File name:

VVSNI_SearchBar_PopupBlockInst.exe

Full analysis: https://app.any.run/tasks/7c89752d-e02e-450a-b035-9868e6ce13e0
Verdict: Malicious activity
Analysis date: June 07, 2024, 16:49:01
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
websocket
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

6D21E5710CE3D0CEECFD415110D5CE52

SHA1:

F99754A72B7E0195A52234EBF0CF118FAC6E0EC4

SHA256:

1D1DF0AA7C7A187565BACBE7573A5C93EBEBFEA49446F05BE9DC84FDB2A28D92

SSDEEP:

3072:fhiO34WkCTfj7T0Eqx/esKRiOCk9Tane2aVVVVVVVVVVjs:fhiO34vCfnT0EqxWs+DH9TOaVVVVVVVO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • VVSNI_SearchBar_PopupBlockInst.exe (PID: 5036)

    • Changes the autorun value in the registry

      • VVSN.exe (PID: 3244)

    • Scans artifacts that could help determine the target

      • VVSN.exe (PID: 3244)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • VVSNI_SearchBar_PopupBlockInst.exe (PID: 5036)

    • Reads security settings of Internet Explorer

      • VVSNI_SearchBar_PopupBlockInst.exe (PID: 5036)
      • VVSN.exe (PID: 3244)
      • TextInputHost.exe (PID: 4544)

    • Reads the date of Windows installation

      • VVSNI_SearchBar_PopupBlockInst.exe (PID: 5036)

    • The process executes via Task Scheduler

      • default-browser-agent.exe (PID: 6888)

  • INFO

    • Checks supported languages

      • VVSNI_SearchBar_PopupBlockInst.exe (PID: 5036)
      • VVSN.exe (PID: 3244)
      • TextInputHost.exe (PID: 4544)
      • default-browser-agent.exe (PID: 6888)

    • Application launched itself

      • firefox.exe (PID: 4920)
      • firefox.exe (PID: 6908)
      • firefox.exe (PID: 1016)

    • Creates files in the program directory

      • VVSNI_SearchBar_PopupBlockInst.exe (PID: 5036)
      • VVSN.exe (PID: 3244)

    • Create files in a temporary directory

      • VVSNI_SearchBar_PopupBlockInst.exe (PID: 5036)

    • Reads the computer name

      • VVSNI_SearchBar_PopupBlockInst.exe (PID: 5036)
      • VVSN.exe (PID: 3244)
      • TextInputHost.exe (PID: 4544)

    • Process checks computer location settings

      • VVSNI_SearchBar_PopupBlockInst.exe (PID: 5036)

    • Reads Microsoft Office registry keys

      • firefox.exe (PID: 4920)
      • firefox.exe (PID: 6928)

    • Manual execution by a user

      • firefox.exe (PID: 1016)

