| URL: | http://fastflix.cc/home |
| Full analysis: | https://app.any.run/tasks/b6f4dd3e-89bb-4b74-8a8c-bdbd67571439 |
| Verdict: | Malicious activity |
| Analysis date: | July 25, 2025, 12:40:20 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Indicators: | |
| MD5: | 24C01CA8DED03DBD7735606C4D6C4C8A |
| SHA1: | A88648E4D3B9DCB6FBC62032652A8BE253B216E6 |
| SHA256: | 534DAB3E7A0E4BE44299233A1EA93491111CB7879A7FB05D56E01B7D393D8B88 |
| SSDEEP: | 3:N1KYZmIGaA:CYa |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 512 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250227124745 -sandboxingKind 0 -prefsHandle 4512 -prefsLen 44905 -prefMapHandle 2972 -prefMapSize 272997 -ipcHandle 4516 -initialChannelId {e126eb50-77d3-4b07-b406-9d67ead3d57a} -parentPid 6508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 136.0 Modules
| |||||||||||||||
| 1068 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250227124745 -sandboxingKind 1 -prefsHandle 6640 -prefsLen 45355 -prefMapHandle 7088 -prefMapSize 272997 -ipcHandle 7076 -initialChannelId {0c0a2bc4-a386-4475-872e-3b64b6f0f7f4} -parentPid 6508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 19 utility | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 136.0 Modules
| |||||||||||||||
| 1180 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250227124745 -prefsHandle 3496 -prefsLen 36996 -prefMapHandle 3500 -prefMapSize 272997 -ipcHandle 3504 -initialChannelId {d5dd6b7c-8470-4d9e-b2c3-053b5cfd589d} -parentPid 6508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6508" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 136.0 Modules
| |||||||||||||||
| 1568 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5336 -prefsLen 39714 -prefMapHandle 6692 -prefMapSize 272997 -jsInitHandle 6728 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 7112 -initialChannelId {abcb56d4-e155-4311-9950-39d83a87d9e5} -parentPid 6508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 20 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 136.0 Modules
| |||||||||||||||
| 1800 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5800 -prefsLen 39714 -prefMapHandle 7260 -prefMapSize 272997 -jsInitHandle 5796 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 6596 -initialChannelId {5be6efa0-030f-49d9-b014-313de36f3818} -parentPid 6508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 25 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 136.0 Modules
| |||||||||||||||
| 2200 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2604 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3388 -prefsLen 31090 -prefMapHandle 3392 -prefMapSize 272997 -jsInitHandle 3396 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 3404 -initialChannelId {6b960978-3bcb-4af3-a932-d4127e06409d} -parentPid 6508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 136.0 Modules
| |||||||||||||||
| 3628 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 7164 -prefsLen 39801 -prefMapHandle 7156 -prefMapSize 272997 -jsInitHandle 6904 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 6840 -initialChannelId {f91bc190-44ae-43d4-9de7-e87f15112c68} -parentPid 6508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 28 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 136.0 Modules
| |||||||||||||||
| 3688 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5148 -prefsLen 39672 -prefMapHandle 5584 -prefMapSize 272997 -jsInitHandle 5572 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 5128 -initialChannelId {ba22335a-14f9-429b-943e-5edad6318f0a} -parentPid 6508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 136.0 Modules
| |||||||||||||||
| 3732 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5956 -prefsLen 39672 -prefMapHandle 5984 -prefMapSize 272997 -jsInitHandle 5532 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 5404 -initialChannelId {880145aa-93fd-4a08-bd20-bde036252ce4} -parentPid 6508 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6508" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 15 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 136.0 Modules
| |||||||||||||||
| (PID) Process: | (6508) firefox.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe |
Value: 0 | |||
| (PID) Process: | (6508) firefox.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-790078335-998561069-2208156648-988539944-4021756109-3505228477-4058360096 |
| Operation: | write | Name: | DisplayName |
Value: Chrome Sandbox | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6508 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite | — | |
MD5:— | SHA256:— | |||
| 6508 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\datareporting\glean\db\data.safe.bin | dbf | |
