URL:

https://rentry.co/sdbycywegfhgywf

Full analysis: https://app.any.run/tasks/a0ef28ba-208f-485a-b2dd-f6a0f9ff8b5e
Verdict: Malicious activity
Threats:

HijackLoader is a modular malware acting as a vehicle for distributing different types of malicious software on compromised systems. It gained prominence during the summer of 2023 and has since been used in multiple attacks against organizations from various sectors, including hospitality businesses.

Malware Trends Tracker     >>>
Analysis date: July 19, 2024, 16:58:04
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
hijackloader
loader
lumma
crypto-regex
Indicators:
MD5:

7D3C931A4DD96F2A9957C08AE19AC38B

SHA1:

EC8CEEF538F709B8EFE522A91D1F4499B0599673

SHA256:

3ADE99D234D48F854ADBC5536A486E61999B0DA75772458AD25FAF0B9DCE7DDD

SSDEEP:

3:N8ZTX1o:2Zbq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Setup.exe (PID: 8252)
      • more.com (PID: 8288)
      • PeLoadDrv.exe (PID: 8188)
      • cmd.exe (PID: 5896)

    • HIJACKLOADER has been detected (YARA)

      • more.com (PID: 8288)
      • PeLoadDrv.exe (PID: 8188)
      • cmd.exe (PID: 5896)
      • updater.exe (PID: 10200)

    • LUMMA has been detected (YARA)

      • more.com (PID: 8288)
      • PeLoadDrv.exe (PID: 8188)

    • Actions looks like stealing of personal data

      • PeLoadDrv.exe (PID: 8188)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6088)

    • Application launched itself

      • WinRAR.exe (PID: 6088)
      • Taskmgr.exe (PID: 7456)

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 8468)

    • Executable content was dropped or overwritten

      • Setup.exe (PID: 8252)
      • more.com (PID: 8288)
      • PeLoadDrv.exe (PID: 8188)
      • cmd.exe (PID: 5896)

    • Starts application with an unusual extension

      • Setup.exe (PID: 8252)

    • Searches for installed software

      • PeLoadDrv.exe (PID: 8188)

    • Starts CMD.EXE for commands execution

      • 8MK5WDSN2J481UUN.exe (PID: 4972)

    • The executable file from the user directory is run by the CMD process

      • updater.exe (PID: 10200)

    • Executes application which crashes

      • PeLoadDrv.exe (PID: 8188)

    • Found regular expressions for crypto-addresses (YARA)

      • updater.exe (PID: 10200)

  • INFO

    • The process uses the downloaded file

      • firefox.exe (PID: 7612)
      • WinRAR.exe (PID: 6088)

    • Application launched itself

      • firefox.exe (PID: 7628)
      • firefox.exe (PID: 7612)

    • Reads Microsoft Office registry keys

      • firefox.exe (PID: 7612)

    • Manual execution by a user

      • WinRAR.exe (PID: 6088)
      • Taskmgr.exe (PID: 6196)
      • Taskmgr.exe (PID: 7456)
      • Setup.exe (PID: 8252)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 8468)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 7456)
      • Taskmgr.exe (PID: 9864)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 8468)

    • Checks supported languages

      • Setup.exe (PID: 8252)
      • more.com (PID: 8288)
      • PeLoadDrv.exe (PID: 8188)
      • 8MK5WDSN2J481UUN.exe (PID: 4972)
      • updater.exe (PID: 10200)

    • Reads the computer name

      • Setup.exe (PID: 8252)
      • PeLoadDrv.exe (PID: 8188)
      • more.com (PID: 8288)
      • 8MK5WDSN2J481UUN.exe (PID: 4972)
      • updater.exe (PID: 10200)

    • Creates files or folders in the user directory

      • Setup.exe (PID: 8252)
      • WerFault.exe (PID: 7764)

    • Create files in a temporary directory

      • Setup.exe (PID: 8252)
      • PeLoadDrv.exe (PID: 8188)
      • more.com (PID: 8288)
      • 8MK5WDSN2J481UUN.exe (PID: 4972)

    • Reads the software policy settings

      • PeLoadDrv.exe (PID: 8188)

    • Creates files in the program directory

      • updater.exe (PID: 10200)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Lumma

