URL:

http://onhax.io

Full analysis: https://app.any.run/tasks/e8a47ac2-86d2-453b-97fe-3f6512412e79
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 21, 2022, 17:22:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
trojan
loader
rat
redline
phishing
evasion
Indicators:
MD5:

6076A26D24D02B391AB4193ED60D0C53

SHA1:

113EF04D8AC60097D19B5F7F88D75BA6ABFB3C75

SHA256:

772C2B507E5BCC80638F83268252100D35317E531424F5AA6880F65A6AD8F31A

SSDEEP:

3:N1KRLALn:C6L

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • win_setup__6213c7fc58a9f.exe (PID: 3108)
      • win_setup__6213c7fc58a9f.exe (PID: 1084)
      • setup_installer.exe (PID: 4020)
      • 6213c7f15efe2_Mon1755c58a115c.exe (PID: 3636)
      • 6213c7712660c_Mon1725defbc8.exe (PID: 1432)
      • 6213c76a1285e_Mon1755345927.exe (PID: 3096)
      • 6213c76b12a09_Mon1791fd34f6.exe (PID: 2516)
      • 6213c76cdec93_Mon171bb9418dd0.exe (PID: 2428)
      • 6213c76c328cf_Mon17b943b10.exe (PID: 1980)
      • 6213c7f2505eb_Mon17e51b4cf5.exe (PID: 3536)
      • 6213c76bcc375_Mon17b69a7f586.exe (PID: 3484)
      • 6213c76fd4de3_Mon17a76f9854e.exe (PID: 3656)
      • 6213c7ee55374_Mon17f0f93fe.exe (PID: 2828)
      • 6213c7f44408a_Mon17beb03de.exe (PID: 3964)
      • setup_install.exe (PID: 2656)
      • 6213c76bcc375_Mon17b69a7f586.exe (PID: 2708)
      • 6213c773d71f0_Mon17447345c.exe (PID: 2520)
      • 6213c76cdec93_Mon171bb9418dd0.exe (PID: 3124)
      • 6213c76fd4de3_Mon17a76f9854e.exe (PID: 1264)
      • 6213c7f15efe2_Mon1755c58a115c.exe (PID: 3172)
      • 241J5.exe (PID: 3496)
      • M07L3.exe (PID: 2204)
      • M07L3.exe (PID: 4048)
      • K6LAA.exe (PID: 3096)
      • JJDM1.exe (PID: 1708)
      • Maeguhutome.exe (PID: 3344)
      • Vipugelesae.exe (PID: 2448)
      • poweroff.exe (PID: 1940)
      • Power Off.exe (PID: 2760)
      • GGH5H.exe (PID: 284)
      • 161.exe (PID: 10896)
      • jg5_5knj.exe (PID: 13028)
      • random.exe (PID: 14044)
      • random.exe (PID: 4292)
      • tapinstall.exe (PID: 11860)
      • tapinstall.exe (PID: 12276)
      • mask_svc.exe (PID: 12396)
      • autosubplayer.exe (PID: 6084)
      • mask_svc.exe (PID: 9528)
      • mask_svc.exe (PID: 6712)

    • Drops executable file immediately after starts

      • setup_installer.exe (PID: 4020)
      • 6213c76fd4de3_Mon17a76f9854e.exe (PID: 3656)
      • poweroff.exe (PID: 1940)
      • poweroff.tmp (PID: 3156)
      • 161.exe (PID: 10896)
      • 161.tmp (PID: 11124)
      • DrvInst.exe (PID: 12680)

    • Executes PowerShell scripts

      • cmd.exe (PID: 3064)
      • cmd.exe (PID: 1336)

    • Loads dropped or rewritten executable

      • setup_install.exe (PID: 2656)
      • 6213c76a1285e_Mon1755345927.exe (PID: 3096)
      • rundll32.exe (PID: 2988)
      • mask_svc.exe (PID: 6712)
      • autosubplayer.exe (PID: 6084)

    • Actions looks like stealing of personal data

      • 6213c76b12a09_Mon1791fd34f6.exe (PID: 2516)
      • 6213c76bcc375_Mon17b69a7f586.exe (PID: 2708)
      • jg5_5knj.exe (PID: 13028)

    • Changes settings of System certificates

      • 6213c76cdec93_Mon171bb9418dd0.exe (PID: 3124)
      • Maeguhutome.exe (PID: 3344)
      • 161.tmp (PID: 11124)
      • tapinstall.exe (PID: 12276)

    • Runs injected code in another process

      • rundll32.exe (PID: 2988)
      • rundll32.exe (PID: 10000)

    • Application was injected by another process

      • svchost.exe (PID: 872)

    • Changes the autorun value in the registry

      • 5(6665____.exe (PID: 2992)
      • DrvInst.exe (PID: 9584)
      • svchost.exe (PID: 872)

