URL:

https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwiK7Y-sn8b3AhXCJkQIHV8ABuUQFnoECAMQAQ&url=https%3A%2F%2Farchive.org%2Fdetails%2FMEMZ4.0Clean_20181103&usg=AOvVaw3fZvyxiPtOvz66R0xNMJgN

Full analysis: https://app.any.run/tasks/60986cf5-7af2-418b-bc64-840d3139e9a3
Verdict: Malicious activity
Analysis date: May 04, 2022, 16:17:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

52E5980B2E77F150A424EAE4200369FE

SHA1:

659060305B1D481E33178DF7E737B618D0FD7D64

SHA256:

6E8D7DEC27168D3EA327D80E787A12E7862EC2590E11822B36FD3D2D6F4F4778

SSDEEP:

6:2OLI2sq+wp1w4pNpnLOJYNRR3z+XLXUmZ8d5Sjf2Cr:2V2JnNVLOJY5yXz58d5jo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 2488)

    • Application was dropped or rewritten from another process

      • MEMZ-Clean.exe (PID: 3080)

    • Runs app for hidden code execution

      • MEMZ-Clean.exe (PID: 3080)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 2488)
      • MEMZ-Clean.exe (PID: 3080)
      • cmd.exe (PID: 2244)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2488)

    • Reads the computer name

      • WinRAR.exe (PID: 2488)
      • MEMZ-Clean.exe (PID: 3080)

    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 2488)

    • Starts Internet Explorer

      • MEMZ-Clean.exe (PID: 3080)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 736)
      • iexplore.exe (PID: 4012)
      • iexplore.exe (PID: 1940)
      • iexplore.exe (PID: 2748)
      • iexplore.exe (PID: 3148)

    • Starts CMD.EXE for commands execution

      • MEMZ-Clean.exe (PID: 3080)

  • INFO

    • Reads CPU info

      • firefox.exe (PID: 3172)

    • Reads the computer name

      • firefox.exe (PID: 1068)
      • firefox.exe (PID: 2416)
      • firefox.exe (PID: 3276)
      • firefox.exe (PID: 760)
      • firefox.exe (PID: 3172)
      • firefox.exe (PID: 2444)
      • firefox.exe (PID: 3744)
      • firefox.exe (PID: 2968)
      • iexplore.exe (PID: 3848)
      • iexplore.exe (PID: 736)
      • iexplore.exe (PID: 3084)
      • iexplore.exe (PID: 4012)
      • iexplore.exe (PID: 1940)
      • iexplore.exe (PID: 2748)
      • iexplore.exe (PID: 3148)

    • Application launched itself

      • firefox.exe (PID: 2832)
      • firefox.exe (PID: 3172)
      • iexplore.exe (PID: 3848)
      • iexplore.exe (PID: 3084)

    • Checks supported languages

      • firefox.exe (PID: 3744)
      • firefox.exe (PID: 3172)
      • firefox.exe (PID: 2444)
      • firefox.exe (PID: 1068)
      • firefox.exe (PID: 2832)
      • firefox.exe (PID: 2416)
      • firefox.exe (PID: 3276)
      • firefox.exe (PID: 760)
      • firefox.exe (PID: 2968)
      • iexplore.exe (PID: 3848)
      • iexplore.exe (PID: 736)
      • iexplore.exe (PID: 3084)
      • iexplore.exe (PID: 4012)
      • iexplore.exe (PID: 1940)
      • iexplore.exe (PID: 2748)
      • iexplore.exe (PID: 3148)

    • Creates files in the program directory

      • firefox.exe (PID: 3172)

    • Creates files in the user directory

      • firefox.exe (PID: 3172)
      • iexplore.exe (PID: 736)
      • iexplore.exe (PID: 4012)
      • iexplore.exe (PID: 2748)
      • iexplore.exe (PID: 1940)
      • iexplore.exe (PID: 3084)
      • iexplore.exe (PID: 3148)

    • Checks Windows Trust Settings

      • firefox.exe (PID: 3172)
      • iexplore.exe (PID: 736)
      • iexplore.exe (PID: 4012)
      • iexplore.exe (PID: 3084)
      • iexplore.exe (PID: 1940)
      • iexplore.exe (PID: 3148)
      • iexplore.exe (PID: 2748)

