager\IEMonitor.exe—IDMan.exe
User:
admin
Company:
Tonec Inc.
Integrity Level:
MEDIUM
Description:
Internet Download Manager agent for click monitoring in IE-based browsers
Exit code:
0
Version:
6, 37, 8, 1
Modules
Images
c:\program files\internet download manager\iemonitor.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1892"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4044.1.2078969166\348885928" -parentBuildID 20230710165010 -prefsHandle 1432 -prefMapHandle 1428 -prefsLen 28600 -prefMapSize 244195 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3866181-7215-488d-93b3-7de6099e0d4c} 4044 "\\.\pipe\gecko-crash-server-pipe.4044" 1444 d61b1a0 socketC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
2516"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4044.6.684837045\1710777205" -childID 5 -isForBrowser -prefsHandle 4012 -prefMapHandle 3988 -prefsLen 34332 -prefMapSize 244195 -jsInitHandle 924 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2436d682-facf-4cd1-b35d-385423a80320} 4044 "\\.\pipe\gecko-crash-server-pipe.4044" 3924 217b63f0 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
2584"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4044.4.308190640\304194261" -childID 3 -isForBrowser -prefsHandle 3532 -prefMapHandle 2880 -prefsLen 29209 -prefMapSize 244195 -jsInitHandle 924 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e5c1fb2-d524-400d-8aba-fe3d68b40076} 4044 "\\.\pipe\gecko-crash-server-pipe.4044" 3540 1c55a9b0 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
Total events
26 502
Read events
26 181
Write events
226
Delete events
95

Modification events

(PID) Process:(3448) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3448) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3644) IDM1.tmpKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
Operation:writeName:PendingFileRenameOperations
Value:
\??\C:\Users\admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
(PID) Process:(3644) IDM1.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}
Operation:writeName:RunAs
Value:
Interactive User
Executable files
15
Suspicious files
130
Text files
35
Unknown types
0