    • Checks proxy server information

      • VVSN.exe (PID: 3244)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2004:11:05 23:25:33+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 7.1
CodeSize: 32256
InitializedDataSize: 68096
UninitializedDataSize: -
EntryPoint: 0x7ac1
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.1.2
ProductVersionNumber: 1.0.1.2
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: WhenU.com, Inc
FileDescription: UInstall Application
FileVersion: 1, 0, 1, 2
InternalName: UInstall
LegalCopyright: Copyright (C) 2003
OriginalFileName: UInstall.exe
ProductName: Universal Installer
ProductVersion: 1, 0, 1, 2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
122
Monitored processes
18
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start vvsni_searchbar_popupblockinst.exe vvsn.exe firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs textinputhost.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs default-browser-agent.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs vvsni_searchbar_popupblockinst.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1016"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\program files\mozilla firefox\vcruntime140_1.dll
c:\program files\mozilla firefox\vcruntime140.dll
1864"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1908 -parentBuildID 20240213221259 -prefsHandle 1848 -prefMapHandle 1840 -prefsLen 30537 -prefMapSize 244343 -appDir "C:\Program Files\Mozilla Firefox\browser" - {acad732c-acf5-46df-8321-18e6e326b7e8} 4920 "\\.\pipe\gecko-crash-server-pipe.4920" 1bb9e5eb310 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
1
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
3244"C:\Program Files (x86)\VVSN\VVSN.exe" /cfg:TEST120412C:\Program Files (x86)\VVSN\VVSN.exe
VVSNI_SearchBar_PopupBlockInst.exe
User:
admin
Company:
WhenU.com
Integrity Level:
HIGH
Description:
VVSN
Version:
1, 0, 1, 5
Modules
Images
c:\program files (x86)\vvsn\vvsn.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
3740"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2952 -childID 1 -isForBrowser -prefsHandle 2944 -prefMapHandle 2940 -prefsLen 30953 -prefMapSize 244343 -jsInitHandle 1296 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {01670102-e631-4dcf-9b36-8550b186a92e} 4920 "\\.\pipe\gecko-crash-server-pipe.4920" 1bba3f69150 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
4128"C:\Users\admin\Desktop\VVSNI_SearchBar_PopupBlockInst.exe" C:\Users\admin\Desktop\VVSNI_SearchBar_PopupBlockInst.exe—explorer.exe
User:
admin
Company:
WhenU.com, Inc
Integrity Level:
MEDIUM
Description:
UInstall Application
Exit code:
3221226540
Version:
1, 0, 1, 2
Modules
Images
c:\users\admin\desktop\vvsni_searchbar_popupblockinst.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4544"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Version:
123.26505.0.0
Modules
Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
4920"C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
5036"C:\Users\admin\Desktop\VVSNI_SearchBar_PopupBlockInst.exe" C:\Users\admin\Desktop\VVSNI_SearchBar_PopupBlockInst.exe
explorer.exe
User:
admin
Company:
WhenU.com, Inc
Integrity Level:
HIGH
Description:
UInstall Application
Exit code:
0
Version:
1, 0, 1, 2
Modules
Images
c:\users\admin\desktop\vvsni_searchbar_popupblockinst.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
5800"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2288 -parentBuildID 20240213221259 -prefsHandle 2284 -prefMapHandle 2272 -prefsLen 30537 -prefMapSize 244343 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2928ac05-7dd4-4bbb-8cd8-63e610e861f0} 4920 "\\.\pipe\gecko-crash-server-pipe.4920" 1bb91b82910 socketC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
6244"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2776 -childID 2 -isForBrowser -prefsHandle 4612 -prefMapHandle 4608 -prefsLen 36263 -prefMapSize 244343 -jsInitHandle 1296 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {404fb3ce-5dcf-43ad-ac6a-0907d824fcff} 4920 "\\.\pipe\gecko-crash-server-pipe.4920" 1bba5751bd0 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
Total events
29 542
Read events
29 388
Write events
148
Delete events
6

Modification events

(PID) Process:(5036) VVSNI_SearchBar_PopupBlockInst.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(5036) VVSNI_SearchBar_PopupBlockInst.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(5036) VVSNI_SearchBar_PopupBlockInst.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(5036) VVSNI_SearchBar_PopupBlockInst.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3244) VVSN.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:VVSN
Value:
C:\Program Files (x86)\VVSN\VVSN.exe
(PID) Process:(3244) VVSN.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3244) VVSN.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3244) VVSN.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3244) VVSN.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1016) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Launcher
Value:
357272F300000000
Executable files
4
Suspicious files
157
Text files
49
Unknown types
20

