| URL: | https://fs.tv96.im |
| Full analysis: | https://app.any.run/tasks/93014946-bd0a-436e-9ae0-70178b86ce7e |
| Verdict: | Malicious activity |
| Analysis date: | August 06, 2024, 15:39:59 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MD5: | 52EA2E232B03D6990069EBFF2B598E7B |
| SHA1: | EB59011E58CE6DE088E49154A98691C8AF1D0284 |
| SHA256: | 68DDF888CDD2D053561CDCDBAF5A10A26EA0F8B14F14C436646E192DBF0C3E28 |
| SSDEEP: | 3:N8giF:27 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 304 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2132 -parentBuildID 20240213221259 -prefsHandle 2124 -prefMapHandle 2120 -prefsLen 19989 -prefMapSize 240426 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {98f4b90e-757f-42d5-b508-d1b48a531f2f} 2080 "\\.\pipe\gecko-crash-server-pipe.2080" 24465a85d10 socket | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 123.0 Modules
| |||||||||||||||
| 1344 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5488 -childID 5 -isForBrowser -prefsHandle 3648 -prefMapHandle 2732 -prefsLen 28947 -prefMapSize 240426 -jsInitHandle 1216 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e077045-3c1d-490c-8ac2-8aff355dcc58} 2080 "\\.\pipe\gecko-crash-server-pipe.2080" 2447b6d0690 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 123.0 Modules
| |||||||||||||||
| 1656 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5712 -childID 6 -isForBrowser -prefsHandle 5924 -prefMapHandle 5928 -prefsLen 31161 -prefMapSize 244343 -jsInitHandle 1208 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0370ffb-bf73-4627-a864-eab28cf7afce} 6376 "\\.\pipe\gecko-crash-server-pipe.6376" 2af91bcc150 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 123.0 Modules
| |||||||||||||||
| 1884 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5724 -childID 9 -isForBrowser -prefsHandle 5620 -prefMapHandle 5612 -prefsLen 29214 -prefMapSize 240426 -jsInitHandle 1216 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d65d817-cb6c-42d6-989a-67fb8d7f9edb} 2080 "\\.\pipe\gecko-crash-server-pipe.2080" 24479abfa10 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 123.0 Modules
| |||||||||||||||
| 2080 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 123.0 Modules
| |||||||||||||||
| 2932 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6740 -childID 11 -isForBrowser -prefsHandle 6860 -prefMapHandle 7068 -prefsLen 29214 -prefMapSize 240426 -jsInitHandle 1216 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {91fa740c-6232-4965-95bf-3a06b313290b} 2080 "\\.\pipe\gecko-crash-server-pipe.2080" 24479abf690 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 123.0 Modules
| |||||||||||||||
| 3032 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7072 -childID 10 -isForBrowser -prefsHandle 6592 -prefMapHandle 7076 -prefsLen 29214 -prefMapSize 240426 -jsInitHandle 1216 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1663b1bf-54fa-4894-8e2d-9099dc1c35af} 2080 "\\.\pipe\gecko-crash-server-pipe.2080" 2447768e310 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 123.0 Modules
| |||||||||||||||
| 3692 | "C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mca | C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Version: 123.26505.0.0 Modules
| |||||||||||||||
| 3864 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6468 -childID 7 -isForBrowser -prefsHandle 6544 -prefMapHandle 6540 -prefsLen 31161 -prefMapSize 244343 -jsInitHandle 1208 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb41bdc1-6f9e-4b19-92c1-971fa27e9da3} 6376 "\\.\pipe\gecko-crash-server-pipe.6376" 2af8efee150 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 123.0 Modules
| |||||||||||||||
| 4436 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6848 -childID 8 -isForBrowser -prefsHandle 5944 -prefMapHandle 5700 -prefsLen 31161 -prefMapSize 244343 -jsInitHandle 1208 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {82d03c0e-d24c-4276-a4e1-8c50cf1afa18} 6376 "\\.\pipe\gecko-crash-server-pipe.6376" 2af913d0a10 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 123.0 Modules
| |||||||||||||||
| (PID) Process: | (6344) firefox.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Launcher |
Value: 1AC802C800000000 | |||
| (PID) Process: | (6376) firefox.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Browser |
Value: B43B04C800000000 | |||
| (PID) Process: | (6376) firefox.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\PreXULSkeletonUISettings |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Progress |
Value: 0 | |||
| (PID) Process: | (6376) firefox.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\PreXULSkeletonUISettings |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Progress |
Value: 1 | |||
