File name:

Trojan.GenericKD.3943952.7z

Full analysis: https://app.any.run/tasks/ef6cac7f-078f-450d-915e-a5e4f793da5d
Verdict: Malicious activity
Analysis date: November 20, 2023, 20:02:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

BA8E08F68601CB06E4C82D41DC6E5436

SHA1:

1B284EE73C3A5255C95CA701A076F0FE4E49C5CD

SHA256:

EE27B607FFAA140F1A38FC8867094C15EF1FA05B7739F8816F4B9D44492CBE67

SSDEEP:

768:8yXYwr+jAWq8MFPfwPZbyzKxFe7yYzDa16yWFD9G:LX1r+Tq8MFPfeb/nzYzS6ZDg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 2f3409bb36d5411d1a02ebd189c305e2b20f744c204f15eef9be459ec398448b.exe (PID: 3696)
      • explorer.exe (PID: 300)
      • explorer.exe (PID: 2056)

    • Creates a writable file in the system directory

      • explorer.exe (PID: 2056)

    • Actions looks like stealing of personal data

      • explorer.exe (PID: 2056)

    • Changes the autorun value in the registry

      • explorer.exe (PID: 2056)

  • SUSPICIOUS

    • Reads the Internet Settings

      • taskmgr.exe (PID: 3468)
      • 2f3409bb36d5411d1a02ebd189c305e2b20f744c204f15eef9be459ec398448b.exe (PID: 3696)
      • explorer.exe (PID: 300)
      • explorer.exe (PID: 2056)

    • The process creates files with name similar to system file names

      • 2f3409bb36d5411d1a02ebd189c305e2b20f744c204f15eef9be459ec398448b.exe (PID: 3696)
      • explorer.exe (PID: 300)

    • Application launched itself

      • taskmgr.exe (PID: 3468)
      • explorer.exe (PID: 300)

    • Starts itself from another location

      • 2f3409bb36d5411d1a02ebd189c305e2b20f744c204f15eef9be459ec398448b.exe (PID: 3696)

  • INFO

    • Manual execution by a user

      • taskmgr.exe (PID: 3468)
      • 2f3409bb36d5411d1a02ebd189c305e2b20f744c204f15eef9be459ec398448b.exe (PID: 3696)
      • wmpnscfg.exe (PID: 3804)
      • firefox.exe (PID: 1612)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3208)

    • Checks supported languages

      • 2f3409bb36d5411d1a02ebd189c305e2b20f744c204f15eef9be459ec398448b.exe (PID: 3696)
      • explorer.exe (PID: 300)
      • taskmgr.exe (PID: 2368)
      • wmpnscfg.exe (PID: 3804)
      • explorer.exe (PID: 2056)

    • Reads the computer name

      • 2f3409bb36d5411d1a02ebd189c305e2b20f744c204f15eef9be459ec398448b.exe (PID: 3696)
      • explorer.exe (PID: 300)
      • explorer.exe (PID: 2056)
      • taskmgr.exe (PID: 2368)
      • wmpnscfg.exe (PID: 3804)

    • Reads the machine GUID from the registry

      • 2f3409bb36d5411d1a02ebd189c305e2b20f744c204f15eef9be459ec398448b.exe (PID: 3696)
      • explorer.exe (PID: 300)
      • explorer.exe (PID: 2056)
      • wmpnscfg.exe (PID: 3804)

    • Create files in a temporary directory

      • explorer.exe (PID: 300)
      • 2f3409bb36d5411d1a02ebd189c305e2b20f744c204f15eef9be459ec398448b.exe (PID: 3696)

    • Reads Environment values

      • explorer.exe (PID: 2056)

    • Creates files in the program directory

      • explorer.exe (PID: 2056)

    • Creates files or folders in the user directory

      • explorer.exe (PID: 2056)