    • Steals credentials from Web Browsers

      • 6213c76bcc375_Mon17b69a7f586.exe (PID: 2708)
      • jg5_5knj.exe (PID: 13028)

    • Connects to CnC server

      • 6213c76bcc375_Mon17b69a7f586.exe (PID: 2708)
      • jg5_5knj.exe (PID: 13028)

    • REDLINE was detected

      • 6213c76bcc375_Mon17b69a7f586.exe (PID: 2708)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 2360)
      • WinRAR.exe (PID: 520)
      • setup_install.exe (PID: 2656)
      • setup_installer.exe (PID: 4020)
      • cmd.exe (PID: 2916)
      • 6213c76a1285e_Mon1755345927.exe (PID: 3096)
      • cmd.exe (PID: 2160)
      • cmd.exe (PID: 3064)
      • cmd.exe (PID: 3696)
      • cmd.exe (PID: 1048)
      • cmd.exe (PID: 404)
      • cmd.exe (PID: 3588)
      • 6213c76b12a09_Mon1791fd34f6.exe (PID: 2516)
      • cmd.exe (PID: 3492)
      • cmd.exe (PID: 904)
      • powershell.exe (PID: 3876)
      • cmd.exe (PID: 500)
      • 6213c76bcc375_Mon17b69a7f586.exe (PID: 3484)
      • 6213c76fd4de3_Mon17a76f9854e.exe (PID: 3656)
      • cmd.exe (PID: 1132)
      • cmd.exe (PID: 2196)
      • cmd.exe (PID: 1336)
      • win_setup__6213c7fc58a9f.exe (PID: 3108)
      • cmd.exe (PID: 2808)
      • cmd.exe (PID: 2464)
      • powershell.exe (PID: 3916)
      • 6213c773d71f0_Mon17447345c.exe (PID: 2520)
      • 6213c7ee55374_Mon17f0f93fe.exe (PID: 2828)
      • 6213c7f15efe2_Mon1755c58a115c.exe (PID: 3636)
      • 6213c7712660c_Mon1725defbc8.exe (PID: 1432)
      • 6213c76c328cf_Mon17b943b10.exe (PID: 1980)
      • 6213c76cdec93_Mon171bb9418dd0.exe (PID: 2428)
      • 6213c76fd4de3_Mon17a76f9854e.tmp (PID: 476)
      • 6213c7f2505eb_Mon17e51b4cf5.exe (PID: 3536)
      • 6213c7f44408a_Mon17beb03de.exe (PID: 3964)
      • 6213c76cdec93_Mon171bb9418dd0.exe (PID: 3124)
      • 6213c7f2505eb_Mon17e51b4cf5.tmp (PID: 3848)
      • 6213c76fd4de3_Mon17a76f9854e.exe (PID: 1264)
      • 6213c76fd4de3_Mon17a76f9854e.tmp (PID: 3384)
      • 6213c76bcc375_Mon17b69a7f586.exe (PID: 2708)
      • 241J5.exe (PID: 3496)
      • 6213c7f15efe2_Mon1755c58a115c.exe (PID: 3172)
      • M07L3.exe (PID: 4048)
      • M07L3.exe (PID: 2204)
      • 5(6665____.exe (PID: 2992)
      • K6LAA.exe (PID: 3096)
      • GGH5H.exe (PID: 284)
      • JJDM1.exe (PID: 1708)
      • Vipugelesae.exe (PID: 2448)
      • Maeguhutome.exe (PID: 3344)
      • poweroff.exe (PID: 1940)
      • poweroff.tmp (PID: 3156)
      • Power Off.exe (PID: 2760)
      • cmd.exe (PID: 2728)
      • cmd.exe (PID: 6660)
      • cmd.exe (PID: 8160)
      • cmd.exe (PID: 10748)
      • 161.exe (PID: 10896)
      • 161.tmp (PID: 11124)
      • cmd.exe (PID: 11704)
      • tapinstall.exe (PID: 11860)
      • cmd.exe (PID: 12124)
      • tapinstall.exe (PID: 12276)
      • DrvInst.exe (PID: 12680)
      • cmd.exe (PID: 12876)
      • jg5_5knj.exe (PID: 13028)
      • cmd.exe (PID: 13896)
      • random.exe (PID: 14044)
      • random.exe (PID: 4292)
      • DrvInst.exe (PID: 9584)
      • autosubplayer.exe (PID: 6084)
      • cmd.exe (PID: 12732)
      • mask_svc.exe (PID: 12396)
      • ns12C8.tmp (PID: 7176)
      • powershell.exe (PID: 7720)
      • ns19ED.tmp (PID: 6272)
      • lighteningplayer-cache-gen.exe (PID: 6728)
      • mask_svc.exe (PID: 9528)
      • mask_svc.exe (PID: 6712)

