URL:

https://mega.nz/file/PU0CxYDD#eOHb1ACa5bogmO7MfnDKam-vqLfmbNsYtpBD-0J-ZKA

Full analysis: https://app.any.run/tasks/3647256b-4f8d-4e7e-8a41-9bbae89d9561
Verdict: Malicious activity
Threats:

HijackLoader is a modular malware acting as a vehicle for distributing different types of malicious software on compromised systems. It gained prominence during the summer of 2023 and has since been used in multiple attacks against organizations from various sectors, including hospitality businesses.

Malware Trends Tracker     >>>
Analysis date: July 19, 2024, 17:54:11
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
hijackloader
loader
lumma
Indicators:
MD5:

7C3D70BB5B94E73207C9878021A3D101

SHA1:

F3F9D4353C803302688E07B56C35998907C940B8

SHA256:

5818FD667E13D52EC3329924C8D356CE1DB4A048680E29C2241B7C72C7D91E85

SSDEEP:

3:N8X/iJVH3QUkmEQH2qbZIIzHCAkVvCr:2KNAUkmEQH2G1zHeqr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Setup.exe (PID: 2708)
      • more.com (PID: 4440)
      • PeLoadDrv.exe (PID: 2788)
      • cmd.exe (PID: 2344)
      • Bush.pif (PID: 5400)

    • HIJACKLOADER has been detected (YARA)

      • more.com (PID: 4440)
      • PeLoadDrv.exe (PID: 2788)

    • LUMMA has been detected (YARA)

      • more.com (PID: 4440)
      • PeLoadDrv.exe (PID: 2788)

    • Antivirus name has been found in the command line (generic signature)

      • findstr.exe (PID: 7096)
      • findstr.exe (PID: 4956)

    • Actions looks like stealing of personal data

      • PeLoadDrv.exe (PID: 2788)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 3944)

    • Create files in the Startup directory

      • cmd.exe (PID: 8044)

  • SUSPICIOUS

    • Application launched itself

      • WinRAR.exe (PID: 1004)
      • Taskmgr.exe (PID: 7816)
      • cmd.exe (PID: 2344)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 1004)
      • JGH1W9JF176UOE5DPF1U8WXHCE.exe (PID: 8112)

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 7864)

    • Executable content was dropped or overwritten

      • Setup.exe (PID: 2708)
      • more.com (PID: 4440)
      • PeLoadDrv.exe (PID: 2788)
      • cmd.exe (PID: 2344)
      • Bush.pif (PID: 5400)

    • Starts application with an unusual extension

      • Setup.exe (PID: 2708)
      • cmd.exe (PID: 2344)

    • Searches for installed software

      • PeLoadDrv.exe (PID: 2788)

    • Executes application which crashes

      • PeLoadDrv.exe (PID: 2788)

    • Starts CMD.EXE for commands execution

      • JGH1W9JF176UOE5DPF1U8WXHCE.exe (PID: 8112)
      • cmd.exe (PID: 2344)

    • Get information on the list of running processes

      • cmd.exe (PID: 2344)

    • Executing commands from ".cmd" file

      • JGH1W9JF176UOE5DPF1U8WXHCE.exe (PID: 8112)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 2344)

    • Drops a file with a rarely used extension (PIF)

      • cmd.exe (PID: 2344)
      • Bush.pif (PID: 5400)

    • Suspicious file concatenation

      • cmd.exe (PID: 1456)

    • The executable file from the user directory is run by the CMD process

      • Bush.pif (PID: 5400)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 2344)

    • Reads the date of Windows installation

      • JGH1W9JF176UOE5DPF1U8WXHCE.exe (PID: 8112)

  • INFO

    • The process uses the downloaded file

      • firefox.exe (PID: 7612)
      • WinRAR.exe (PID: 1004)

    • Application launched itself

      • firefox.exe (PID: 7612)
      • firefox.exe (PID: 7628)

    • Manual execution by a user

      • WinRAR.exe (PID: 1004)
      • Taskmgr.exe (PID: 7076)
      • Taskmgr.exe (PID: 7816)
      • Setup.exe (PID: 2708)
      • cmd.exe (PID: 3944)
      • cmd.exe (PID: 8044)

    • Reads Microsoft Office registry keys

      • firefox.exe (PID: 7612)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7864)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 7864)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 4596)
      • Taskmgr.exe (PID: 7816)

    • Creates files or folders in the user directory

      • Setup.exe (PID: 2708)
      • WerFault.exe (PID: 7092)
      • Bush.pif (PID: 5400)

    • Checks supported languages

      • Setup.exe (PID: 2708)
      • more.com (PID: 4440)
      • PeLoadDrv.exe (PID: 2788)
      • JGH1W9JF176UOE5DPF1U8WXHCE.exe (PID: 8112)
      • Bush.pif (PID: 5400)

    • Reads the computer name

      • Setup.exe (PID: 2708)
      • more.com (PID: 4440)
      • PeLoadDrv.exe (PID: 2788)
      • Bush.pif (PID: 5400)
      • JGH1W9JF176UOE5DPF1U8WXHCE.exe (PID: 8112)