Dropped files

PID
Process
Filename
Type
3644IDM1.tmpC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Download Manager\Uninstall IDM.lnkbinary
MD5:502B252609C6BEB3EB09EDE6DDCDB58C
SHA256:65B246D4891C803FD880D80B7E8DD8D2155590F221518D4BBBC356843DBA40AD
3448WinRAR.exeC:\Users\admin\Desktop\IDM.6.41.b.6.kuyhAa.Me\Jamu\Lokasi Paste Crack.lnkbinary
MD5:FF6CDB9B107C6CEE39C536882C77537D
SHA256:D6A11EDB519C1509008FE2EF4F42AD894D89EFE612D96FC04252818295E835F2
3448WinRAR.exeC:\Users\admin\Desktop\IDM.6.41.b.6.kuyhAa.Me\www.kuyhaa.me.urltext
MD5:020A2175CD00353419BA86941FAF6ECB
SHA256:0FAD91A7D23B2A63EB58C402D7D2609CC11932F9DF35B69A3EC45783737CFF35
3448WinRAR.exeC:\Users\admin\Desktop\IDM.6.41.b.6.kuyhAa.Me\Settings.Anti.Notif.Update.regtext
MD5:D4C096EDA260A707434CC0DE137ABBDF
SHA256:9CABC1743B35B773F09FFF97DA60EA49323FA56284768B1FC9D9D7A22E944423
3644IDM1.tmpC:\Users\admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.logbinary
MD5:1C92BCB479B9EE7BBC5F5E6754B125B2
SHA256:95EFFBCC2269DB3E96C984D8249D14DBCDD8D4CF6A43143CBA0D7D20F96DF991
3644IDM1.tmpC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Download Manager\license.lnkbinary
MD5:81185ECC2CF6158CE35A8A50743B83C2
SHA256:17E74B263AE03B47CED345BEC25A3ECA090CEFD9694D915BE91DDFF37FE4CF0E
3644IDM1.tmpC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Internet Download Manager\Uninstall IDM.lnkbinary
MD5:B6D7CCACA51BFF52C00F22EF4862B4AC
SHA256:822D26334F66046C3D96C815367A51BABA1B9B9C9F785A51E86131DCE665A6AD
3448WinRAR.exeC:\Users\admin\Desktop\IDM.6.41.b.6.kuyhAa.Me\idman641build6.kuyhAa.exeexecutable
MD5:CA5F2C20B23F553EDE744031BCEE9240
SHA256:F13DFF1C73D422E2119092AF5C2764AD87E4374852D7E5691FDB448696F71F72
3448WinRAR.exeC:\Users\admin\Desktop\IDM.6.41.b.6.kuyhAa.Me\Jamu\kuyhAa.Me.urltext
MD5:B6F5CE7267C50CF195B1AE2A8EAEC913
SHA256:ED77A3BC71138AB5CCD49ABA225514AC860B7251EE16DB3A2B91FD4719F9D291
3448WinRAR.exeC:\Users\admin\Desktop\IDM.6.41.b.6.kuyhAa.Me\Jamu\IDMan.exeexecutable
MD5:52672DED39551AA2D0D8E0BCE2C303CF
SHA256:E54E7B7E8A10DAA6014EB1C994DFAE422DA8E614327DF05661C51742B5D3B30A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
38
DNS requests
71
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4044
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
text
90 b
unknown
4044
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
text
8 b
unknown
4044
firefox.exe
POST
200
2.16.2.73:80
http://r3.o.lencr.org/
unknown
binary
503 b
unknown
1272
IDMan.exe
POST
200
169.61.27.133:80
http://www.internetdownloadmanager.com/data/update641.txt?v=641b06
unknown
text
2.38 Kb
unknown
4044
firefox.exe
POST
200
2.16.2.73:80
http://r3.o.lencr.org/
unknown
binary
503 b
unknown
3900
IDMan.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?66b6c19a6dca6cb7
unknown
compressed
61.6 Kb
unknown
4044
firefox.exe
POST
200
2.16.2.73:80
http://r3.o.lencr.org/
unknown
binary
503 b
unknown
4044
firefox.exe
POST
200
2.16.2.73:80
http://r3.o.lencr.org/
unknown
binary
503 b
unknown
4044
firefox.exe
POST
200
2.16.2.73:80
http://r3.o.lencr.org/
unknown
binary
503 b
unknown
4044
firefox.exe
POST
200
192.229.221.95:80
http://ocsp.digicert.com/
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3900
IDMan.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
4044
firefox.exe
169.61.27.133:443
secure.internetdownloadmanager.com
SOFTLAYER
US
unknown
4044
firefox.exe
34.107.221.82:80
detectportal.firefox.com
GOOGLE
US
whitelisted
4044
firefox.exe
34.117.237.239:443
contile.services.mozilla.com
GOOGLE-CLOUD-PLATFORM
US
unknown
4044
firefox.exe
44.209.32.107:443
spocs.getpocket.com
AMAZON-AES
US
unknown

DNS requests

Domain
IP
Reputation
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
test.internetdownloadmanager.com
  • 185.80.221.18
whitelisted
secure.internetdownloadmanager.com
  • 169.61.27.133
whitelisted
www.internetdownloadmanager.com
  • 169.61.27.133
whitelisted
mirror3.internetdownloadmanager.com
  • 174.127.113.77
whitelisted
mirror5.internetdownloadmanager.com
  • 185.80.221.19
whitelisted
registeridm.com
  • 169.61.27.133
unknown
detectportal.firefox.com
  • 34.107.221.82
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
example.org
  • 93.184.216.34
whitelisted

Threats

PID
Process
Class
Message
1272
IDMan.exe
Potential Corporate Privacy Violation
ET POLICY Outgoing Basic Auth Base64 HTTP Password detected unencrypted
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
IDM.6.41.b.6.kuyhAa.Me.zip