    • Reads the computer name

      • WinRAR.exe (PID: 520)
      • WinRAR.exe (PID: 2360)
      • setup_installer.exe (PID: 4020)
      • powershell.exe (PID: 3876)
      • 6213c76b12a09_Mon1791fd34f6.exe (PID: 2516)
      • 6213c76bcc375_Mon17b69a7f586.exe (PID: 3484)
      • win_setup__6213c7fc58a9f.exe (PID: 3108)
      • powershell.exe (PID: 3916)
      • 6213c773d71f0_Mon17447345c.exe (PID: 2520)
      • 6213c76c328cf_Mon17b943b10.exe (PID: 1980)
      • 6213c76fd4de3_Mon17a76f9854e.tmp (PID: 476)
      • 6213c76cdec93_Mon171bb9418dd0.exe (PID: 2428)
      • 6213c76cdec93_Mon171bb9418dd0.exe (PID: 3124)
      • 6213c7f44408a_Mon17beb03de.exe (PID: 3964)
      • 6213c76fd4de3_Mon17a76f9854e.tmp (PID: 3384)
      • 6213c7f2505eb_Mon17e51b4cf5.tmp (PID: 3848)
      • 6213c76bcc375_Mon17b69a7f586.exe (PID: 2708)
      • 241J5.exe (PID: 3496)
      • 6213c7ee55374_Mon17f0f93fe.exe (PID: 2828)
      • M07L3.exe (PID: 2204)
      • M07L3.exe (PID: 4048)
      • K6LAA.exe (PID: 3096)
      • 5(6665____.exe (PID: 2992)
      • GGH5H.exe (PID: 284)
      • JJDM1.exe (PID: 1708)
      • Vipugelesae.exe (PID: 2448)
      • Maeguhutome.exe (PID: 3344)
      • poweroff.tmp (PID: 3156)
      • 161.tmp (PID: 11124)
      • tapinstall.exe (PID: 11860)
      • tapinstall.exe (PID: 12276)
      • DrvInst.exe (PID: 12680)
      • random.exe (PID: 14044)
      • random.exe (PID: 4292)
      • jg5_5knj.exe (PID: 13028)
      • DrvInst.exe (PID: 9584)
      • autosubplayer.exe (PID: 6084)
      • powershell.exe (PID: 7720)
      • mask_svc.exe (PID: 12396)
      • mask_svc.exe (PID: 9528)
      • mask_svc.exe (PID: 6712)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 520)
      • win_setup__6213c7fc58a9f.exe (PID: 3108)
      • setup_installer.exe (PID: 4020)
      • 6213c76fd4de3_Mon17a76f9854e.exe (PID: 3656)
      • 6213c7f2505eb_Mon17e51b4cf5.exe (PID: 3536)
      • 6213c76fd4de3_Mon17a76f9854e.tmp (PID: 476)
      • 6213c76fd4de3_Mon17a76f9854e.exe (PID: 1264)
      • 6213c7f2505eb_Mon17e51b4cf5.tmp (PID: 3848)
      • 6213c76fd4de3_Mon17a76f9854e.tmp (PID: 3384)
      • 6213c7f44408a_Mon17beb03de.exe (PID: 3964)
      • 6213c76cdec93_Mon171bb9418dd0.exe (PID: 3124)
      • 5(6665____.exe (PID: 2992)
      • poweroff.exe (PID: 1940)
      • poweroff.tmp (PID: 3156)
      • Maeguhutome.exe (PID: 3344)
      • 161.exe (PID: 10896)
      • 161.tmp (PID: 11124)
      • tapinstall.exe (PID: 12276)
      • DrvInst.exe (PID: 12680)
      • jg5_5knj.exe (PID: 13028)
      • DrvInst.exe (PID: 9584)
      • autosubplayer.exe (PID: 6084)

    • Application launched itself

      • WinRAR.exe (PID: 2360)
      • 6213c76bcc375_Mon17b69a7f586.exe (PID: 3484)
      • 6213c76cdec93_Mon171bb9418dd0.exe (PID: 2428)
      • 6213c7f15efe2_Mon1755c58a115c.exe (PID: 3636)
      • random.exe (PID: 14044)

    • Drops a file with a compile date too recent

      • setup_installer.exe (PID: 4020)
      • 6213c7f44408a_Mon17beb03de.exe (PID: 3964)
      • 6213c7f2505eb_Mon17e51b4cf5.tmp (PID: 3848)
      • 6213c76cdec93_Mon171bb9418dd0.exe (PID: 3124)
      • 5(6665____.exe (PID: 2992)
      • Maeguhutome.exe (PID: 3344)
      • jg5_5knj.exe (PID: 13028)

    • Drops a file with too old compile date

      • setup_installer.exe (PID: 4020)
      • 6213c7f2505eb_Mon17e51b4cf5.exe (PID: 3536)
      • 6213c7f2505eb_Mon17e51b4cf5.tmp (PID: 3848)
      • 5(6665____.exe (PID: 2992)
      • poweroff.exe (PID: 1940)
      • poweroff.tmp (PID: 3156)
      • 161.tmp (PID: 11124)

