analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

any run.zip

Full analysis: https://app.any.run/tasks/d5112b62-e515-4eeb-8dc2-578a0a2c80d1
Verdict: Malicious activity
Analysis date: May 20, 2022, 22:25:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

D5580C9560F5FF87A09FC6100654D4E4

SHA1:

5F42337E5F30A7D73546BFBB399453D2328E5A8D

SHA256:

C33C4CC5639886BFF516F52872C773EC9D7D15B6CAAE3530753A0458B334C60B

SSDEEP:

196608:XH/djrRJhxwSAGm7eGfp4mFWjsa0e1y8ky+q:XVvfH2lpbafT+q

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes internet zones settings

      • ie4uinit.exe (PID: 1732)
      • rundll32.exe (PID: 3428)

    • Writes to a start menu file

      • regsvr32.exe (PID: 2536)

    • Changes the Startup folder

      • regsvr32.exe (PID: 2536)

    • Drops executable file immediately after starts

      • firefox.exe (PID: 3900)

    • Application was dropped or rewritten from another process

      • Mythlas.exe (PID: 1836)

  • SUSPICIOUS

    • Reads the computer name

      • WinRAR.exe (PID: 2972)
      • WinMail.exe (PID: 2332)
      • chrmstp.exe (PID: 1876)
      • IMEKLMG.EXE (PID: 2352)
      • IMEKLMG.EXE (PID: 2464)
      • Mythlas.exe (PID: 1836)

    • Checks supported languages

      • WinRAR.exe (PID: 2972)
      • WinMail.exe (PID: 2332)
      • chrmstp.exe (PID: 2804)
      • chrmstp.exe (PID: 1876)
      • IMEKLMG.EXE (PID: 2464)
      • IMEKLMG.EXE (PID: 2352)
      • imkrmig.exe (PID: 2956)
      • jusched.exe (PID: 1188)
      • Mythlas.exe (PID: 1836)

    • Application launched itself

      • taskmgr.exe (PID: 2392)
      • ie4uinit.exe (PID: 1732)
      • rundll32.exe (PID: 3632)
      • chrmstp.exe (PID: 1876)

    • Executed as Windows Service

      • taskhost.exe (PID: 1728)
      • EOSNotify.exe (PID: 2272)

    • Creates files in the Windows directory

      • ie4uinit.exe (PID: 1732)
      • regsvr32.exe (PID: 3648)
      • WinMail.exe (PID: 2332)
      • unregmp2.exe (PID: 2908)
      • regsvr32.exe (PID: 2536)
      • chrmstp.exe (PID: 1876)
      • chrmstp.exe (PID: 2804)
      • IMEKLMG.EXE (PID: 2352)
      • jusched.exe (PID: 1188)
      • firefox.exe (PID: 3900)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • ie4uinit.exe (PID: 1732)
      • WinMail.exe (PID: 2332)
      • unregmp2.exe (PID: 2908)
      • regsvr32.exe (PID: 2536)

    • Uses RUNDLL32.EXE to load library

      • ie4uinit.exe (PID: 1732)
      • rundll32.exe (PID: 3632)

    • Reads Microsoft Outlook installation path

      • ie4uinit.exe (PID: 1732)

    • Removes files from Windows directory

      • ie4uinit.exe (PID: 1732)
      • RunDll32.exe (PID: 3720)
      • WinMail.exe (PID: 2332)
      • unregmp2.exe (PID: 2908)
      • regsvr32.exe (PID: 2536)
      • firefox.exe (PID: 3900)

    • Creates files in the program directory

      • ie4uinit.exe (PID: 1732)
      • chrmstp.exe (PID: 1876)

    • Changes the started page of IE

      • ie4uinit.exe (PID: 1732)

    • Reads Environment values

      • unregmp2.exe (PID: 2908)

    • Changes default file association

      • unregmp2.exe (PID: 2908)