MD5:E3FC1A783723F57DD176551BA95A2197 | SHA256:5961DB5898EF50EFAEB4C9D59D2033EA908DD47362214D5DD1CCBD4BAFC11F76 | |||
| 6508 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 6508 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs.js | text | |
MD5:2FD670934FEF0C60E2119BD874AAF470 | SHA256:771A7C83CA015BDBC6AB86A7BD9B1D54E40062E28942D311A9178A0FE6433CF2 | |||
| 6508 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\urlCache-current.bin | binary | |
MD5:3134ED3F12E4F4F8643DB90043B0FD7B | SHA256:26E4F122034D7A03F6DA0E707799B09CBEEBDAF8D7A3133A1F7BD894AC72EEA1 | |||
| 6508 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.json | binary | |
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A | SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA | |||
| 6508 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal | binary | |
MD5:0123476553705A0BCC12F35E4A7821B0 | SHA256:CDF2A26C7E83CF5F61AF34C864A681924447ADA3804923AF02EFCF43A4395337 | |||
| 6508 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 6508 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\SiteSecurityServiceState.bin | binary | |
MD5:D3451CB59E934F17B7D1A2A4B9CBBFFC | SHA256:1F52A333B7D3B8460135F8D418A225A2A65A2CFD7B52295D81A668D7E5BB5BED | |||
| 6508 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cookies.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6508 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | unknown | — | — | whitelisted |
6508 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/canonical.html | unknown | — | — | whitelisted |
6508 | firefox.exe | POST | 200 | 142.250.181.227:80 | http://o.pki.goog/we2 | unknown | — | — | whitelisted |
6508 | firefox.exe | POST | 200 | 142.250.181.227:80 | http://o.pki.goog/s/wr3/k58 | unknown | — | — | whitelisted |
6508 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | unknown | — | — | whitelisted |
6508 | firefox.exe | POST | 200 | 142.250.181.227:80 | http://o.pki.goog/s/wr3/azY | unknown | — | — | whitelisted |
6508 | firefox.exe | POST | 200 | 142.250.181.227:80 | http://o.pki.goog/s/wr3/azY | unknown | — | — | whitelisted |
6508 | firefox.exe | POST | 200 | 142.250.181.227:80 | http://o.pki.goog/s/wr3/azY | unknown | — | — | whitelisted |
6508 | firefox.exe | POST | 200 | 142.250.181.227:80 | http://o.pki.goog/we2 | unknown | — | — | whitelisted |
6508 | firefox.exe | POST | 200 | 142.250.181.227:80 | http://o.pki.goog/we2 | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
5944 | MoUsoCoreWorker.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1268 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3628 | RUXIMICS.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6508 | firefox.exe | 34.160.144.191:443 | content-signature-2.cdn.mozilla.net | GOOGLE | US | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
6508 | firefox.exe | 104.21.59.155:443 | fastflix.cc | CLOUDFLARENET | — | unknown |
6508 | firefox.exe | 34.107.221.82:80 | detectportal.firefox.com | GOOGLE | US | whitelisted |
6508 | firefox.exe | 34.36.137.203:443 | contile.services.mozilla.com | GOOGLE-CLOUD-PLATFORM | US | whitelisted |
6508 | firefox.exe | 142.250.181.227:80 | o.pki.goog | GOOGLE | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
content-signature-2.cdn.mozilla.net |
| whitelisted |
content-signature-chains.prod.autograph.services.mozaws.net |
| whitelisted |
fastflix.cc |
| unknown |
detectportal.firefox.com |
| whitelisted |
prod.detectportal.prod.cloudops.mozgcp.net |
| whitelisted |
contile.services.mozilla.com |
| whitelisted |
spocs.getpocket.com |
| whitelisted |
mc.prod.ads.prod.webservices.mozgcp.net |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
2200 | svchost.exe | Potentially Bad Traffic | ET DNS Query for .cc TLD |
2200 | svchost.exe | Potentially Bad Traffic | ET DNS Query for .cc TLD |
2200 | svchost.exe | Potentially Bad Traffic | ET DNS Query for .cc TLD |
2200 | svchost.exe | Not Suspicious Traffic | INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com) |
2200 | svchost.exe | Not Suspicious Traffic | INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com) |
2200 | svchost.exe | Not Suspicious Traffic | INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com) |
2200 | svchost.exe | Not Suspicious Traffic | INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com) |
2200 | svchost.exe | Not Suspicious Traffic | INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com) |
2200 | svchost.exe | Not Suspicious Traffic | INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com) |
2200 | svchost.exe | Potentially Bad Traffic | SUSPICIOUS [ANY.RUN] Suspected Malicious domain by CrossDomain (extsoft .info) |