    • Starts CMD.EXE for commands execution

      • setup_install.exe (PID: 2656)
      • 6213c76a1285e_Mon1755345927.exe (PID: 3096)
      • 6213c7ee55374_Mon17f0f93fe.exe (PID: 2828)
      • Maeguhutome.exe (PID: 3344)
      • 161.tmp (PID: 11124)

    • Drops a file that was compiled in debug mode

      • setup_installer.exe (PID: 4020)
      • 6213c76fd4de3_Mon17a76f9854e.tmp (PID: 476)
      • 6213c7f2505eb_Mon17e51b4cf5.tmp (PID: 3848)
      • 6213c76fd4de3_Mon17a76f9854e.tmp (PID: 3384)
      • 6213c7f44408a_Mon17beb03de.exe (PID: 3964)
      • 5(6665____.exe (PID: 2992)
      • poweroff.tmp (PID: 3156)
      • Maeguhutome.exe (PID: 3344)
      • 161.tmp (PID: 11124)
      • tapinstall.exe (PID: 12276)
      • DrvInst.exe (PID: 12680)
      • jg5_5knj.exe (PID: 13028)
      • DrvInst.exe (PID: 9584)

    • Reads Windows owner or organization settings

      • 6213c76fd4de3_Mon17a76f9854e.tmp (PID: 476)
      • 6213c7f2505eb_Mon17e51b4cf5.tmp (PID: 3848)
      • 6213c76fd4de3_Mon17a76f9854e.tmp (PID: 3384)
      • poweroff.tmp (PID: 3156)
      • 161.tmp (PID: 11124)

    • Reads the Windows organization settings

      • 6213c7f2505eb_Mon17e51b4cf5.tmp (PID: 3848)
      • 6213c76fd4de3_Mon17a76f9854e.tmp (PID: 476)
      • 6213c76fd4de3_Mon17a76f9854e.tmp (PID: 3384)
      • poweroff.tmp (PID: 3156)
      • 161.tmp (PID: 11124)

    • Reads the cookies of Google Chrome

      • 6213c76b12a09_Mon1791fd34f6.exe (PID: 2516)
      • 6213c76bcc375_Mon17b69a7f586.exe (PID: 2708)

    • Loads DLL from Mozilla Firefox

      • 6213c76b12a09_Mon1791fd34f6.exe (PID: 2516)

    • Adds / modifies Windows certificates

      • 6213c76cdec93_Mon171bb9418dd0.exe (PID: 3124)
      • Maeguhutome.exe (PID: 3344)

    • Uses RUNDLL32.EXE to load library

      • control.exe (PID: 3728)
      • control.exe (PID: 3148)

    • Reads CPU info

      • 6213c76b12a09_Mon1791fd34f6.exe (PID: 2516)

    • Reads Environment values

      • 6213c76b12a09_Mon1791fd34f6.exe (PID: 2516)
      • 5(6665____.exe (PID: 2992)
      • Vipugelesae.exe (PID: 2448)
      • Maeguhutome.exe (PID: 3344)
      • 6213c76bcc375_Mon17b69a7f586.exe (PID: 2708)
      • vssvc.exe (PID: 13220)
      • DrvInst.exe (PID: 9584)
      • 161.tmp (PID: 11124)

    • Executed via WMI

      • rundll32.exe (PID: 2988)
      • rundll32.exe (PID: 10000)

    • Searches for installed software

      • 6213c76b12a09_Mon1791fd34f6.exe (PID: 2516)
      • 6213c76bcc375_Mon17b69a7f586.exe (PID: 2708)

    • Creates a directory in Program Files

      • 5(6665____.exe (PID: 2992)
      • poweroff.tmp (PID: 3156)
      • 6213c76fd4de3_Mon17a76f9854e.tmp (PID: 3384)
      • 161.tmp (PID: 11124)
      • autosubplayer.exe (PID: 6084)

    • Reads the cookies of Mozilla Firefox

      • 6213c76bcc375_Mon17b69a7f586.exe (PID: 2708)
      • jg5_5knj.exe (PID: 13028)

    • Reads default file associations for system extensions

      • JJDM1.exe (PID: 1708)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2728)

    • Starts Internet Explorer

      • Vipugelesae.exe (PID: 2448)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3464)
      • iexplore.exe (PID: 13644)

    • Creates files in the Windows directory

      • DrvInst.exe (PID: 12680)
      • DrvInst.exe (PID: 9584)

    • Creates files in the driver directory

      • DrvInst.exe (PID: 12680)
      • DrvInst.exe (PID: 9584)

    • Removes files from Windows directory

      • DrvInst.exe (PID: 12680)
      • DrvInst.exe (PID: 9584)

    • Executed via COM

      • DrvInst.exe (PID: 12680)
      • DrvInst.exe (PID: 9584)