    • Dropped object may contain Bitcoin addresses

      • firefox.exe (PID: 3172)

    • Manual execution by user

      • WinRAR.exe (PID: 2488)

    • Reads the date of Windows installation

      • firefox.exe (PID: 3172)
      • iexplore.exe (PID: 3848)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 736)
      • iexplore.exe (PID: 4012)
      • iexplore.exe (PID: 3084)
      • iexplore.exe (PID: 1940)
      • iexplore.exe (PID: 3148)
      • iexplore.exe (PID: 2748)

    • Changes internet zones settings

      • iexplore.exe (PID: 3848)
      • iexplore.exe (PID: 3084)

    • Reads internet explorer settings

      • iexplore.exe (PID: 736)
      • iexplore.exe (PID: 4012)
      • iexplore.exe (PID: 1940)
      • iexplore.exe (PID: 2748)
      • iexplore.exe (PID: 3148)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3084)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3084)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
59
Monitored processes
19
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs winrar.exe memz-clean.exe no specs iexplore.exe no specs iexplore.exe iexplore.exe iexplore.exe iexplore.exe cmd.exe no specs iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
736"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3848 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
760"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3172.34.1963545407\1779411445" -childID 5 -isForBrowser -prefsHandle 3508 -prefMapHandle 3720 -prefsLen 7307 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3172 "\\.\pipe\gecko-crash-server-pipe.3172" 3752 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
1068"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3172.6.1544345674\184131849" -childID 1 -isForBrowser -prefsHandle 2976 -prefMapHandle 2972 -prefsLen 245 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3172 "\\.\pipe\gecko-crash-server-pipe.3172" 2988 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
1940"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3084 CREDAT:1316105 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2244"C:\Windows\System32\cmd.exe" C:\Windows\System32\cmd.exe—MEMZ-Clean.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2416"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3172.21.2129190286\1961509232" -childID 4 -isForBrowser -prefsHandle 3508 -prefMapHandle 3504 -prefsLen 7307 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3172 "\\.\pipe\gecko-crash-server-pipe.3172" 3544 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
2444"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3172.0.247093387\1667740240" -parentBuildID 20201112153044 -prefsHandle 1124 -prefMapHandle 1116 -prefsLen 1 -prefMapSize 238726 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3172 "\\.\pipe\gecko-crash-server-pipe.3172" 1208 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
1
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msasn1.dll
2488"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\MEMZ 4.0 Clean.zip"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2748"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3084 CREDAT:1250572 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
2832"C:\Program Files\Mozilla Firefox\firefox.exe" "https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwiK7Y-sn8b3AhXCJkQIHV8ABuUQFnoECAMQAQ&url=https%3A%2F%2Farchive.org%2Fdetails%2FMEMZ4.0Clean_20181103&usg=AOvVaw3fZvyxiPtOvz66R0xNMJgN"C:\Program Files\Mozilla Firefox\firefox.exe—Explorer.EXE
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
Total events
41 104
Read events
40 719
Write events
380
Delete events
5

Modification events

(PID) Process:(2832) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Launcher
Value:
51B4132E40000000
(PID) Process:(3172) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Browser
Value:
DCBF132E40000000
(PID) Process:(3172) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry
Value:
0
(PID) Process:(3172) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\DllPrefetchExperiment
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
0
(PID) Process:(3172) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|DisableTelemetry
Value:
1
(PID) Process:(3172) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|DisableDefaultBrowserAgent
Value:
0
(PID) Process:(3172) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|ServicesSettingsServer
Value:
https://firefox.settings.services.mozilla.com/v1
(PID) Process:(3172) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|SecurityContentSignatureRootHash
Value:
97:E8:BA:9C:F1:2F:B3:DE:53:CC:42:A4:E6:57:7E:D6:4D:F4:93:C2:47:B4:14:FE:A0:36:81:8D:38:23:56:0E
(PID) Process:(3172) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3172) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000003B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
1
Suspicious files
142
Text files
82
Unknown types
46

