URL:

http://th.symcb.com/th.crl

Full analysis: https://app.any.run/tasks/2f98033d-bb6a-403f-84fb-a7a43e00ca59
Verdict: Malicious activity
Analysis date: December 29, 2019, 14:41:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

E9C3EC255D882CCEEC86FA860E5B4DE4

SHA1:

24FA9A119A6AEB063FDE5FE66256D55BB9195D0D

SHA256:

B3F580473067EB44D47A9C5231FD86132916A9CC4908DFA51953DA85A0290AC7

SSDEEP:

3:N1KKNAGHL3NEJ:CKNjG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes settings of System certificates

      • rundll32.exe (PID: 2888)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3060)

  • SUSPICIOUS

    • Uses RUNDLL32.EXE to load library

      • firefox.exe (PID: 460)

    • Creates files in the program directory

      • firefox.exe (PID: 460)
      • firefox.exe (PID: 2812)

    • Creates files in the user directory

      • notepad++.exe (PID: 2612)

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 2812)

  • INFO

    • Reads CPU info

      • firefox.exe (PID: 460)
      • firefox.exe (PID: 2812)

    • Manual execution by user

      • rundll32.exe (PID: 1892)
      • explorer.exe (PID: 3276)
      • notepad++.exe (PID: 2612)
      • rundll32.exe (PID: 2888)
      • rundll32.exe (PID: 3628)

    • Creates files in the user directory

      • firefox.exe (PID: 460)
      • firefox.exe (PID: 2812)

    • Application launched itself

      • firefox.exe (PID: 460)
      • firefox.exe (PID: 2812)

    • Dropped object may contain Bitcoin addresses

      • firefox.exe (PID: 460)
      • firefox.exe (PID: 2812)

    • Reads settings of System Certificates

      • pingsender.exe (PID: 952)

    • Dropped object may contain TOR URL's

      • firefox.exe (PID: 2812)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
66
Monitored processes
24
Malicious processes
1
Suspicious processes
3

Behavior graph

Click at the process to see the details
start firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe firefox.exe firefox.exe rundll32.exe no specs explorer.exe no specs rundll32.exe no specs rundll32.exe no specs notepad++.exe gup.exe rundll32.exe no specs pingsender.exe firefox.exe firefox.exe no specs firefox.exe firefox.exe firefox.exe firefox.exe firefox.exe firefox.exe firefox.exe searchprotocolhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
460"C:\Program Files\Mozilla Firefox\firefox.exe" http://th.symcb.com/th.crlC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
600"C:\Program Files\Notepad++\updater\gup.exe" -v7.51C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
MEDIUM
Description:
GUP : a free (LGPL) Generic Updater
Exit code:
4294967295
Version:
4.1
Modules
Images
c:\program files\notepad++\updater\gup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\notepad++\updater\libcurl.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\wldap32.dll
940"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2812.6.1087821309\289003199" -childID 1 -isForBrowser -prefsHandle 1984 -prefMapHandle 2020 -prefsLen 1 -prefMapSize 184959 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2812 "\\.\pipe\gecko-crash-server-pipe.2812" 2100 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
952"C:\Program Files\Mozilla Firefox\pingsender.exe" https://incoming.telemetry.mozilla.org/submit/telemetry/3c31620b-910d-4beb-ba7c-7f5fc311f741/main/Firefox/68.0.1/release/20190717172542?v=4 C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\saved-telemetry-pings\3c31620b-910d-4beb-ba7c-7f5fc311f741C:\Program Files\Mozilla Firefox\pingsender.exe
firefox.exe
User:
admin
Company:
Mozilla Foundation
Integrity Level:
MEDIUM
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\pingsender.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
1780"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="460.3.818885202\1431381812" -childID 1 -isForBrowser -prefsHandle 1344 -prefMapHandle 1340 -prefsLen 1 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 460 "\\.\pipe\gecko-crash-server-pipe.460" 1328 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
1792"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2812.34.717057839\283600584" -childID 5 -isForBrowser -prefsHandle 3064 -prefMapHandle 3052 -prefsLen 8392 -prefMapSize 184959 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2812 "\\.\pipe\gecko-crash-server-pipe.2812" 3048 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
1892"C:\Windows\system32\rundll32.exe" cryptext.dll,CryptExtOpenCRL C:\Users\admin\Downloads\th.crlC:\Windows\system32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1904"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2812.20.1163957002\815697911" -childID 3 -isForBrowser -prefsHandle 2440 -prefMapHandle 2436 -prefsLen 120 -prefMapSize 184959 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2812 "\\.\pipe\gecko-crash-server-pipe.2812" 2424 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\dbghelp.dll
1952"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2812.27.2141568385\1043566833" -childID 4 -isForBrowser -prefsHandle 2948 -prefMapHandle 2984 -prefsLen 1387 -prefMapSize 184959 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2812 "\\.\pipe\gecko-crash-server-pipe.2812" 2996 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
2140"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2812.48.1188558301\589548733" -childID 7 -isForBrowser -prefsHandle 4296 -prefMapHandle 4376 -prefsLen 9061 -prefMapSize 184959 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2812 "\\.\pipe\gecko-crash-server-pipe.2812" 4364 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
Total events
1 748
Read events
1 662
Write events
85
Delete events
1