    • Executed as Windows Service

      • vssvc.exe (PID: 13220)
      • mask_svc.exe (PID: 6712)

    • Creates a software uninstall entry

      • autosubplayer.exe (PID: 6084)

    • Creates files in the user directory

      • autosubplayer.exe (PID: 6084)

    • Starts application with an unusual extension

      • autosubplayer.exe (PID: 6084)

    • Executes PowerShell scripts

      • ns12C8.tmp (PID: 7176)

    • Creates files in the program directory

      • autosubplayer.exe (PID: 6084)
      • lighteningplayer-cache-gen.exe (PID: 6728)

  • INFO

    • Application launched itself

      • firefox.exe (PID: 2220)
      • firefox.exe (PID: 3692)
      • iexplore.exe (PID: 2756)

    • Reads CPU info

      • firefox.exe (PID: 3692)

    • Reads the computer name

      • firefox.exe (PID: 3692)
      • firefox.exe (PID: 2096)
      • firefox.exe (PID: 1488)
      • firefox.exe (PID: 3200)
      • firefox.exe (PID: 3736)
      • firefox.exe (PID: 3504)
      • firefox.exe (PID: 924)
      • firefox.exe (PID: 2324)
      • control.exe (PID: 3728)
      • rundll32.exe (PID: 2988)
      • control.exe (PID: 3148)
      • iexplore.exe (PID: 2756)
      • taskkill.exe (PID: 3088)
      • iexplore.exe (PID: 3464)
      • vssvc.exe (PID: 13220)
      • rundll32.exe (PID: 10000)
      • iexplore.exe (PID: 13644)

    • Checks supported languages

      • firefox.exe (PID: 3200)
      • firefox.exe (PID: 2220)
      • firefox.exe (PID: 3736)
      • firefox.exe (PID: 924)
      • firefox.exe (PID: 3692)
      • firefox.exe (PID: 3504)
      • firefox.exe (PID: 2096)
      • firefox.exe (PID: 1488)
      • firefox.exe (PID: 2324)
      • NOTEPAD.EXE (PID: 3108)
      • control.exe (PID: 3728)
      • rundll32.exe (PID: 2776)
      • control.exe (PID: 3148)
      • rundll32.exe (PID: 884)
      • taskkill.exe (PID: 3088)
      • iexplore.exe (PID: 2756)
      • iexplore.exe (PID: 3464)
      • rundll32.exe (PID: 2988)
      • vssvc.exe (PID: 13220)
      • rundll32.exe (PID: 10000)
      • iexplore.exe (PID: 13644)

    • Creates files in the program directory

      • firefox.exe (PID: 3692)
      • 5(6665____.exe (PID: 2992)
      • poweroff.tmp (PID: 3156)
      • 6213c76fd4de3_Mon17a76f9854e.tmp (PID: 3384)
      • 161.tmp (PID: 11124)

    • Dropped object may contain Bitcoin addresses

      • firefox.exe (PID: 3692)

    • Reads the date of Windows installation

      • firefox.exe (PID: 3692)

    • Checks Windows Trust Settings

      • firefox.exe (PID: 3692)
      • powershell.exe (PID: 3876)
      • powershell.exe (PID: 3916)
      • 6213c76c328cf_Mon17b943b10.exe (PID: 1980)
      • 6213c7f2505eb_Mon17e51b4cf5.tmp (PID: 3848)
      • iexplore.exe (PID: 3464)
      • iexplore.exe (PID: 2756)
      • tapinstall.exe (PID: 12276)
      • DrvInst.exe (PID: 12680)
      • DrvInst.exe (PID: 9584)
      • powershell.exe (PID: 7720)

    • Manual execution by user

      • WinRAR.exe (PID: 2360)
      • win_setup__6213c7fc58a9f.exe (PID: 1084)
      • win_setup__6213c7fc58a9f.exe (PID: 3108)

    • Creates files in the user directory

      • firefox.exe (PID: 3692)
      • iexplore.exe (PID: 3464)
      • iexplore.exe (PID: 2756)

    • Reads settings of System Certificates

      • 6213c76cdec93_Mon171bb9418dd0.exe (PID: 3124)
      • powershell.exe (PID: 3876)
      • powershell.exe (PID: 3916)
      • 6213c76c328cf_Mon17b943b10.exe (PID: 1980)
      • 6213c7f2505eb_Mon17e51b4cf5.tmp (PID: 3848)
      • 5(6665____.exe (PID: 2992)
      • Vipugelesae.exe (PID: 2448)
      • Maeguhutome.exe (PID: 3344)
      • 6213c76b12a09_Mon1791fd34f6.exe (PID: 2516)
      • iexplore.exe (PID: 3464)
      • iexplore.exe (PID: 2756)
      • 161.tmp (PID: 11124)
      • tapinstall.exe (PID: 12276)
      • DrvInst.exe (PID: 12680)
      • random.exe (PID: 4292)
      • DrvInst.exe (PID: 9584)

