URL: | https://addons.mozilla.org/en-US/firefox/addon/veepn-free-fast-security-vpn/?utm_content=search&utm_medium=referral&utm_source=addons.mozilla.org |
Full analysis: | https://app.any.run/tasks/6183d18c-5f39-4f30-9f70-1d223060403b |
Verdict: | Malicious activity |
Analysis date: | June 19, 2025, 08:55:46 |
OS: | Windows 10 Professional (build: 19044, 64 bit) |
Tags: | |
Indicators: | |
MD5: | 08FBED3699B355AF79B359B01711DFB5 |
SHA1: | 5650935FF5CEE9090CAD886567B5A49A1B2CEF56 |
SHA256: | 001B46B81B0D91E9B3304A88718642361B3CBDA8EE83AA9BA5954E3084518723 |
SSDEEP: | 3:N8qQMUHiMhKDWmKdpBK+40x2WsXMRr+AL+H5ijRIYQDAAQHNQW2BXUHiMC:2qkHiABmKdpgWsXMRr/q5iSrD7QHCWd8 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1508 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7244 -prefsLen 39533 -prefMapHandle 7292 -prefMapSize 272997 -jsInitHandle 7296 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 7304 -initialChannelId {1d28a9f8-f131-4a0f-9378-b65b68b0a1cd} -parentPid 6188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 27 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 136.0 Modules
| |||||||||||||||
1508 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3996 -prefsLen 39869 -prefMapHandle 6640 -prefMapSize 272997 -jsInitHandle 7080 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 5956 -initialChannelId {d335df98-8914-41d3-8960-99f4a06d2a52} -parentPid 6188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 39 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 136.0 Modules
| |||||||||||||||
1944 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250227124745 -prefsHandle 3348 -prefsLen 36996 -prefMapHandle 3352 -prefMapSize 272997 -ipcHandle 3360 -initialChannelId {dbb1a83f-5fd3-417c-a575-abf6a52d6ebf} -parentPid 6188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6188" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 136.0 Modules
| |||||||||||||||
3760 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7136 -prefsLen 39533 -prefMapHandle 6660 -prefMapSize 272997 -jsInitHandle 5244 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 6832 -initialChannelId {fe0e5e2c-455e-4b76-bfbe-e655ad823a49} -parentPid 6188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 136.0 Modules
| |||||||||||||||
4088 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5824 -prefsLen 39869 -prefMapHandle 7440 -prefMapSize 272997 -jsInitHandle 6536 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 6940 -initialChannelId {e05c29bc-c122-4f16-a203-ccadaa39124a} -parentPid 6188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 41 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 136.0 Modules
| |||||||||||||||
4104 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4808 -prefsLen 39068 -prefMapHandle 4864 -prefMapSize 272997 -jsInitHandle 4868 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 4332 -initialChannelId {b9d1d219-4ffe-4f23-b949-0181649a7816} -parentPid 6188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 136.0 Modules
| |||||||||||||||
4312 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
5644 | "C:\Program Files\Mozilla Firefox\firefox.exe" "https://addons.mozilla.org/en-US/firefox/addon/veepn-free-fast-security-vpn/?utm_content=search&utm_medium=referral&utm_source=addons.mozilla.org" | C:\Program Files\Mozilla Firefox\firefox.exe | — | explorer.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 136.0 Modules
| |||||||||||||||
5848 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6012 -prefsLen 39869 -prefMapHandle 6328 -prefMapSize 272997 -jsInitHandle 6372 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 4272 -initialChannelId {23fd825c-18f3-4497-abbe-bafeb01c0c0e} -parentPid 6188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 44 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 136.0 Modules
| |||||||||||||||
5884 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2356 -prefsLen 39533 -prefMapHandle 1048 -prefMapSize 272997 -jsInitHandle 912 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 1016 -initialChannelId {b905b8e3-9d20-48b3-9caa-2ce615046ba0} -parentPid 6188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 29 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 136.0 Modules
|
(PID) Process: | (6188) firefox.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment |
Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
6188 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite | — | |
MD5:— | SHA256:— | |||
6188 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
6188 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\urlCache-current.bin | binary | |
MD5:3134ED3F12E4F4F8643DB90043B0FD7B | SHA256:26E4F122034D7A03F6DA0E707799B09CBEEBDAF8D7A3133A1F7BD894AC72EEA1 | |||
6188 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
6188 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.json | binary | |
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A | SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA | |||
6188 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
6188 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs-1.js | text | |
MD5:DC7FBEF3BEE7B4DD631C9AD5BC779B75 | SHA256:B0FD5E5AF28DD7C03623CA62B7449C642E11A337D25C9096AEFECF5B6EA24AEA | |||
6188 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs.js | text | |
MD5:DC7FBEF3BEE7B4DD631C9AD5BC779B75 | SHA256:B0FD5E5AF28DD7C03623CA62B7449C642E11A337D25C9096AEFECF5B6EA24AEA | |||
6188 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\SiteSecurityServiceState.bin | binary | |
MD5:D1CF2470D47B2033487F74D0FAC2D3D4 | SHA256:C89D7DCC0DDFD016DC8B0826ACAAC07F27623A235EB561FA11CECBEC885B54AF | |||
6188 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cookies.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
6188 | firefox.exe | POST | 200 | 2.22.242.225:80 | http://r11.o.lencr.org/ | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 2.23.181.156:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6188 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/canonical.html | unknown | — | — | whitelisted |
6188 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | unknown | — | — | whitelisted |
6188 | firefox.exe | POST | 200 | 2.22.242.225:80 | http://r11.o.lencr.org/ | unknown | — | — | whitelisted |
6748 | SIHClient.exe | GET | 200 | 2.23.181.156:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 23.216.77.29:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6748 | SIHClient.exe | GET | 200 | 2.23.181.156:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
6188 | firefox.exe | POST | 200 | 142.250.186.131:80 | http://o.pki.goog/we2 | unknown | — | — | whitelisted |
6188 | firefox.exe | POST | 200 | 18.245.65.219:80 | http://ocsp.r2m01.amazontrust.com/ | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1268 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
7052 | RUXIMICS.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
6188 | firefox.exe | 34.160.144.191:443 | content-signature-2.cdn.mozilla.net | GOOGLE | US | whitelisted |
6188 | firefox.exe | 151.101.1.91:443 | addons.mozilla.org | FASTLY | US | whitelisted |
6188 | firefox.exe | 34.107.221.82:80 | detectportal.firefox.com | GOOGLE | US | whitelisted |
6188 | firefox.exe | 34.36.137.203:443 | contile.services.mozilla.com | GOOGLE-CLOUD-PLATFORM | US | whitelisted |
6188 | firefox.exe | 142.250.186.131:80 | o.pki.goog | GOOGLE | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
google.com |
| whitelisted |
content-signature-2.cdn.mozilla.net |
| whitelisted |
content-signature-chains.prod.autograph.services.mozaws.net |
| whitelisted |
detectportal.firefox.com |
| whitelisted |
addons.mozilla.org |
| whitelisted |
contile.services.mozilla.com |
| whitelisted |
prod.detectportal.prod.cloudops.mozgcp.net |
| whitelisted |
spocs.getpocket.com |
| whitelisted |
mc.prod.ads.prod.webservices.mozgcp.net |
| whitelisted |
example.org |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | Not Suspicious Traffic | INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com) |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com) |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com) |