Modification events

(PID) Process:(460) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Browser
Value:
64D2841703000000
(PID) Process:(2600) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Launcher
Value:
64D2841703000000
(PID) Process:(460) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry
Value:
1
(PID) Process:(460) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(460) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000092000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(460) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(460) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(460) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crl\OpenWithProgids
Operation:writeName:CRLFile
Value:
(PID) Process:(460) firefox.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(460) firefox.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:@cryptext.dll,-6134
Value:
&Install CRL
Executable files
2
Suspicious files
169
Text files
140
Unknown types
179

Dropped files

PID
Process
Filename
Type
460firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
460firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shm —
MD5:—
SHA256:—
460firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js —
MD5:—
SHA256:—
460firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp —
MD5:—
SHA256:—
460firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4.tmp —
MD5:—
SHA256:—
460firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.jstext
MD5:—
SHA256:—
460firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.binbinary
MD5:—
SHA256:—
460firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-child-current.binbinary
MD5:—
SHA256:—
460firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\base-track-digest256.sbstorebinary
MD5:—
SHA256:—
460firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4jsonlz4
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
57
DNS requests
215
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
460
firefox.exe
GET
204
194.255.210.68:80
http://ec-tpm-404-56729.ac.bcon.ecdns.net/udp/56729.png
DK
—
—
whitelisted
460
firefox.exe
GET
200
93.184.220.29:80
http://th.symcb.com/th.crl
US
binary
191 Kb
whitelisted
460
firefox.exe
GET
404
93.184.220.29:80
http://th.symcb.com/th
US
xml
445 b
whitelisted
—
—
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQrBBNpPfHTPX6Jy6BVzyBPnBWMnQQUPnQtH89FdQR%2BP8Cihz5MQ4NRE8YCEAxHWpoyfQpCuYL7zNoKQA4%3D
US
der
280 b
whitelisted
460
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
460
firefox.exe
GET
404
93.184.220.29:80
http://th.symcb.com/favicon.ico
US
xml
445 b
whitelisted
460
firefox.exe
GET
200
93.184.221.133:80
http://wpc.75674.betacdn.net/0075674/www/ec_tpm_bcon.js
US
text
222 b
whitelisted
460
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
2812
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
460
firefox.exe
POST
200
172.217.20.227:80
http://ocsp.pki.goog/gts1o1
US
der
472 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
460
firefox.exe
93.184.220.29:80
th.symcb.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
460
firefox.exe
2.21.77.145:80
detectportal.firefox.com
Akamai International B.V.
—
whitelisted
460
firefox.exe
52.89.218.39:443
search.services.mozilla.com
Amazon.com, Inc.
US
unknown
460
firefox.exe
13.35.253.28:443
snippets.cdn.mozilla.net
—
US
malicious
460
firefox.exe
54.191.162.246:443
push.services.mozilla.com
Amazon.com, Inc.
US
malicious
460
firefox.exe
34.210.52.58:443
tiles.services.mozilla.com
Amazon.com, Inc.
US
unknown
460
firefox.exe
172.217.23.42:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
460
firefox.exe
13.35.253.117:443
firefox.settings.services.mozilla.com
—
US
suspicious
460
firefox.exe
13.35.253.94:443
tracking-protection.cdn.mozilla.net
—
US
suspicious
460
firefox.exe
13.35.253.55:443
content-signature-2.cdn.mozilla.net
—
US
malicious

DNS requests

Domain
IP
Reputation
th.symcb.com
  • 93.184.220.29
whitelisted
detectportal.firefox.com
  • 2.21.77.145
whitelisted
search.services.mozilla.com
  • 52.89.218.39
whitelisted
push.services.mozilla.com
  • 54.191.162.246
whitelisted
tiles.services.mozilla.com
  • 34.210.52.58
whitelisted
snippets.cdn.mozilla.net
  • 13.35.253.28
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
safebrowsing.googleapis.com
  • 172.217.23.42
whitelisted
ocsp.pki.goog
  • 172.217.20.227
  • 172.217.23.35
whitelisted
firefox.settings.services.mozilla.com
  • 13.35.253.117
whitelisted

Threats

No threats detected
Process
Message
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
42C4C5846BB675C74E2B2C90C69AB44366401093
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://th.symcb.com/th.crl