    • Application was dropped or rewritten from another process

      • 6213c76fd4de3_Mon17a76f9854e.tmp (PID: 476)
      • 6213c76fd4de3_Mon17a76f9854e.tmp (PID: 3384)
      • 6213c7f2505eb_Mon17e51b4cf5.tmp (PID: 3848)
      • 5(6665____.exe (PID: 2992)
      • poweroff.tmp (PID: 3156)
      • 161.tmp (PID: 11124)

    • Loads dropped or rewritten executable

      • 6213c76fd4de3_Mon17a76f9854e.tmp (PID: 476)
      • 6213c7f2505eb_Mon17e51b4cf5.tmp (PID: 3848)
      • 6213c76fd4de3_Mon17a76f9854e.tmp (PID: 3384)
      • poweroff.tmp (PID: 3156)
      • 161.tmp (PID: 11124)

    • Creates a software uninstall entry

      • poweroff.tmp (PID: 3156)
      • 6213c76fd4de3_Mon17a76f9854e.tmp (PID: 3384)
      • 161.tmp (PID: 11124)

    • Changes internet zones settings

      • iexplore.exe (PID: 2756)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3464)
      • iexplore.exe (PID: 13644)

    • Searches for installed software

      • DrvInst.exe (PID: 12680)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2756)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2756)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
169
Monitored processes
102
Malicious processes
39
Suspicious processes
10

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start inject firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs winrar.exe no specs notepad.exe no specs winrar.exe win_setup__6213c7fc58a9f.exe no specs win_setup__6213c7fc58a9f.exe setup_installer.exe setup_install.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs 6213c76a1285e_mon1755345927.exe no specs powershell.exe no specs cmd.exe no specs 6213c76b12a09_mon1791fd34f6.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs 6213c76bcc375_mon17b69a7f586.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs 6213c773d71f0_mon17447345c.exe no specs 6213c76fd4de3_mon17a76f9854e.exe cmd.exe no specs 6213c76cdec93_mon171bb9418dd0.exe no specs cmd.exe no specs cmd.exe no specs 6213c7ee55374_mon17f0f93fe.exe 6213c76c328cf_mon17b943b10.exe 6213c7f15efe2_mon1755c58a115c.exe no specs powershell.exe no specs 6213c7712660c_mon1725defbc8.exe 6213c7f44408a_mon17beb03de.exe 6213c7f2505eb_mon17e51b4cf5.exe 6213c76fd4de3_mon17a76f9854e.tmp #REDLINE 6213c76bcc375_mon17b69a7f586.exe 6213c76cdec93_mon171bb9418dd0.exe 6213c7f2505eb_mon17e51b4cf5.tmp 6213c76fd4de3_mon17a76f9854e.exe 6213c76fd4de3_mon17a76f9854e.tmp 241j5.exe no specs control.exe no specs rundll32.exe no specs 6213c7f15efe2_mon1755c58a115c.exe no specs m07l3.exe no specs m07l3.exe no specs 5(6665____.exe k6laa.exe no specs rundll32.exe no specs ggh5h.exe no specs jjdm1.exe no specs vipugelesae.exe maeguhutome.exe poweroff.exe poweroff.tmp power off.exe no specs control.exe no specs rundll32.exe no specs cmd.exe no specs iexplore.exe taskkill.exe no specs iexplore.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs 161.exe 161.tmp cmd.exe no specs tapinstall.exe no specs cmd.exe no specs tapinstall.exe drvinst.exe cmd.exe no specs jg5_5knj.exe vssvc.exe no specs cmd.exe no specs random.exe no specs random.exe rundll32.exe no specs svchost.exe drvinst.exe cmd.exe no specs autosubplayer.exe mask_svc.exe no specs ns12c8.tmp no specs powershell.exe no specs ns19ed.tmp no specs lighteningplayer-cache-gen.exe mask_svc.exe no specs mask_svc.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
284"C:\Users\admin\AppData\Local\Temp\GGH5H.exe"C:\Users\admin\AppData\Local\Temp\GGH5H.exe—6213c7f44408a_Mon17beb03de.exe
User:
admin
Company:
Symantec Corporation
Integrity Level:
HIGH
Description:
Symantec Application
Exit code:
0
Version:
7.11.0.12
Modules
Images
c:\users\admin\appdata\local\temp\ggh5h.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
404C:\Windows\system32\cmd.exe /c 6213c76cdec93_Mon171bb9418dd0.exe C:\Windows\system32\cmd.exe—setup_install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\cmd.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
476"C:\Users\admin\AppData\Local\Temp\is-87DFI.tmp\6213c76fd4de3_Mon17a76f9854e.tmp" /SL5="$6016C,870458,780800,C:\Users\admin\AppData\Local\Temp\7zS4BF28480\6213c76fd4de3_Mon17a76f9854e.exe" C:\Users\admin\AppData\Local\Temp\is-87DFI.tmp\6213c76fd4de3_Mon17a76f9854e.tmp
6213c76fd4de3_Mon17a76f9854e.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
1
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-87dfi.tmp\6213c76fd4de3_mon17a76f9854e.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
500C:\Windows\system32\cmd.exe /c 6213c7ee55374_Mon17f0f93fe.exe /mixtwoC:\Windows\system32\cmd.exe—setup_install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
520"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\Rar$DIa2360.49483\winp-6213c7fc641cdi864-en.zipC:\Program Files\WinRAR\WinRAR.exe
WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\windows\system32\kernel32.dll
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
872C:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
884"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\admin\AppData\Local\Temp\TEBW8SGT.CpL",C:\Windows\system32\rundll32.exe—control.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\usp10.dll
904C:\Windows\system32\cmd.exe /c 6213c7f15efe2_Mon1755c58a115c.exe C:\Windows\system32\cmd.exe—setup_install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\gdi32.dll
924"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3692.34.1298484129\1424733498" -childID 5 -isForBrowser -prefsHandle 3724 -prefMapHandle 3720 -prefsLen 7307 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3692 "\\.\pipe\gecko-crash-server-pipe.3692" 3736 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
1048C:\Windows\system32\cmd.exe /c 6213c76fd4de3_Mon17a76f9854e.exe C:\Windows\system32\cmd.exe—setup_install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
115 197
Read events
113 519
Write events
1 569
Delete events
109