    • Create files in a temporary directory

      • more.com (PID: 4440)
      • Setup.exe (PID: 2708)
      • PeLoadDrv.exe (PID: 2788)
      • JGH1W9JF176UOE5DPF1U8WXHCE.exe (PID: 8112)

    • Reads the software policy settings

      • PeLoadDrv.exe (PID: 2788)

    • Reads mouse settings

      • Bush.pif (PID: 5400)

    • Process checks computer location settings

      • JGH1W9JF176UOE5DPF1U8WXHCE.exe (PID: 8112)

    • Creates files in the program directory

      • Bush.pif (PID: 5400)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Lumma

(PID) Process(4440) more.com
C2 (9)rightruesx.shop
upknittsoappz.shop
callosallsaospz.shop
outpointsozp.shop
shepherdlyopzc.shop
unseaffarignsk.shop
indexterityszcoxp.shop
liernessfornicsa.shop
lariatedzugspd.shop
(PID) Process(2788) PeLoadDrv.exe
C2 (9)rightruesx.shop
upknittsoappz.shop
callosallsaospz.shop
outpointsozp.shop
shepherdlyopzc.shop
unseaffarignsk.shop
indexterityszcoxp.shop
liernessfornicsa.shop
lariatedzugspd.shop
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
184
Monitored processes
41
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs slui.exe no specs rundll32.exe no specs winrar.exe no specs winrar.exe taskmgr.exe no specs taskmgr.exe taskmgr.exe no specs setup.exe #LUMMA more.com conhost.exe no specs #LUMMA peloaddrv.exe jgh1w9jf176uoe5dpf1u8wxhce.exe no specs werfault.exe no specs cmd.exe conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs bush.pif timeout.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe conhost.exe no specs schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1004"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\#!!setUp_KeY_8811_P@s$C0DE!~!%!.rar" C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1348"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5404 -parentBuildID 20240213221259 -sandboxingKind 0 -prefsHandle 1080 -prefMapHandle 2488 -prefsLen 34713 -prefMapSize 244343 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {db289587-b809-4a9f-b3e2-76997c3f2495} 7612 "\\.\pipe\gecko-crash-server-pipe.7612" 23326d9ff10 utilityC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
1
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
1456cmd /c copy /b Compared + Capabilities + Democrat + Carey + Sarah + Default 484309\g C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1956\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2116findstr /V "DEUTSCHCOMEDYCONDITIONSMINDS" Clips C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll
2344"C:\Windows\System32\cmd.exe" /k copy Nerve Nerve.cmd & Nerve.cmd & exitC:\Windows\SysWOW64\cmd.exe
JGH1W9JF176UOE5DPF1U8WXHCE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
9009
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2632"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2964 -childID 1 -isForBrowser -prefsHandle 2960 -prefMapHandle 2956 -prefsLen 26706 -prefMapSize 244343 -jsInitHandle 1460 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {00dedeff-f9bf-4d33-8f25-5b3410a0d423} 7612 "\\.\pipe\gecko-crash-server-pipe.7612" 23322e38150 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
2708"C:\Users\admin\Desktop\#!!Add-setUp_KeY_8811_P@s$C0DE!~!%!\Setup.exe" C:\Users\admin\Desktop\#!!Add-setUp_KeY_8811_P@s$C0DE!~!%!\Setup.exe
explorer.exe
User:
admin
Company:
Florian Heidenreich
Integrity Level:
HIGH
Description:
Mp3tag - the universal Tag editor
Exit code:
1
Version:
3.26.0.0
Modules
Images
c:\users\admin\desktop\#!!add-setup_key_8811_p@s$c0de!~!%!\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2788C:\Users\admin\AppData\Local\Temp\PeLoadDrv.exeC:\Users\admin\AppData\Local\Temp\PeLoadDrv.exe
more.com
User:
admin
Integrity Level:
HIGH
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\temp\qfcyhyigcovkd
c:\windows\syswow64\version.dll
c:\users\admin\appdata\local\temp\peloaddrv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
Lumma
(PID) Process(2788) PeLoadDrv.exe
C2 (9)rightruesx.shop
upknittsoappz.shop
callosallsaospz.shop
outpointsozp.shop
shepherdlyopzc.shop
unseaffarignsk.shop
indexterityszcoxp.shop
liernessfornicsa.shop
lariatedzugspd.shop
Total events
36 452
Read events
36 291
Write events
149
Delete events
12

Modification events

(PID) Process:(7628) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Launcher
Value:
93C7EFA203000000
(PID) Process:(7612) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Browser
Value:
8289F1A203000000
(PID) Process:(7612) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\PreXULSkeletonUISettings
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Progress
Value:
0
(PID) Process:(7612) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\PreXULSkeletonUISettings
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Progress
Value:
1
(PID) Process:(7612) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\Installer\308046B0AF4A39CB
Operation:delete valueName:installer.taskbarpin.win10.enabled
Value:
(PID) Process:(7612) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry
Value:
0
(PID) Process:(7612) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
0
(PID) Process:(7612) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\PreXULSkeletonUISettings
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Theme
Value:
1
(PID) Process:(7612) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|DisableTelemetry
Value:
1
(PID) Process:(7612) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|DisableDefaultBrowserAgent
Value:
0
Executable files
14
Suspicious files
215
Text files
26
Unknown types
10