| (PID) Process: | (6376) firefox.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\Installer\308046B0AF4A39CB |
| Operation: | delete value | Name: | installer.taskbarpin.win10.enabled |
Value: | |||
| (PID) Process: | (6376) firefox.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry |
Value: 0 | |||
| (PID) Process: | (6376) firefox.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe |
Value: 0 | |||
| (PID) Process: | (6376) firefox.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\PreXULSkeletonUISettings |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Theme |
Value: 1 | |||
| (PID) Process: | (6376) firefox.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\PreXULSkeletonUISettings |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Enabled |
Value: 1 | |||
| (PID) Process: | (6376) firefox.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableTelemetry |
Value: 1 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6376 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\urlCache-current.bin | binary | |
MD5:297E88D7CEB26E549254EC875649F4EB | SHA256:8B75D4FB1845BAA06122888D11F6B65E6A36B140C54A72CC13DF390FD7C95702 | |||
| 6376 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite | — | |
MD5:— | SHA256:— | |||
| 6376 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs-1.js | text | |
MD5:918F2779FA9E4B0CC641CE5F86FB47BC | SHA256:F7270816800346410E17D0EFF669A086E54E6E3E982313FAA251FC305D8FB49D | |||
| 6376 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cookies.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 6376 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.json | binary | |
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A | SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA | |||
| 6376 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.json.tmp | binary | |
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A | SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA | |||
| 6376 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 6376 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 6376 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs.js | text | |
MD5:918F2779FA9E4B0CC641CE5F86FB47BC | SHA256:F7270816800346410E17D0EFF669A086E54E6E3E982313FAA251FC305D8FB49D | |||
| 6376 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\SiteSecurityServiceState.bin | binary | |
MD5:9A0BD58F78BE82447DA66E206DAF8A61 | SHA256:C17481B82EEF0671EC543474318AF62D38A3D6C8EB4809FC09BC91B188BD76CB | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6376 | firefox.exe | POST | 200 | 142.250.186.67:80 | http://o.pki.goog/wr2 | US | binary | 471 b | unknown |
6376 | firefox.exe | POST | 200 | 142.250.186.67:80 | http://o.pki.goog/wr2 | US | binary | 471 b | unknown |
6376 | firefox.exe | POST | 200 | 142.250.186.67:80 | http://o.pki.goog/wr2 | US | binary | 471 b | unknown |
6376 | firefox.exe | POST | 200 | 142.250.186.67:80 | http://o.pki.goog/wr2 | US | binary | 471 b | unknown |
6376 | firefox.exe | POST | 200 | 142.250.186.67:80 | http://o.pki.goog/wr2 | US | binary | 471 b | unknown |
6376 | firefox.exe | POST | 200 | 142.250.186.67:80 | http://o.pki.goog/wr2 | US | binary | 471 b | unknown |
6376 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | US | text | 8 b | whitelisted |
6376 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/canonical.html | US | text | 90 b | whitelisted |
6376 | firefox.exe | POST | 200 | 95.100.146.66:80 | http://r10.o.lencr.org/ | CZ | binary | 504 b | unknown |
6376 | firefox.exe | POST | 200 | 95.100.146.66:80 | http://r10.o.lencr.org/ | CZ | binary | 504 b | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
5112 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
5028 | RUXIMICS.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
2120 | MoUsoCoreWorker.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
3888 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
6376 | firefox.exe | 34.107.221.82:80 | detectportal.firefox.com | GOOGLE | US | whitelisted |
6376 | firefox.exe | 34.117.188.166:443 | contile.services.mozilla.com | — | — | unknown |
6376 | firefox.exe | 172.67.198.235:443 | fs.tv96.im | CLOUDFLARENET | US | unknown |
6376 | firefox.exe | 216.58.206.74:443 | safebrowsing.googleapis.com | — | — | whitelisted |
6376 | firefox.exe | 34.160.144.191:443 | content-signature-2.cdn.mozilla.net | GOOGLE | US | unknown |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| unknown |
detectportal.firefox.com |
| whitelisted |
fs.tv96.im |
| unknown |
prod.detectportal.prod.cloudops.mozgcp.net |
| whitelisted |
example.org |
| whitelisted |
ipv4only.arpa |
| whitelisted |
contile.services.mozilla.com |
| whitelisted |
spocs.getpocket.com |
| whitelisted |
prod.ads.prod.webservices.mozgcp.net |
| unknown |