Modification events

(PID) Process:(2220) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Launcher
Value:
26E10E259C000000
(PID) Process:(3692) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Browser
Value:
D2E70E259C000000
(PID) Process:(3692) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry
Value:
0
(PID) Process:(3692) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\DllPrefetchExperiment
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
0
(PID) Process:(3692) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|DisableTelemetry
Value:
1
(PID) Process:(3692) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|DisableDefaultBrowserAgent
Value:
0
(PID) Process:(3692) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|ServicesSettingsServer
Value:
https://firefox.settings.services.mozilla.com/v1
(PID) Process:(3692) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|SecurityContentSignatureRootHash
Value:
97:E8:BA:9C:F1:2F:B3:DE:53:CC:42:A4:E6:57:7E:D6:4D:F4:93:C2:47:B4:14:FE:A0:36:81:8D:38:23:56:0E
(PID) Process:(3692) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3692) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000003B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
110
Suspicious files
285
Text files
122
Unknown types
116

Dropped files

PID
Process
Filename
Type
3692firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
3692firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore-backups\recovery.jsonlz4jsonlz4
MD5:—
SHA256:—
3692firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite —
MD5:—
SHA256:—
3692firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore-backups\recovery.jsonlz4.tmpjsonlz4
MD5:—
SHA256:—
3692firefox.exeC:\Users\admin\AppData\Local\Temp\mz_etilqs_Jy6vq7mxSt5ZCuebinary
MD5:—
SHA256:—
3692firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-walbinary
MD5:—
SHA256:—
3692firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
3692firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
3692firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4jsonlz4
MD5:B17F8D93B0C43D6B72DC03752C20A2D9
SHA256:ADA0F70D374223FB63C2F19471FAB45D986A681E2485692E63F00F5071F19D76
3692firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\addonStartup.json.lz4jsonlz4
MD5:01DAE35763819EE4C2BD72553B33C337
SHA256:674E499CCF7E955DEFFEB21B94C092DE0A8EA1DD308C426DCF04BC84DBDFA377
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
94
TCP/UDP connections
320
DNS requests
458
Threats
81

