URL:

https://wolfmax4k.com/online/235630

Full analysis: https://app.any.run/tasks/93339bca-bdc6-49c3-be12-6a147e97537b
Verdict: Malicious activity
Analysis date: November 20, 2024, 13:07:12
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
phishing
obfuscated-js
arch-scr
arch-doc
arch-html
Indicators:
MD5:

2D9DDA98F26EACC1DCB77DC7A97B8BA6

SHA1:

0807F5BA2C5B582B0FE389BD09D9EF8029B16278

SHA256:

A2365295E12470DF7591039DE7334A175EE48BD3EC2741CDBC92DF040F164FDF

SSDEEP:

3:N8bJUHRQKXe:2OKKXe

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 5960)

    • Application launched itself

      • firefox.exe (PID: 2436)
      • firefox.exe (PID: 5960)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
191
Monitored processes
61
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs textinputhost.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
244"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5860 -childID 31 -isForBrowser -prefsHandle 5372 -prefMapHandle 7796 -prefsLen 32153 -prefMapSize 244583 -jsInitHandle 1400 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {83cf6559-c15e-457e-8fb2-204f8a406f14} 5960 "\\.\pipe\gecko-crash-server-pipe.5960" 24e5ecfcd90 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
244"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4392 -childID 48 -isForBrowser -prefsHandle 9060 -prefMapHandle 9056 -prefsLen 32399 -prefMapSize 244583 -jsInitHandle 1400 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {046fc0ba-7bca-48ce-b21c-6fcabcd0342e} 5960 "\\.\pipe\gecko-crash-server-pipe.5960" 24e608ce690 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
544"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7084 -childID 27 -isForBrowser -prefsHandle 6312 -prefMapHandle 5296 -prefsLen 32153 -prefMapSize 244583 -jsInitHandle 1400 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9125d150-4a9f-4e65-9b2f-b4ea12dcb0e8} 5960 "\\.\pipe\gecko-crash-server-pipe.5960" 24e5ac574d0 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
1300"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6860 -childID 26 -isForBrowser -prefsHandle 7236 -prefMapHandle 4148 -prefsLen 32153 -prefMapSize 244583 -jsInitHandle 1400 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {07db4761-879d-4260-9006-0fd6e8a4fa7b} 5960 "\\.\pipe\gecko-crash-server-pipe.5960" 24e5f011690 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
1816"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7016 -parentBuildID 20240213221259 -sandboxingKind 1 -prefsHandle 6872 -prefMapHandle 4652 -prefsLen 40254 -prefMapSize 244583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ff13115-d1e1-4bc4-83e9-06a567a21f1c} 5960 "\\.\pipe\gecko-crash-server-pipe.5960" 24e5e0ce110 utilityC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_1.dll
2164"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7684 -childID 35 -isForBrowser -prefsHandle 8032 -prefMapHandle 8020 -prefsLen 32153 -prefMapSize 244583 -jsInitHandle 1400 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {066b38e5-a4d4-49a9-8509-7d2d2e6e34bc} 5960 "\\.\pipe\gecko-crash-server-pipe.5960" 24e5ecfc850 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
2396"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7520 -childID 52 -isForBrowser -prefsHandle 8968 -prefMapHandle 8088 -prefsLen 33826 -prefMapSize 244583 -jsInitHandle 1400 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {269e2195-9fb0-43dc-a05d-7fe1278e936d} 5960 "\\.\pipe\gecko-crash-server-pipe.5960" 24e67348a10 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
2436"C:\Program Files\Mozilla Firefox\firefox.exe" "https://wolfmax4k.com/online/235630"C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\program files\mozilla firefox\vcruntime140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\program files\mozilla firefox\msvcp140.dll
2460"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6496 -childID 14 -isForBrowser -prefsHandle 6700 -prefMapHandle 6696 -prefsLen 32153 -prefMapSize 244583 -jsInitHandle 1400 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f9915ff-9bf6-4f20-b0a3-1233b7631cb9} 5960 "\\.\pipe\gecko-crash-server-pipe.5960" 24e5f9b4850 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140.dll
2524"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9076 -childID 51 -isForBrowser -prefsHandle 9080 -prefMapHandle 8228 -prefsLen 33826 -prefMapSize 244583 -jsInitHandle 1400 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {914cd5f5-5a9c-47c4-9051-6b5355216f69} 5960 "\\.\pipe\gecko-crash-server-pipe.5960" 24e67348bd0 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Total events
33 360
Read events
33 359
Write events
1
Delete events
0

