File name:

8ty8Fs4efSjghJzrshoiEg.zip

Full analysis: https://app.any.run/tasks/4a182875-58a4-4c91-bd18-ccf9acdab510
Verdict: Malicious activity
Analysis date: December 21, 2023, 21:04:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

6F23E0630A081B58EE77F9963E5CD261

SHA1:

A5A815DBE47B32F13CF265BEFC2BA32AB25791D2

SHA256:

B577D7111AE4BFEA8C85CB3D89C6152AD6A07C01CC331A64F6151749B37591AE

SSDEEP:

6:5juu4IHlfcKv5zmShVGoGx1NjXnHu7kVzW/Cxxuu4IJBt+lU5:5juu4IHlfc0wUkx3nAgzW/Cx4u4IJLaM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the Internet Settings

      • rundll32.exe (PID: 3048)
      • rundll32.exe (PID: 696)
      • rundll32.exe (PID: 2300)
      • rundll32.exe (PID: 2788)
      • rundll32.exe (PID: 2968)
      • ehshell.exe (PID: 2508)
      • rundll32.exe (PID: 2960)
      • wmplayer.exe (PID: 2460)
      • rundll32.exe (PID: 1556)

    • Uses RUNDLL32.EXE to load library

      • iexplore.exe (PID: 2316)

  • INFO

    • Manual execution by a user

      • rundll32.exe (PID: 696)
      • rundll32.exe (PID: 3048)
      • rundll32.exe (PID: 1380)
      • rundll32.exe (PID: 2300)
      • iexplore.exe (PID: 2316)
      • rundll32.exe (PID: 2968)
      • rundll32.exe (PID: 2960)
      • ehtray.exe (PID: 3484)
      • ehtray.exe (PID: 3424)
      • rundll32.exe (PID: 1556)

    • Application launched itself

      • AcroRd32.exe (PID: 2096)
      • firefox.exe (PID: 3032)
      • firefox.exe (PID: 2944)
      • iexplore.exe (PID: 2316)
      • RdrCEF.exe (PID: 1232)

    • Checks supported languages

      • ehshell.exe (PID: 2508)
      • wmplayer.exe (PID: 2460)
      • ehrecvr.exe (PID: 2304)
      • ehsched.exe (PID: 3564)
      • ehrec.exe (PID: 4040)
      • ehshell.exe (PID: 2312)
      • ehtray.exe (PID: 3484)
      • ehsched.exe (PID: 3508)
      • ehtray.exe (PID: 3424)
      • ehrec.exe (PID: 1528)
      • vlc.exe (PID: 3604)

    • Reads the computer name

      • ehshell.exe (PID: 2508)
      • wmplayer.exe (PID: 2460)
      • ehrecvr.exe (PID: 2304)
      • ehrec.exe (PID: 4040)
      • ehshell.exe (PID: 2312)
      • ehsched.exe (PID: 3564)
      • ehtray.exe (PID: 3484)
      • ehsched.exe (PID: 3508)
      • ehtray.exe (PID: 3424)
      • ehrec.exe (PID: 1528)
      • vlc.exe (PID: 3604)

    • Reads the machine GUID from the registry

      • ehshell.exe (PID: 2508)
      • wmplayer.exe (PID: 2460)
      • ehrecvr.exe (PID: 2304)
      • ehtray.exe (PID: 3484)
      • ehrec.exe (PID: 4040)
      • ehsched.exe (PID: 3564)
      • ehsched.exe (PID: 3508)
      • ehrec.exe (PID: 1528)
      • ehshell.exe (PID: 2312)
      • ehtray.exe (PID: 3424)

    • Creates files or folders in the user directory

      • ehshell.exe (PID: 2508)
      • wmplayer.exe (PID: 2460)

    • Process checks computer location settings

      • ehshell.exe (PID: 2508)
      • wmplayer.exe (PID: 2460)
      • ehshell.exe (PID: 2312)

    • Reads Environment values

      • wmplayer.exe (PID: 2460)
      • ehshell.exe (PID: 2508)

    • Executes as Windows Service

      • ehrecvr.exe (PID: 2304)
      • ehsched.exe (PID: 3564)
      • ehsched.exe (PID: 3508)