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3692
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3692
firefox.exe
POST
200
2.16.186.42:80
http://r3.o.lencr.org/
unknown
der
503 b
shared
3692
firefox.exe
GET
200
172.67.159.126:80
http://tara707.xyz/.well-known/http-opportunistic
US
text
42 b
suspicious
3692
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3692
firefox.exe
GET
200
104.21.41.30:80
http://tara707.xyz/~lp1/lander.php?lander=aHR0cDovL3JlcmExNTAueHl6L35scDIvP3Q9MTY0NTQ2NDM3NiZxPUFkdmFuY2VkLVN5c3RlbUNhcmUtVWx0aW1hdGUtMTUwMTc3LU1hYy1PUy1YLUNyYWNrLUlzLUhlcmUmaD0zN2RjOTAxZjg5YjdiNzYzMjExNGE5YzQ2MWM4ZTYxMmQxYjQxOTAwZThkZWJiYjM4M2ZlNTY1ZQ&kod=&t=1645464266
US
html
391 b
suspicious
3692
firefox.exe
GET
200
104.21.70.113:80
http://rera150.xyz/~lp2/?t=1645464376&q=Advanced-SystemCare-Ultimate-150177-Mac-OS-X-Crack-Is-Here&h=37dc901f89b7b7632114a9c461c8e612d1b41900e8debbb383fe565e&kaobd=&tellym=1645464268
US
html
360 b
suspicious
3692
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3692
firefox.exe
POST
200
142.250.185.131:80
http://ocsp.pki.goog/gts1c3
US
der
471 b
whitelisted
3692
firefox.exe
GET
404
104.21.70.113:80
http://rera150.xyz/favicon.ico
US
html
4.75 Kb
suspicious
3692
firefox.exe
POST
200
104.18.31.182:80
http://ocsp.sectigo.com/
US
der
472 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3692
firefox.exe
34.107.221.82:80
detectportal.firefox.com
—
US
whitelisted
3692
firefox.exe
13.224.189.76:443
firefox.settings.services.mozilla.com
—
US
unknown
3692
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3692
firefox.exe
80.82.77.15:80
onhax.io
Quasi Networks LTD.
SC
suspicious
3692
firefox.exe
142.250.185.202:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
3692
firefox.exe
52.41.252.32:443
push.services.mozilla.com
Amazon.com, Inc.
US
unknown
3692
firefox.exe
142.250.185.131:80
ocsp.pki.goog
Google Inc.
US
whitelisted
3692
firefox.exe
52.38.132.78:443
location.services.mozilla.com
Amazon.com, Inc.
US
unknown
3692
firefox.exe
13.225.80.56:443
content-signature-2.cdn.mozilla.net
—
US
unknown
3692
firefox.exe
80.82.77.15:443
onhax.io
Quasi Networks LTD.
SC
suspicious

DNS requests

Domain
IP
Reputation
detectportal.firefox.com
  • 34.107.221.82
whitelisted
onhax.io
  • 80.82.77.15
suspicious
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
firefox.settings.services.mozilla.com
  • 13.224.189.76
  • 13.224.189.71
  • 13.224.189.54
  • 13.224.189.85
whitelisted
location.services.mozilla.com
  • 52.38.132.78
  • 34.217.232.122
  • 35.161.134.161
  • 52.40.22.163
  • 52.41.42.176
  • 54.148.72.145
whitelisted
locprod2-elb-us-west-2.prod.mozaws.net
  • 54.148.72.145
  • 52.41.42.176
  • 52.40.22.163
  • 35.161.134.161
  • 34.217.232.122
  • 52.38.132.78
whitelisted
safebrowsing.googleapis.com
  • 142.250.185.202
  • 2a00:1450:4001:813::200a
whitelisted
push.services.mozilla.com
  • 52.41.252.32
whitelisted
autopush.prod.mozaws.net
  • 52.41.252.32
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted

Threats

PID
Process
Class
Message
3692
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
3692
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
3692
firefox.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3692
firefox.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3692
firefox.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3692
firefox.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3692
firefox.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3692
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
3692
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
3692
firefox.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
20 ETPRO signatures available at the full report
Process
Message
lighteningplayer-cache-gen.exe
main libvlc debug: VLC media player - 3.0.7 Vetinari
lighteningplayer-cache-gen.exe
main libvlc debug: Copyright � 1996-2018 the VideoLAN team
lighteningplayer-cache-gen.exe
main libvlc debug: revision 3.0.2-225-gc9e3360dd4
lighteningplayer-cache-gen.exe
main libvlc debug: configured with ../extras/package/win32/../../../configure '--enable-update-check' '--enable-lua' '--enable-faad' '--enable-flac' '--enable-theora' '--enable-twolame' '--enable-avcodec' '--enable-merge-ffmpeg' '--enable-dca' '--enable-mpc' '--enable-libass' '--enable-x264' '--enable-schroedinger' '--enable-realrtsp' '--enable-live555' '--enable-dvdread' '--enable-shout' '--enable-goom' '--enable-caca' '--enable-qt' '--enable-skins2' '--enable-sse' '--enable-mmx' '--enable-libcddb' '--enable-zvbi' '--disable-telx' '--enable-nls' '--host=i686-w64-mingw32' '--build=x86_64-pc-linux-gnu' 'build_alias=x86_64-pc-linux-gnu' 'host_alias=i686-w64-mingw32'
lighteningplayer-cache-gen.exe
main libvlc debug: using multimedia timers as clock source
lighteningplayer-cache-gen.exe
main libvlc debug: min period: 1 ms, max period: 1000000 ms
lighteningplayer-cache-gen.exe
main libvlc debug: searching plug-in modules
lighteningplayer-cache-gen.exe
main libvlc debug: ignoring plugins cache file
lighteningplayer-cache-gen.exe
main libvlc debug: recursively browsing `C:\Program Files\lighteningplayer\plugins'
lighteningplayer-cache-gen.exe
main libvlc debug: saving plugins cache C:\Program Files\lighteningplayer\plugins\plugins.dat
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://onhax.io