Dropped files

PID
Process
Filename
Type
7612firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\urlCache-current.binbinary
MD5:297E88D7CEB26E549254EC875649F4EB
SHA256:8B75D4FB1845BAA06122888D11F6B65E6A36B140C54A72CC13DF390FD7C95702
7612firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.json.tmpbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
7612firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
7612firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
7612firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite —
MD5:—
SHA256:—
7612firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs-1.jstext
MD5:7A97B8DBC4F98D175F958C00F463A52A
SHA256:92074D2ED1AA1FD621287E35DB9EF1AE3DC04777EFAE5F09E7A3B4534C201548
7612firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
7612firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
7612firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
7612firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
88
DNS requests
99
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7612
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
7612
firefox.exe
POST
200
216.58.206.67:80
http://o.pki.goog/wr2
unknown
—
—
unknown
7612
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
7612
firefox.exe
POST
200
184.24.77.62:80
http://r10.o.lencr.org/
unknown
—
—
unknown
7612
firefox.exe
POST
200
216.58.206.67:80
http://o.pki.goog/wr2
unknown
—
—
unknown
7612
firefox.exe
POST
200
184.24.77.48:80
http://r3.o.lencr.org/
unknown
—
—
unknown
7612
firefox.exe
POST
200
184.24.77.62:80
http://r10.o.lencr.org/
unknown
—
—
unknown
7612
firefox.exe
POST
200
104.18.38.233:80
http://ocsp.sectigo.com/
unknown
—
—
unknown
7612
firefox.exe
POST
200
104.18.38.233:80
http://ocsp.sectigo.com/
unknown
—
—
unknown
7612
firefox.exe
POST
200
104.18.38.233:80
http://ocsp.sectigo.com/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4716
svchost.exe
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5620
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
7856
svchost.exe
4.208.221.206:443
licensing.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
—
—
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7948
backgroundTaskHost.exe
104.126.37.136:443
www.bing.com
Akamai International B.V.
DE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
7612
firefox.exe
31.216.144.5:443
mega.nz
Datacenter Luxembourg S.A.
LU
unknown
7612
firefox.exe
34.107.221.82:80
detectportal.firefox.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
login.live.com
  • 20.190.160.20
  • 40.126.32.72
  • 40.126.32.68
  • 20.190.160.17
  • 20.190.160.14
  • 20.190.160.22
  • 40.126.32.76
  • 40.126.32.136
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
www.bing.com
  • 104.126.37.136
  • 104.126.37.154
  • 104.126.37.161
  • 104.126.37.144
  • 104.126.37.155
  • 104.126.37.139
  • 104.126.37.128
  • 104.126.37.123
  • 104.126.37.153
whitelisted
google.com
  • 142.250.185.142
whitelisted
mega.nz
  • 31.216.144.5
  • 31.216.145.5
  • 2a0b:e46:1:144::5
  • 2a0b:e46:1:145::5
whitelisted
detectportal.firefox.com
  • 34.107.221.82
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
contile.services.mozilla.com
  • 34.117.188.166
whitelisted
example.org
  • 93.184.215.14
whitelisted
ipv4only.arpa
  • 192.0.0.171
  • 192.0.0.170
whitelisted

Threats

PID
Process
Class
Message
2168
svchost.exe
Misc activity
ET INFO File Sharing Related Domain in DNS Lookup (mega .nz)
2168
svchost.exe
Misc activity
ET INFO File Sharing Related Domain in DNS Lookup (mega .nz)
2168
svchost.exe
Misc activity
ET INFO File Sharing Related Domain in DNS Lookup (mega .nz)
7612
firefox.exe
Misc activity
ET INFO File Sharing Domain Observed in TLS SNI (mega .nz)
7612
firefox.exe
Misc activity
ET INFO File Sharing Domain Observed in TLS SNI (mega .nz)
2168
svchost.exe
Misc activity
ET INFO Observed DNS Query to Filesharing Service (mega .co .nz)
2168
svchost.exe
Misc activity
ET INFO Observed DNS Query to Filesharing Service (mega .co .nz)
2168
svchost.exe
Misc activity
ET INFO Observed DNS Query to Filesharing Service (mega .co .nz)
2168
svchost.exe
Misc activity
ET INFO Observed DNS Query to Filesharing Service (mega .co .nz)
2168
svchost.exe
Misc activity
ET INFO Observed DNS Query to Filesharing Service (mega .co .nz)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://mega.nz/file/PU0CxYDD#eOHb1ACa5bogmO7MfnDKam-vqLfmbNsYtpBD-0J-ZKA