    • Application launched itself

      • firefox.exe (PID: 712)
      • firefox.exe (PID: 1612)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
59
Monitored processes
17
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs taskmgr.exe no specs taskmgr.exe 2f3409bb36d5411d1a02ebd189c305e2b20f744c204f15eef9be459ec398448b.exe explorer.exe no specs taskmgr.exe no specs explorer.exe wmpnscfg.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
276"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="712.2.462741463\769297406" -childID 1 -isForBrowser -prefsHandle 2052 -prefMapHandle 1988 -prefsLen 28712 -prefMapSize 244195 -jsInitHandle 892 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9de67832-8167-42a6-88b3-d6473a781f6c} 712 "\\.\pipe\gecko-crash-server-pipe.712" 1920 1b64d280 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
300"C:\Users\admin\AppData\Local\Temp\explorer.exe" C:\Users\admin\AppData\Local\Temp\explorer.exe—2f3409bb36d5411d1a02ebd189c305e2b20f744c204f15eef9be459ec398448b.exe
User:
admin
Company:
Windows Explorer
Integrity Level:
HIGH
Description:
explorer
Exit code:
0
Version:
7.30
Modules
Images
c:\users\admin\appdata\local\temp\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
712"C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
1116"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="712.1.1767866720\1143249773" -parentBuildID 20230710165010 -prefsHandle 1404 -prefMapHandle 1400 -prefsLen 28600 -prefMapSize 244195 -appDir "C:\Program Files\Mozilla Firefox\browser" - {72e07c22-3fbd-4a95-8623-13b87c83c86b} 712 "\\.\pipe\gecko-crash-server-pipe.712" 1416 17b24130 socketC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
1612"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
2056"C:\Users\admin\AppData\Local\Temp\explorer.exe" C:\Users\admin\AppData\Local\Temp\explorer.exe
explorer.exe
User:
admin
Company:
Windows Explorer
Integrity Level:
HIGH
Description:
explorer
Exit code:
0
Version:
7.30
Modules
Images
c:\users\admin\appdata\local\temp\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2368"C:\Users\admin\AppData\Local\Temp\taskmgr.exe" C:\Users\admin\AppData\Local\Temp\taskmgr.exe—explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
taskmgr
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2392"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="712.0.599854572\1941464504" -parentBuildID 20230710165010 -prefsHandle 1096 -prefMapHandle 1088 -prefsLen 28523 -prefMapSize 244195 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5cc49c0a-9462-4029-ad72-12eb21be8d30} 712 "\\.\pipe\gecko-crash-server-pipe.712" 1168 d4a9bc0 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
1
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
2964"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="712.3.650292587\1992445304" -childID 2 -isForBrowser -prefsHandle 2892 -prefMapHandle 2888 -prefsLen 34225 -prefMapSize 244195 -jsInitHandle 892 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {843abbc6-ab13-41fa-b4a6-6b6b4c3235b4} 712 "\\.\pipe\gecko-crash-server-pipe.712" 2904 1f40c3f0 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
3156"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="712.5.1595034349\773355019" -childID 4 -isForBrowser -prefsHandle 3916 -prefMapHandle 3920 -prefsLen 29209 -prefMapSize 244195 -jsInitHandle 892 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f94f914-fbe6-4978-b255-64538753d009} 712 "\\.\pipe\gecko-crash-server-pipe.712" 3900 20516560 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
Total events
27 406
Read events
19 230
Write events
8 173
Delete events
3

Modification events

(PID) Process:(3208) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3208) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3208) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3208) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3208) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3208) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3208) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3208) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3208) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(3208) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\Desktop
Executable files
98
Suspicious files
69
Text files
19
Unknown types
0