(PID) Process(8288) more.com
C2 (9)rightruesx.shop
upknittsoappz.shop
callosallsaospz.shop
outpointsozp.shop
shepherdlyopzc.shop
unseaffarignsk.shop
indexterityszcoxp.shop
liernessfornicsa.shop
lariatedzugspd.shop
(PID) Process(8188) PeLoadDrv.exe
C2 (9)rightruesx.shop
upknittsoappz.shop
callosallsaospz.shop
outpointsozp.shop
shepherdlyopzc.shop
unseaffarignsk.shop
indexterityszcoxp.shop
liernessfornicsa.shop
lariatedzugspd.shop
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
194
Monitored processes
47
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs rundll32.exe no specs winrar.exe no specs winrar.exe taskmgr.exe no specs taskmgr.exe taskmgr.exe no specs setup.exe #LUMMA more.com conhost.exe no specs #LUMMA peloaddrv.exe 8mk5wdsn2j481uun.exe no specs werfault.exe no specs #HIJACKLOADER cmd.exe conhost.exe no specs THREAT updater.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1940"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5668 -childID 3 -isForBrowser -prefsHandle 5684 -prefMapHandle 5680 -prefsLen 31169 -prefMapSize 244343 -jsInitHandle 1428 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4fdf1301-2e71-4ca0-8503-3cbc126a2fe8} 7612 "\\.\pipe\gecko-crash-server-pipe.7612" 2236e0904d0 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
2632"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3012 -childID 1 -isForBrowser -prefsHandle 3004 -prefMapHandle 3000 -prefsLen 26706 -prefMapSize 244343 -jsInitHandle 1428 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {16afb681-211c-414b-94f9-af6d01767164} 7612 "\\.\pipe\gecko-crash-server-pipe.7612" 2236b562150 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
3108"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5380 -parentBuildID 20240213221259 -sandboxingKind 0 -prefsHandle 5388 -prefMapHandle 5356 -prefsLen 36339 -prefMapSize 244343 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f685843b-57d1-41fa-bff7-aa4de428e1e6} 7612 "\\.\pipe\gecko-crash-server-pipe.7612" 2236f37dd10 utilityC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
3536\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4020"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4608 -childID 2 -isForBrowser -prefsHandle 4600 -prefMapHandle 4596 -prefsLen 36263 -prefMapSize 244343 -jsInitHandle 1428 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c7dbced3-522b-49b4-a9cb-c5388bdc9c32} 7612 "\\.\pipe\gecko-crash-server-pipe.7612" 2236d681d90 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
4492"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6304 -childID 6 -isForBrowser -prefsHandle 6228 -prefMapHandle 6232 -prefsLen 34789 -prefMapSize 244343 -jsInitHandle 1428 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd953da4-72f1-490e-95f8-77b3a131880e} 7612 "\\.\pipe\gecko-crash-server-pipe.7612" 223702edd90 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
4972"C:\Users\admin\AppData\Local\Temp\8MK5WDSN2J481UUN.exe"C:\Users\admin\AppData\Local\Temp\8MK5WDSN2J481UUN.exe—PeLoadDrv.exe
User:
admin
Company:
GameHitZone.com
Integrity Level:
HIGH
Description:
Alien Strike
Exit code:
1
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\appdata\local\temp\8mk5wdsn2j481uun.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
5312"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8124 -childID 11 -isForBrowser -prefsHandle 8132 -prefMapHandle 8136 -prefsLen 31161 -prefMapSize 244343 -jsInitHandle 1428 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {89b0f70a-e452-4587-b1c2-ef380e22ba79} 7612 "\\.\pipe\gecko-crash-server-pipe.7612" 223761c0850 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
5400"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1896 -parentBuildID 20240213221259 -prefsHandle 1812 -prefMapHandle 1800 -prefsLen 30537 -prefMapSize 244343 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e25971f-9a7d-429e-9ee4-f2e1302064e7} 7612 "\\.\pipe\gecko-crash-server-pipe.7612" 22365be7810 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
1
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
5864"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6112 -childID 5 -isForBrowser -prefsHandle 5940 -prefMapHandle 5936 -prefsLen 31169 -prefMapSize 244343 -jsInitHandle 1428 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5bd3567d-67b3-40a0-95cf-091408439e44} 7612 "\\.\pipe\gecko-crash-server-pipe.7612" 223702edbd0 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
Total events
52 482
Read events
52 339
Write events
131
Delete events
12

Modification events

(PID) Process:(7628) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Launcher
Value:
882125A303000000
(PID) Process:(7612) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Browser
Value:
D0C826A303000000
(PID) Process:(7612) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\PreXULSkeletonUISettings
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Progress
Value:
0
(PID) Process:(7612) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\PreXULSkeletonUISettings
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Progress
Value:
1
(PID) Process:(7612) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\Installer\308046B0AF4A39CB
Operation:delete valueName:installer.taskbarpin.win10.enabled
Value:
(PID) Process:(7612) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry
Value:
0
(PID) Process:(7612) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
0
(PID) Process:(7612) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\PreXULSkeletonUISettings
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Theme
Value:
1
(PID) Process:(7612) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|DisableTelemetry
Value:
1
(PID) Process:(7612) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|DisableDefaultBrowserAgent
Value:
0
Executable files
13
Suspicious files
204
Text files
23
Unknown types
9