Dropped files

PID
Process
Filename
Type
3172firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
3172firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite —
MD5:—
SHA256:—
3172firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
3172firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-walbinary
MD5:—
SHA256:—
3172firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\protections.sqlite-journalbinary
MD5:—
SHA256:—
3172firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.binbinary
MD5:994A33896BB41A278A315D0D796422B6
SHA256:54EC50A20FFF8CC016710E49437CF6A11D3FE5EE7B28C185E4A9AAFEE2908B63
3172firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
3172firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
3172firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.jstext
MD5:299A2B747C11E4BDA194E563FEA4A699
SHA256:94EE461F62E8B4A0A65471A41E10C8C56722B73C0A019D76ACA7F5BAF109813E
3172firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.jstext
MD5:299A2B747C11E4BDA194E563FEA4A699
SHA256:94EE461F62E8B4A0A65471A41E10C8C56722B73C0A019D76ACA7F5BAF109813E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
28
TCP/UDP connections
115
DNS requests
94
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3172
firefox.exe
POST
200
172.217.23.99:80
http://ocsp.pki.goog/gts1c3
US
der
471 b
whitelisted
3172
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
4012
iexplore.exe
GET
302
142.250.185.228:80
http://google.co.ck/search?q=how+to+code+a+virus+in+visual+basic
US
html
373 b
whitelisted
3172
firefox.exe
POST
200
172.217.23.99:80
http://ocsp.pki.goog/gts1c3
US
der
472 b
whitelisted
3172
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3172
firefox.exe
POST
200
172.217.23.99:80
http://ocsp.pki.goog/gts1c3
US
der
472 b
whitelisted
4012
iexplore.exe
GET
200
172.217.23.99:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDZVQ0c3n%2F16xKL4oJJTrDj
US
der
472 b
whitelisted
3172
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
4012
iexplore.exe
GET
200
172.217.23.99:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFBpiRkWWQcXClTQVPWVHTs%3D
US
der
471 b
whitelisted
3084
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3172
firefox.exe
142.250.186.36:443
www.google.com
Google Inc.
US
whitelisted
3172
firefox.exe
34.107.221.82:80
detectportal.firefox.com
—
US
whitelisted
3172
firefox.exe
142.250.184.234:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
3172
firefox.exe
143.204.201.8:443
firefox.settings.services.mozilla.com
—
US
malicious
3172
firefox.exe
65.9.63.59:443
firefox-settings-attachments.cdn.mozilla.net
AT&T Services, Inc.
US
unknown
3172
firefox.exe
207.241.224.2:443
archive.org
Internet Archive
US
malicious
3172
firefox.exe
54.148.56.186:443
push.services.mozilla.com
Amazon.com, Inc.
US
unknown
3172
firefox.exe
207.241.239.242:443
polyfill.archive.org
Internet Archive
US
suspicious
3172
firefox.exe
99.86.4.128:443
content-signature-2.cdn.mozilla.net
AT&T Services, Inc.
US
suspicious
3172
firefox.exe
207.241.227.160:443
ia600700.us.archive.org
Internet Archive
US
unknown

DNS requests

Domain
IP
Reputation
detectportal.firefox.com
  • 34.107.221.82
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
www.google.com
  • 142.250.186.36
  • 2a00:1450:4001:802::2004
  • 216.58.212.164
  • 216.58.214.4
malicious
firefox.settings.services.mozilla.com
  • 143.204.201.8
  • 143.204.201.102
  • 143.204.201.62
  • 143.204.201.119
whitelisted
location.services.mozilla.com
  • 54.148.18.111
  • 15.254.24.110
  • 34.223.166.69
  • 52.42.213.44
  • 54.148.72.145
  • 35.160.240.234
whitelisted
locprod2-elb-us-west-2.prod.mozaws.net
  • 35.160.240.234
  • 54.148.72.145
  • 52.42.213.44
  • 34.223.166.69
  • 15.254.24.110
  • 54.148.18.111
whitelisted
ocsp.pki.goog
  • 172.217.23.99
whitelisted
pki-goog.l.google.com
  • 172.217.23.99
  • 2a00:1450:4001:800::2003
whitelisted
example.org
  • 93.184.216.34
whitelisted
ipv4only.arpa
  • 192.0.0.171
  • 192.0.0.170
whitelisted

Threats

PID
Process
Class
Message
3172
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
3172
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahUKEwiK7Y-sn8b3AhXCJkQIHV8ABuUQFnoECAMQAQ&url=https%3A%2F%2Farchive.org%2Fdetails%2FMEMZ4.0Clean_20181103&usg=AOvVaw3fZvyxiPtOvz66R0xNMJgN