Modification events

(PID) Process:(5960) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
0
Executable files
2
Suspicious files
341
Text files
62
Unknown types
9

Dropped files

PID
Process
Filename
Type
5960firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
5960firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.json.tmpbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
5960firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite —
MD5:—
SHA256:—
5960firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs.jstext
MD5:33F0252151F1E4289975017EF70823F2
SHA256:B0CC31BD67E8E5DEBE068D6DEC04FB5B1FDC4CD397D54706CDB2B901ECB6699A
5960firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
5960firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cookies.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
5960firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.jsonbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
5960firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
5960firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\datareporting\glean\db\data.safe.tmpdbf
MD5:D30F5B10F3D4B3992E4D666F622163F4
SHA256:2585819A7401A308DA879FA416278E473CEA5F6D0D24C59F514C5A698C61D03A
5960firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\datareporting\glean\db\data.safe.bindbf
MD5:D30F5B10F3D4B3992E4D666F622163F4
SHA256:2585819A7401A308DA879FA416278E473CEA5F6D0D24C59F514C5A698C61D03A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
109
TCP/UDP connections
460
DNS requests
466
Threats
13

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5960
firefox.exe
POST
200
142.250.184.195:80
http://o.pki.goog/s/wr3/yvU
unknown
—
—
whitelisted
5960
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
5960
firefox.exe
POST
200
2.16.2.75:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
5960
firefox.exe
POST
200
2.16.2.75:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
5960
firefox.exe
POST
200
2.16.2.75:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
5960
firefox.exe
POST
—
142.250.184.195:80
http://o.pki.goog/wr2
unknown
—
—
whitelisted
5960
firefox.exe
POST
200
2.16.2.75:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
5960
firefox.exe
POST
200
2.16.2.75:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
5960
firefox.exe
POST
200
104.18.21.226:80
http://ocsp.globalsign.com/ca/gsatlasr3dvtlsca2024q3
unknown
—
—
whitelisted
4932
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4932
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5180
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5960
firefox.exe
172.67.217.166:443
wolfmax4k.com
CLOUDFLARENET
US
unknown
5960
firefox.exe
34.107.221.82:80
detectportal.firefox.com
GOOGLE
US
whitelisted
5960
firefox.exe
142.250.185.170:443
safebrowsing.googleapis.com
—
—
whitelisted
5960
firefox.exe
34.117.188.166:443
contile.services.mozilla.com
—
—
unknown
5960
firefox.exe
34.107.243.93:443
push.services.mozilla.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.78
whitelisted
wolfmax4k.com
  • 172.67.217.166
  • 104.21.59.72
  • 2606:4700:3037::ac43:d9a6
  • 2606:4700:3030::6815:3b48
unknown
detectportal.firefox.com
  • 34.107.221.82
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
contile.services.mozilla.com
  • 34.117.188.166
whitelisted
spocs.getpocket.com
  • 34.117.188.166
whitelisted
prod.ads.prod.webservices.mozgcp.net
  • 34.117.188.166
unknown
example.org
  • 93.184.215.14
whitelisted
ipv4only.arpa
  • 192.0.0.170
  • 192.0.0.171
whitelisted
content-signature-2.cdn.mozilla.net
  • 34.160.144.191
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
2192
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
2192
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
2192
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
—
—
Misc activity
ET INFO Observed ZeroSSL SSL/TLS Certificate
—
—
Misc activity
ET INFO Observed ZeroSSL SSL/TLS Certificate
—
—
Misc activity
ET INFO Observed ZeroSSL SSL/TLS Certificate
—
—
Not Suspicious Traffic
INFO [ANY.RUN] VK Redirect (away .vk .com)
—
—
Not Suspicious Traffic
INFO [ANY.RUN] VK Redirect (away .vk .com)
—
—
Not Suspicious Traffic
INFO [ANY.RUN] VK Redirect (away .vk .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://wolfmax4k.com/online/235630