Dropped files

PID
Process
Filename
Type
36962f3409bb36d5411d1a02ebd189c305e2b20f744c204f15eef9be459ec398448b.exeC:\Users\admin\AppData\Local\Temp\Ex1.3.bigtext
MD5:54D54A126A783BC9CBA8C06137136943
SHA256:5312FB609F60384731FCFCB95DEEF3602239BF61F865A07BD8E08D818D22E9FA
36962f3409bb36d5411d1a02ebd189c305e2b20f744c204f15eef9be459ec398448b.exeC:\Users\admin\AppData\Local\Temp\Ex1.bigtext
MD5:54D54A126A783BC9CBA8C06137136943
SHA256:5312FB609F60384731FCFCB95DEEF3602239BF61F865A07BD8E08D818D22E9FA
2056explorer.exeC:\Program Files\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\core\dev\nls\de-de.exeexecutable
MD5:7714FCCF2D8F60A76F2F77BA55666437
SHA256:2F3409BB36D5411D1A02EBD189C305E2B20F744C204F15EEF9BE459EC398448B
36962f3409bb36d5411d1a02ebd189c305e2b20f744c204f15eef9be459ec398448b.exeC:\Users\admin\AppData\Local\Temp\~~~~~~~~~m1.1.bigtext
MD5:54D54A126A783BC9CBA8C06137136943
SHA256:5312FB609F60384731FCFCB95DEEF3602239BF61F865A07BD8E08D818D22E9FA
36962f3409bb36d5411d1a02ebd189c305e2b20f744c204f15eef9be459ec398448b.exeC:\Users\admin\AppData\Local\Temp\Ex1.2.bigtext
MD5:54D54A126A783BC9CBA8C06137136943
SHA256:5312FB609F60384731FCFCB95DEEF3602239BF61F865A07BD8E08D818D22E9FA
2056explorer.exeC:\Program Files\Adobe\Acrobat Reader DC\Reader\WebResources\Resource1\static\js\plugins\activity-badge\js\nls\pt-br.exeexecutable
MD5:7714FCCF2D8F60A76F2F77BA55666437
SHA256:2F3409BB36D5411D1A02EBD189C305E2B20F744C204F15EEF9BE459EC398448B
36962f3409bb36d5411d1a02ebd189c305e2b20f744c204f15eef9be459ec398448b.exeC:\Users\admin\AppData\Local\Temp\~~~~~~~~~m.bigtext
MD5:54D54A126A783BC9CBA8C06137136943
SHA256:5312FB609F60384731FCFCB95DEEF3602239BF61F865A07BD8E08D818D22E9FA
36962f3409bb36d5411d1a02ebd189c305e2b20f744c204f15eef9be459ec398448b.exeC:\Users\admin\AppData\Local\Temp\explorer.exeexecutable
MD5:7714FCCF2D8F60A76F2F77BA55666437
SHA256:2F3409BB36D5411D1A02EBD189C305E2B20F744C204F15EEF9BE459EC398448B
300explorer.exeC:\Users\admin\AppData\Local\Temp\taskmgr.exeexecutable
MD5:BBF8F7E57A66BD16A2809E035F6B9918
SHA256:3BA294E5207000F0712D8616BDE121EF110F88C79EDB2D3143416CC749F549C1
36962f3409bb36d5411d1a02ebd189c305e2b20f744c204f15eef9be459ec398448b.exeC:\Users\admin\AppData\Local\Temp\~~~~~~~~~m1.2.bigtext
MD5:54D54A126A783BC9CBA8C06137136943
SHA256:5312FB609F60384731FCFCB95DEEF3602239BF61F865A07BD8E08D818D22E9FA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
35
DNS requests
67
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2056
explorer.exe
GET
200
79.127.127.68:80
http://limlim00000.rozblog.com/page/main
unknown
—
—
unknown
712
firefox.exe
POST
200
184.24.77.56:80
http://r3.o.lencr.org/
unknown
binary
503 b
unknown
712
firefox.exe
POST
200
142.250.186.131:80
http://ocsp.pki.goog/gts1c3
unknown
binary
472 b
unknown
712
firefox.exe
POST
—
13.225.21.174:80
http://ocsp.r2m02.amazontrust.com/
unknown
—
—
unknown
712
firefox.exe
POST
200
142.250.186.131:80
http://ocsp.pki.goog/gts1c3
unknown
binary
472 b
unknown
712
firefox.exe
POST
200
184.24.77.56:80
http://r3.o.lencr.org/
unknown
binary
503 b
unknown
712
firefox.exe
POST
200
184.24.77.48:80
http://r3.o.lencr.org/
unknown
binary
503 b
unknown
712
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
text
8 b
unknown
712
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
text
90 b
unknown
712
firefox.exe
POST
200
184.24.77.56:80
http://r3.o.lencr.org/
unknown
binary
503 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2056
explorer.exe
142.250.186.164:80
www.google.com
GOOGLE
US
whitelisted
2056
explorer.exe
79.127.127.68:80
limlim00000.rozblog.com
Asiatech Data Transmission company
IR
unknown
712
firefox.exe
34.107.221.82:80
detectportal.firefox.com
GOOGLE
US
whitelisted
712
firefox.exe
184.24.77.48:80
r3.o.lencr.org
Akamai International B.V.
DE
unknown
712
firefox.exe
142.250.181.234:443
safebrowsing.googleapis.com
—
—
whitelisted
712
firefox.exe
34.117.237.239:443
contile.services.mozilla.com
GOOGLE-CLOUD-PLATFORM
US
unknown

DNS requests

Domain
IP
Reputation
www.google.com
  • 142.250.186.164
whitelisted
limlim00000.rozblog.com
  • 79.127.127.68
unknown
detectportal.firefox.com
  • 34.107.221.82
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
example.org
  • 93.184.216.34
whitelisted
ipv4only.arpa
  • 192.0.0.170
  • 192.0.0.171
whitelisted
contile.services.mozilla.com
  • 34.117.237.239
whitelisted
spocs.getpocket.com
  • 34.200.129.107
  • 34.226.161.51
  • 3.218.237.85
  • 34.196.199.111
shared
proxyserverecs-1736642167.us-east-1.elb.amazonaws.com
  • 3.218.237.85
  • 34.226.161.51
  • 34.200.129.107
  • 34.196.199.111
shared
r3.o.lencr.org
  • 184.24.77.56
  • 184.24.77.52
  • 184.24.77.48
  • 184.24.77.79
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Trojan.GenericKD.3943952.7z