    • Reads the date of Windows installation

      • chrmstp.exe (PID: 1876)

    • Check for Java to be installed

      • jusched.exe (PID: 1188)

    • Executed via Task Scheduler

      • sipnotify.exe (PID: 2276)

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 3900)

    • Drops a file with a compile date too recent

      • firefox.exe (PID: 3900)

  • INFO

    • Checks supported languages

      • taskmgr.exe (PID: 2392)
      • taskhost.exe (PID: 1728)
      • taskmgr.exe (PID: 3096)
      • ie4uinit.exe (PID: 1732)
      • ie4uinit.exe (PID: 3452)
      • rundll32.exe (PID: 3632)
      • rundll32.exe (PID: 3556)
      • RunDll32.exe (PID: 3180)
      • RunDll32.exe (PID: 3720)
      • regsvr32.exe (PID: 3648)
      • ie4uinit.exe (PID: 3640)
      • unregmp2.exe (PID: 2908)
      • ie4uinit.exe (PID: 1024)
      • regsvr32.exe (PID: 2536)
      • rundll32.exe (PID: 3428)
      • EOSNotify.exe (PID: 2272)
      • firefox.exe (PID: 440)
      • sipnotify.exe (PID: 2276)
      • firefox.exe (PID: 3900)
      • firefox.exe (PID: 3992)
      • firefox.exe (PID: 952)
      • firefox.exe (PID: 3332)
      • firefox.exe (PID: 1768)
      • firefox.exe (PID: 3392)
      • firefox.exe (PID: 2856)
      • firefox.exe (PID: 1588)
      • firefox.exe (PID: 2860)

    • Reads the computer name

      • taskmgr.exe (PID: 2392)
      • taskmgr.exe (PID: 3096)
      • taskhost.exe (PID: 1728)
      • ie4uinit.exe (PID: 1732)
      • rundll32.exe (PID: 3632)
      • rundll32.exe (PID: 3556)
      • RunDll32.exe (PID: 3180)
      • RunDll32.exe (PID: 3720)
      • regsvr32.exe (PID: 3648)
      • unregmp2.exe (PID: 2908)
      • regsvr32.exe (PID: 2536)
      • ie4uinit.exe (PID: 3452)
      • EOSNotify.exe (PID: 2272)
      • sipnotify.exe (PID: 2276)
      • firefox.exe (PID: 3900)
      • firefox.exe (PID: 3332)
      • firefox.exe (PID: 952)
      • firefox.exe (PID: 3992)
      • firefox.exe (PID: 1588)
      • firefox.exe (PID: 3392)
      • firefox.exe (PID: 1768)
      • firefox.exe (PID: 2856)
      • firefox.exe (PID: 2860)

    • Manual execution by user

      • taskmgr.exe (PID: 2392)
      • ie4uinit.exe (PID: 1732)
      • WinMail.exe (PID: 2332)
      • regsvr32.exe (PID: 3648)
      • ie4uinit.exe (PID: 3640)
      • unregmp2.exe (PID: 2908)
      • ie4uinit.exe (PID: 1024)
      • regsvr32.exe (PID: 2536)
      • rundll32.exe (PID: 3428)
      • chrmstp.exe (PID: 1876)
      • IMEKLMG.EXE (PID: 2352)
      • jusched.exe (PID: 1188)
      • IMEKLMG.EXE (PID: 2464)
      • firefox.exe (PID: 440)
      • Mythlas.exe (PID: 1836)

    • Application launched itself

      • firefox.exe (PID: 440)
      • firefox.exe (PID: 3900)

    • Reads CPU info

      • firefox.exe (PID: 3900)

    • Creates files in the program directory

      • firefox.exe (PID: 3900)

    • Reads the date of Windows installation

      • firefox.exe (PID: 3900)