Dropped files

PID
Process
Filename
Type
4920firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs-1.jstext
MD5:7A97B8DBC4F98D175F958C00F463A52A
SHA256:92074D2ED1AA1FD621287E35DB9EF1AE3DC04777EFAE5F09E7A3B4534C201548
5036VVSNI_SearchBar_PopupBlockInst.exeC:\Program Files (x86)\VVSN\SET4BAD.tmpexecutable
MD5:7AD334CA884EC3F530E74A9F65AA31D8
SHA256:DC650CE050E5C46667914A5E458A20168581E187F10157ECF126326D6AC88B8E
4920firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs.jstext
MD5:7A97B8DBC4F98D175F958C00F463A52A
SHA256:92074D2ED1AA1FD621287E35DB9EF1AE3DC04777EFAE5F09E7A3B4534C201548
5036VVSNI_SearchBar_PopupBlockInst.exeC:\Program Files (x86)\VVSN\SET4B8D.tmpexecutable
MD5:7AD334CA884EC3F530E74A9F65AA31D8
SHA256:DC650CE050E5C46667914A5E458A20168581E187F10157ECF126326D6AC88B8E
3244VVSN.exeC:\Program Files (x86)\VVSN\vvsn.cfgtext
MD5:96EEFDD9FFBB4DAF73A87CCF9A1418C4
SHA256:CC62CFCB1BB24C820B58E54BAA02EA1C668B8D89F9BE841601A2702660724F1F
5036VVSNI_SearchBar_PopupBlockInst.exeC:\Program Files (x86)\VVSN\VVSN.exeexecutable
MD5:7AD334CA884EC3F530E74A9F65AA31D8
SHA256:DC650CE050E5C46667914A5E458A20168581E187F10157ECF126326D6AC88B8E
4920firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
5036VVSNI_SearchBar_PopupBlockInst.exeC:\Users\admin\AppData\Local\Temp\13AC.WUT\vvsn.cabcompressed
MD5:F00B92E77BD89312347D8989F656F1B2
SHA256:05302C7569105C23E57744E2AF104D4AEC1F7E96F27BA3380EBCF1C91B88FAB0
4920firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.jsonbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
4920firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
107
TCP/UDP connections
45
DNS requests
103
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4920
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
unknown
—
—
GET
101
34.107.243.93:443
https://push.services.mozilla.com/
unknown
—
—
—
4920
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
unknown
—
—
GET
200
34.160.144.191:443
https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2024-07-20-10-02-57.chain
unknown
—
—
—
—
—
GET
200
34.117.188.166:443
https://contile.services.mozilla.com/v1/tiles
unknown
binary
2.21 Kb
—
—
—
GET
200
216.58.206.42:443
https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=AIzaSyC7jsptDS3am4tPx4r3nxis7IMjBc5Dovo&$httpMethod=POST&$req=ChUKE25hdmNsaWVudC1hdXRvLWZmb3gaJwgFEAEaGwoNCAUQBhgBIgMwMDEwARD31RUaAhgJ1ShmESICIAIoARonCAEQARobCg0IARAGGAEiAzAwMTABEJz_DRoCGAnWZvpiIgIgAigBGicIAxABGhsKDQgDEAYYASIDMDAxMAEQpPYNGgIYCRiY-6YiAiACKAEaJwgHEAEaGwoNCAcQBhgBIgMwMDEwARDLxQ4aAhgJeFtrxyICIAIoARolCAkQARoZCg0ICRAGGAEiAzAwMTABECMaAhgJi9M7nSICIAIoAQ==
unknown
binary
8.23 Mb
—
—
—
GET
200
34.149.100.209:443
https://firefox.settings.services.mozilla.com/v1/buckets/monitor/collections/changes/changeset?_expected=0
unknown
binary
26.4 Kb
—
—
—
GET
200
188.114.96.3:443
https://tip.neiki.dev/
unknown
html
976 b
—
—
—
GET
200
34.149.100.209:443
https://firefox.settings.services.mozilla.com/v1/buckets/blocklists/collections/addons-bloomfilters/changeset?_expected=1717094162111&_since=%221706272559513%22
unknown
binary
23.4 Kb
—
—
—
GET
200
188.114.96.3:443
https://tip.neiki.dev/assets/index-CVgQL23B.js
unknown
binary
636 Kb
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4920
firefox.exe
34.107.221.82:80
detectportal.firefox.com
GOOGLE
US
whitelisted
4920
firefox.exe
34.117.188.166:443
contile.services.mozilla.com
GOOGLE-CLOUD-PLATFORM
US
unknown
4920
firefox.exe
34.160.144.191:443
content-signature-2.cdn.mozilla.net
GOOGLE
US
unknown
4920
firefox.exe
34.107.243.93:443
push.services.mozilla.com
GOOGLE
US
unknown
4920
firefox.exe
216.58.212.138:443
safebrowsing.googleapis.com
GOOGLE
US
whitelisted
4920
firefox.exe
34.149.100.209:443
firefox.settings.services.mozilla.com
GOOGLE
US
unknown
4920
firefox.exe
172.217.18.4:443
www.google.com
GOOGLE
US
whitelisted
4920
firefox.exe
188.114.97.3:443
tip.neiki.dev
CLOUDFLARENET
NL
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
app.whenu.com
  • —
unknown
spweb.whenu.com
  • —
unknown
detectportal.firefox.com
  • 34.107.221.82
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
contile.services.mozilla.com
  • 34.117.188.166
whitelisted
spocs.getpocket.com
  • 34.117.188.166
shared
prod.ads.prod.webservices.mozgcp.net
  • 34.117.188.166
unknown
content-signature-2.cdn.mozilla.net
  • 34.160.144.191
whitelisted
prod.content-signature-chains.prod.webservices.mozgcp.net
  • 34.160.144.191
  • 2600:1901:0:92a9::
whitelisted
push.services.mozilla.com
  • 34.107.243.93
whitelisted

Threats

PID
Process
Class
Message
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Websocket Upgrade Request
—
—
Generic Protocol Command Decode
SURICATA HTTP Request abnormal Content-Encoding header
—
—
Generic Protocol Command Decode
SURICATA HTTP Request abnormal Content-Encoding header
—
—
Generic Protocol Command Decode
SURICATA HTTP Request abnormal Content-Encoding header
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Websocket Upgrade Request
—
—
Misc activity
ET INFO Generic HTTP EXE Upload Outbound
—
—
Generic Protocol Command Decode
SURICATA HTTP Request abnormal Content-Encoding header
—
—
Generic Protocol Command Decode
SURICATA HTTP Request abnormal Content-Encoding header
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
VVSNI_SearchBar_PopupBlockInst.exe