    • Creates files in the program directory

      • ehshell.exe (PID: 2508)
      • ehrecvr.exe (PID: 2304)
      • ehshell.exe (PID: 2312)

    • Drops the executable file immediately after the start

      • ehrec.exe (PID: 4040)

    • Checks proxy server information

      • wmplayer.exe (PID: 2460)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Deflated
ZipModifyDate: 2023:12:21 15:24:38
ZipCRC: 0x2356acce
ZipCompressedSize: 100
ZipUncompressedSize: 152
ZipFileName: Pictures_
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
86
Monitored processes
44
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs rundll32.exe no specs PhotoViewer.dll no specs rundll32.exe no specs mspaint.exe no specs rundll32.exe no specs acrord32.exe acrord32.exe no specs rdrcef.exe rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rundll32.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs iexplore.exe no specs iexplore.exe no specs rundll32.exe no specs winword.exe no specs rundll32.exe no specs ehshell.exe wmplayer.exe ehrecvr.exe no specs ehsched.exe no specs ehtray.exe no specs ehrec.exe no specs rundll32.exe no specs ehshell.exe ehsched.exe no specs ehtray.exe no specs ehrec.exe no specs rundll32.exe no specs vlc.exe

Process information

PID
CMD
Path
Indicators
Parent process
572"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3032.7.1495773830\353587962" -childID 6 -isForBrowser -prefsHandle 4084 -prefMapHandle 4120 -prefsLen 34225 -prefMapSize 244195 -jsInitHandle 884 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a6b8e479-8fc9-4633-83b0-d2c37f075280} 3032 "\\.\pipe\gecko-crash-server-pipe.3032" 3944 18386c90 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
696"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\PicturesC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
908"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1156,14637910537695706829,13029155377920505168,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-gpu-compositing --lang=en-US --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.13.20064 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=7153866409666336749 --renderer-client-id=7 --mojo-platform-channel-handle=2364 --allow-no-sandbox-job /prefetch:1C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
0
Version:
20.13.20064.405839
Modules
Images
c:\program files\adobe\acrobat reader dc\reader\acrocef\rdrcef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1044C:\Windows\system32\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1232"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
0
Version:
20.13.20064.405839
Modules
Images
c:\program files\adobe\acrobat reader dc\reader\acrocef\rdrcef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1380"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\PicturesC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1432"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\8ty8Fs4efSjghJzrshoiEg.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1528C:\Windows\ehome\ehRec.exe -EmbeddingC:\Windows\ehome\ehrec.exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Media Center Host Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\ehome\ehrec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1556"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1156,14637910537695706829,13029155377920505168,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-gpu-compositing --lang=en-US --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.13.20064 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=11983651020904617462 --renderer-client-id=2 --mojo-platform-channel-handle=1164 --allow-no-sandbox-job /prefetch:1C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
0
Version:
20.13.20064.405839
Modules
Images
c:\program files\adobe\acrobat reader dc\reader\acrocef\rdrcef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1556"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\PicturesC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
Total events
39 797
Read events
38 595
Write events
943
Delete events
259

Modification events

(PID) Process:(1432) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1432) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1432) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(1432) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1432) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(1432) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1432) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1432) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1432) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1380) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
3
Suspicious files
222
Text files
39
Unknown types
0