    • Checks Windows Trust Settings

      • firefox.exe (PID: 3900)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: aramaware.exe
ZipUncompressedSize: 616717
ZipCompressedSize: 186036
ZipCRC: 0x75455c4d
ZipModifyDate: 2022:05:12 13:09:21
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
94
Monitored processes
36
Malicious processes
7
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe no specs taskmgr.exe no specs taskmgr.exe taskhost.exe no specs ie4uinit.exe no specs ie4uinit.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs rundll32.exe no specs regsvr32.exe no specs winmail.exe no specs ie4uinit.exe no specs unregmp2.exe no specs ie4uinit.exe no specs regsvr32.exe rundll32.exe no specs chrmstp.exe no specs chrmstp.exe no specs imeklmg.exe no specs imeklmg.exe no specs jusched.exe no specs imkrmig.exe no specs eosnotify.exe no specs sipnotify.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs mythlas.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2972"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\any run.zip"C:\Program Files\WinRAR\WinRAR.exe—Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2392"C:\Windows\system32\taskmgr.exe" C:\Windows\system32\taskmgr.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
3096"C:\Windows\system32\taskmgr.exe" /1C:\Windows\system32\taskmgr.exe
taskmgr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Task Manager
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1728"taskhost.exe"C:\Windows\system32\taskhost.exe—services.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Host Process for Windows Tasks
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1732"C:\Windows\System32\ie4uinit.exe" -UserConfigC:\Windows\System32\ie4uinit.exe—Explorer.EXE
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
IE Per-User Initialization Utility
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
3452C:\Windows\System32\ie4uinit.exe -ClearIconCacheC:\Windows\System32\ie4uinit.exe—ie4uinit.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
IE Per-User Initialization Utility
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
3556C:\Windows\System32\rundll32 advpack.dll,LaunchINFSectionEx C:\Windows\system32\ieuinit.inf,Install,,36C:\Windows\System32\rundll32.exe—ie4uinit.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3632C:\Windows\System32\rundll32 C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /mC:\Windows\System32\rundll32.exe—ie4uinit.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3180C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0C:\Windows\system32\RunDll32.exe—rundll32.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Windows host process (Rundll32)
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3720C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0C:\Windows\system32\RunDll32.exe—rundll32.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
21 954
Read events
20 120
Write events
1 813
Delete events
21

Modification events

(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2972) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\any run.zip
(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2972) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
2
Suspicious files
334
Text files
199
Unknown types
93