Dropped files

PID
Process
Filename
Type
7612firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\datareporting\glean\db\data.safe.tmpdbf
MD5:F759EB25271E6A6F0A3500520813E5FE
SHA256:015E515D432DD64FDC9502ABE9C723EEF544E7AF11C36BDFE8B38412597CA1EC
7612firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
7612firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\AlternateServices.binbinary
MD5:417EC60DC493ED996560928BD8D0B5D3
SHA256:F9C8929D71C8DDB876B33BD1351BCD2464DB9FCE79D4A5630474E37D2224E626
7612firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\datareporting\glean\db\data.safe.bindbf
MD5:F759EB25271E6A6F0A3500520813E5FE
SHA256:015E515D432DD64FDC9502ABE9C723EEF544E7AF11C36BDFE8B38412597CA1EC
7612firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite —
MD5:—
SHA256:—
7612firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cert9.db-journalbinary
MD5:382E82290F5625BBDCF5B4760D82AFFC
SHA256:DE8C2A430E415CEA0556F60552A4E28558130052E668EA2B8B02EC7B0468435A
7612firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.json.tmpbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
7612firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\urlCache-current.binbinary
MD5:297E88D7CEB26E549254EC875649F4EB
SHA256:8B75D4FB1845BAA06122888D11F6B65E6A36B140C54A72CC13DF390FD7C95702
7612firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.jsonbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
7612firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
106
TCP/UDP connections
284
DNS requests
484
Threats
18

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7612
firefox.exe
POST
200
104.18.38.233:80
http://ocsp.sectigo.com/
unknown
—
—
—
7612
firefox.exe
POST
200
216.58.206.67:80
http://o.pki.goog/wr2
unknown
—
—
—
7612
firefox.exe
POST
200
192.229.221.95:80
http://ocsp.digicert.com/
unknown
—
—
—
7612
firefox.exe
POST
200
184.24.77.45:80
http://e5.o.lencr.org/
unknown
—
—
—
7612
firefox.exe
POST
200
192.229.221.95:80
http://status.rapidssl.com/
unknown
—
—
—
7612
firefox.exe
POST
—
192.229.221.95:80
http://ocsp.digicert.com/
unknown
—
—
—
7612
firefox.exe
POST
200
192.229.221.95:80
http://ocsp.digicert.com/
unknown
—
—
—
7612
firefox.exe
POST
200
192.229.221.95:80
http://ocsp.digicert.com/
unknown
—
—
—
7612
firefox.exe
POST
200
216.58.206.67:80
http://o.pki.goog/s/wr3/-EA
unknown
—
—
—
7612
firefox.exe
POST
200
192.229.221.95:80
http://ocsp.digicert.com/
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
5620
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4716
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.208.221.206:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
8112
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7856
svchost.exe
4.208.221.206:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
2760
svchost.exe
40.113.103.199:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7612
firefox.exe
34.107.221.82:80
detectportal.firefox.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
login.live.com
  • 20.190.159.75
  • 20.190.159.2
  • 20.190.159.23
  • 20.190.159.4
  • 40.126.31.69
  • 40.126.31.67
  • 20.190.159.71
  • 20.190.159.64
whitelisted
google.com
  • 142.250.185.206
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
rentry.co
  • 172.67.75.40
  • 104.26.2.16
  • 104.26.3.16
  • 2606:4700:20::681a:210
  • 2606:4700:20::681a:310
  • 2606:4700:20::ac43:4b28
unknown
detectportal.firefox.com
  • 34.107.221.82
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
example.org
  • 93.184.215.14
whitelisted
ipv4only.arpa
  • 192.0.0.170
  • 192.0.0.171
whitelisted
contile.services.mozilla.com
  • 34.117.188.166
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO Pastebin Service Domain in DNS Lookup (rentry .co)
—
—
Misc activity
ET INFO Pastebin Service Domain in DNS Lookup (rentry .co)
—
—
Misc activity
ET INFO Pastebin Service Domain in DNS Lookup (rentry .co)
—
—
Misc activity
ET INFO Observed Pastebin Service Domain (rentry .co in TLS SNI)
—
—
Misc activity
ET INFO File Sharing Related Domain in DNS Lookup (mega .nz)
—
—
Misc activity
ET INFO File Sharing Related Domain in DNS Lookup (mega .nz)
—
—
Misc activity
ET INFO File Sharing Related Domain in DNS Lookup (mega .nz)
—
—
Misc activity
ET INFO File Sharing Domain Observed in TLS SNI (mega .nz)
—
—
Misc activity
ET INFO File Sharing Domain Observed in TLS SNI (mega .nz)
—
—
Misc activity
ET INFO Observed DNS Query to Filesharing Service (mega .co .nz)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://rentry.co/sdbycywegfhgywf