Dropped files

PID
Process
Filename
Type
1232RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0binary
MD5:FB9B1CB4919447298471975D7C2655D3
SHA256:5D356C3F47EAF2DAA31BA326CC7FA0336271EC77AE1522D2DF3AF3F7DA707A40
1232RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0binary
MD5:AF253B0E364D82A993074141B3BDC54B
SHA256:22A8A41D893F058E574A7FA3FCC4A1431B873B6C7C380B2AEB1AEB72D10F4631
1432WinRAR.exeC:\Users\admin\Desktop\Pictures_binary
MD5:4F430DEF1CAF6923DC0A5560C87E2517
SHA256:9ED60E56F8C1FE4D4ACE4A8EDD655CC418B251E98A8751D6758A8D0262B93362
2336AcroRd32.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\SOPHIA.jsonbinary
MD5:01F233C92A89C705229A0D63D09F846A
SHA256:62137C4381ACC2DE8BCA158AD9D9CE730BD7A96A39A2FB64CE7CFA5C861CF7B4
1232RdrCEF.exe —
MD5:—
SHA256:—
1232RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0binary
MD5:A3E4F8895DC0E584CC35315381757D70
SHA256:CD8424296707DB2B453B27B677C48EAFD2EF12D9038B5CC598BF37690292F1A2
1232RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\983b7a3da8f39a46_0binary
MD5:95C0DF025F7F31F1F9F4F9CE92762B1B
SHA256:395E0F746B87A7A10067EAFEBD01AC4D44827703B8D50153B327C1A80DC1BE8E
1232RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0binary
MD5:22C0022E42DAC044FC16A6135867F4CD
SHA256:474DF04A0B8F5F3368CE4767485E1352C39110D586DB3D497219028492EE1B9A
1232RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0binary
MD5:36050987FBC706E4C953C328F0C3A6DC
SHA256:7FA4622514883BFAF486348A8F199324DFFE152230F76B6741DC2BBBC32F5796
1232RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0binary
MD5:FA0B30ABACBB71307C4AE38AE340D5DC
SHA256:A48EB60A3B90F9E6F2EE3612A8874777A02773B6E49345A0680787383C904C76
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
22
TCP/UDP connections
56
DNS requests
203
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2096
AcroRd32.exe
GET
—
2.16.2.154:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?120fad9c75deed2b
unknown
—
—
unknown
3032
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
text
90 b
unknown
3032
firefox.exe
POST
200
2.16.2.73:80
http://r3.o.lencr.org/
unknown
binary
503 b
unknown
3032
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
text
8 b
unknown
3032
firefox.exe
POST
200
2.16.2.73:80
http://r3.o.lencr.org/
unknown
binary
503 b
unknown
3032
firefox.exe
POST
200
2.16.2.73:80
http://r3.o.lencr.org/
unknown
binary
503 b
unknown
3032
firefox.exe
POST
200
2.16.2.73:80
http://r3.o.lencr.org/
unknown
binary
503 b
unknown
3032
firefox.exe
POST
200
192.229.221.95:80
http://ocsp.digicert.com/
unknown
binary
471 b
unknown
3032
firefox.exe
POST
200
2.16.2.73:80
http://r3.o.lencr.org/
unknown
binary
503 b
unknown
3032
firefox.exe
POST
200
2.16.2.73:80
http://r3.o.lencr.org/
unknown
binary
503 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1232
RdrCEF.exe
23.73.140.157:443
geo2.adobe.com
AKAMAI-AS
CZ
unknown
1232
RdrCEF.exe
34.237.241.83:443
p13n.adobe.io
AMAZON-AES
US
unknown
1232
RdrCEF.exe
2.23.8.158:443
armmf.adobe.com
AKAMAI-AS
CZ
unknown
2096
AcroRd32.exe
23.44.215.48:443
acroipm2.adobe.com
Akamai International B.V.
CZ
unknown
2096
AcroRd32.exe
2.16.2.154:80
ctldl.windowsupdate.com
Akamai International B.V.
CZ
whitelisted
3032
firefox.exe
34.107.221.82:80
detectportal.firefox.com
GOOGLE
US
whitelisted
3032
firefox.exe
52.86.78.173:443
spocs.getpocket.com
AMAZON-AES
US
unknown

DNS requests

Domain
IP
Reputation
geo2.adobe.com
  • 23.73.140.157
whitelisted
p13n.adobe.io
  • 34.237.241.83
whitelisted
armmf.adobe.com
  • 2.23.8.158
whitelisted
acroipm2.adobe.com
  • 23.44.215.48
whitelisted
ctldl.windowsupdate.com
  • 2.16.2.154
whitelisted
detectportal.firefox.com
  • 34.107.221.82
whitelisted
contile.services.mozilla.com
  • 34.117.237.239
whitelisted
spocs.getpocket.com
  • 52.86.78.173
shared
firefox.settings.services.mozilla.com
  • 34.149.100.209
whitelisted
safebrowsing.googleapis.com
  • —
unknown

Threats

No threats detected
Process
Message
ehshell.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
ehshell.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
ehshell.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
ehshell.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
ehshell.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
ehshell.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
ehshell.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
ehshell.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
ehshell.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
ehshell.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
8ty8Fs4efSjghJzrshoiEg.zip