Dropped files

PID
Process
Filename
Type
1732ie4uinit.exeC:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnklnk
MD5:44902E96F024930A503F3D00251DED1D
SHA256:DDC4FC419AB290D2A6440256E43D63ED2BC86AC8C446DF666C1D9F3B74C01387
1732ie4uinit.exeC:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnklnk
MD5:478F8CFFC181F23A4A56263BE97EB452
SHA256:F960EAA56BD65D0C7BAFFDE9B2E1A8EA8421CA6EF1B4CE8CA28518328B34D1C5
1732ie4uinit.exeC:\Windows\INF\setupapi.app.logini
MD5:E5BD0082A90348393855756968428F8E
SHA256:D07BCB76CCDA2B80AF4E6ACDDC23D1B9B2F9F8E24ED1286F6C7871BEA2918032
2332WinMail.exeC:\Users\Administrator\Contacts\Administrator (1).contactxml
MD5:676E2FD18F3ABF9CC915B33352991FE6
SHA256:1DED9B1F88A08F37371F679540E74E69986FECCDF3F75CA265BCB11C95F7B901
1732ie4uinit.exeC:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Tiles\pin9728060290\msapplication.xmlxml
MD5:962BBE34A999201A0807065887923B75
SHA256:6C7C129E86E677A7FC712FB59F3863405DAEB0EEC1C352B3751C925DD7F73328
2332WinMail.exeC:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows Mail\edbtmp.logbinary
MD5:D239AD5AA8198644DF51448FC47A80C9
SHA256:067B2A9F4D0B4BBCE05CBE597A9F6393EF61E216CEF94E17F1B881246E8D9A9E
2332WinMail.exeC:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows Mail\edb.logbinary
MD5:D239AD5AA8198644DF51448FC47A80C9
SHA256:067B2A9F4D0B4BBCE05CBE597A9F6393EF61E216CEF94E17F1B881246E8D9A9E
1732ie4uinit.exeC:\Windows\system32\config\systemprofile\Favorites\desktop.initext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
1732ie4uinit.exeC:\Windows\system32\config\systemprofile\AppData\Local\Temp\RGI4DF9.tmpini
MD5:31CB7778F65DF8D02353E6C7B2B2CFFC
SHA256:647A8C7F316EF325F73C2037E8883854F9287584904C977C81D1662DB6471A58
1732ie4uinit.exeC:\Windows\System32\config\systemprofile\Favorites\Links\desktop.iniini
MD5:3C106F431417240DA12FD827323B7724
SHA256:E469ED17B4B54595B335DC51817A52B81FCF13AAD7B7B994626F84EC097C5D57
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
56
DNS requests
156
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3900
firefox.exe
POST
—
93.184.220.29:80
http://ocsp.digicert.com/
US
—
—
whitelisted
3900
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3900
firefox.exe
POST
200
142.250.186.131:80
http://ocsp.pki.goog/gts1c3
US
der
471 b
whitelisted
3900
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3900
firefox.exe
POST
200
142.250.186.131:80
http://ocsp.pki.goog/gts1c3
US
der
472 b
whitelisted
3900
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3900
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt
US
text
8 b
whitelisted
3900
firefox.exe
POST
200
142.250.186.131:80
http://ocsp.pki.goog/gts1c3
US
der
472 b
whitelisted
3900
firefox.exe
POST
200
142.250.186.131:80
http://ocsp.pki.goog/gts1c3
US
der
471 b
whitelisted
3900
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3900
firefox.exe
34.107.221.82:80
detectportal.firefox.com
—
US
whitelisted
3900
firefox.exe
52.222.214.84:443
firefox.settings.services.mozilla.com
Amazon.com, Inc.
US
suspicious
3900
firefox.exe
35.161.134.161:443
location.services.mozilla.com
Amazon.com, Inc.
US
unknown
3900
firefox.exe
13.32.119.185:443
www.mozilla.org
Amazon.com, Inc.
US
suspicious
3900
firefox.exe
34.120.208.123:443
incoming.telemetry.mozilla.org
—
US
malicious
3900
firefox.exe
54.190.96.86:443
accounts.firefox.com
Amazon.com, Inc.
US
unknown
3900
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3900
firefox.exe
52.24.149.180:443
shavar.services.mozilla.com
Amazon.com, Inc.
US
unknown
3900
firefox.exe
52.222.236.127:443
normandy.cdn.mozilla.net
Amazon.com, Inc.
US
suspicious
3900
firefox.exe
34.210.202.253:443
push.services.mozilla.com
Amazon.com, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
detectportal.firefox.com
  • 34.107.221.82
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
www.mozilla.org
  • 13.32.119.185
whitelisted
www.mozorg.moz.works
  • 13.32.119.185
suspicious
example.org
  • 93.184.216.34
whitelisted
ipv4only.arpa
  • 192.0.0.170
  • 192.0.0.171
whitelisted
firefox.settings.services.mozilla.com
  • 52.222.214.84
  • 52.222.214.116
  • 52.222.214.96
  • 52.222.214.105
whitelisted
accounts.firefox.com
  • 54.190.96.86
  • 52.41.224.137
  • 35.165.63.7
whitelisted
incoming.telemetry.mozilla.org
  • 34.120.208.123
whitelisted
prod.ingestion-edge.prod.dataops.mozgcp.net
  • 34.120.208.123
whitelisted

Threats

PID
Process
Class
Message
3900
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
3900
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
3900
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
3900
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
any run.zip