| URL: | https://oyila.com/cdn-cgi/challenge-platform/h/b/jsd/r/0.3435370407381694:1751416143:vY2a7o9CQ8_xZ5kcVF-SxukSCX0hsqx5Mw5ZBTZ8o7E/958a5e5e2c36e7e0 |
| Full analysis: | https://app.any.run/tasks/ee49df9a-394d-40ea-bc1d-b2c204ad657c |
| Verdict: | Malicious activity |
| Analysis date: | July 02, 2025, 05:42:11 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 363E8F1E6FB467624B77047E67BE31E1 |
| SHA1: | E2406908E984713C9837D79B738BAB0B56B49BF1 |
| SHA256: | B2AB6E3BD61074F7DAFD0B21352F0E35BE07BA77542A22DDBAD955F93874FDC0 |
| SSDEEP: | 3:N8VMQGnLbPEgI9NKHPBhLMzlUg8jp8W4XEuNz07Oh/lWTKhH1VUg:2mQE/PEgcNKvBhKr8jp8W4X1wK9MGZD |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 188 | "C:\Program Files\Mozilla Firefox\firefox.exe" https://oyila.com/cdn-cgi/challenge-platform/h/b/jsd/r/0.3435370407381694:1751416143:vY2a7o9CQ8_xZ5kcVF-SxukSCX0hsqx5Mw5ZBTZ8o7E/958a5e5e2c36e7e0 | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 136.0 Modules
| |||||||||||||||
| 724 | C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding | C:\Windows\System32\rundll32.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1136 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4060 -prefsLen 44823 -prefMapHandle 4076 -prefMapSize 272997 -jsInitHandle 4080 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 4088 -initialChannelId {3f0df0d2-8210-4a99-a1ee-67c3f2d515b3} -parentPid 188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 136.0 Modules
| |||||||||||||||
| 1496 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4380 -prefsLen 38806 -prefMapHandle 4400 -prefMapSize 268611 -jsInitHandle 4308 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 5852 -initialChannelId {7e95c02f-5f5f-415e-9e7a-d3c58bba0be1} -parentPid 8020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 136.0 Modules
| |||||||||||||||
| 1828 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5716 -prefsLen 37305 -prefMapHandle 5696 -prefMapSize 268611 -jsInitHandle 5724 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 5720 -initialChannelId {752b3815-6d89-4888-b491-9f0a7642c120} -parentPid 8020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 136.0 Modules
| |||||||||||||||
| 2040 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4664 -prefsLen 35919 -prefMapHandle 4668 -prefMapSize 268611 -jsInitHandle 4672 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 4628 -initialChannelId {bd7f4015-2c7f-4d8a-9a3f-f350b95bd555} -parentPid 8020 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8020" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 136.0 Modules
| |||||||||||||||
| 2200 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2536 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250227124745 -prefsHandle 3452 -prefsLen 36996 -prefMapHandle 3456 -prefMapSize 272997 -ipcHandle 3360 -initialChannelId {51340e75-9140-4abe-adcc-6b85bf43583a} -parentPid 188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.188" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 1 Version: 136.0 Modules
| |||||||||||||||
| 2664 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3332 -prefsLen 31090 -prefMapHandle 3336 -prefMapSize 272997 -jsInitHandle 3340 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 3348 -initialChannelId {09383ba6-7169-4546-ab03-094b347f4bcf} -parentPid 188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 136.0 Modules
| |||||||||||||||
| 3620 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| (PID) Process: | (188) firefox.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe |
Value: 0 | |||
| (PID) Process: | (8020) firefox.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe |
Value: 0 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 188 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite | — | |
MD5:— | SHA256:— | |||
| 188 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\urlCache-current.bin | binary | |
MD5:3134ED3F12E4F4F8643DB90043B0FD7B | SHA256:26E4F122034D7A03F6DA0E707799B09CBEEBDAF8D7A3133A1F7BD894AC72EEA1 | |||
| 188 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 188 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.json.tmp | binary | |
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A | SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA | |||
| 188 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 188 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\safebrowsing-updating\ads-track-digest256.sbstore | — | |
MD5:— | SHA256:— | |||
| 188 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs-1.js | text | |
MD5:28A6A580B9BE4490A7FB0CFF2B5E8AFE | SHA256:6B11FB718A7C03DBAFA51F50D8278D2463EF7BDC5D096D885365F5DBEC45FCFA | |||
| 188 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\datareporting\glean\db\data.safe.tmp | binary | |
MD5:E3FC1A783723F57DD176551BA95A2197 | SHA256:5961DB5898EF50EFAEB4C9D59D2033EA908DD47362214D5DD1CCBD4BAFC11F76 | |||
| 188 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\datareporting\glean\db\data.safe.bin | binary | |
MD5:E3FC1A783723F57DD176551BA95A2197 | SHA256:5961DB5898EF50EFAEB4C9D59D2033EA908DD47362214D5DD1CCBD4BAFC11F76 | |||
| 188 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\safebrowsing-updating\analytics-track-digest256.sbstore | — | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
188 | firefox.exe | POST | 200 | 172.217.18.3:80 | http://o.pki.goog/s/wr3/k58 | unknown | — | — | whitelisted |
188 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | unknown | — | — | whitelisted |
188 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/canonical.html | unknown | — | — | whitelisted |
8020 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/canonical.html | unknown | — | — | whitelisted |
188 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | unknown | — | — | whitelisted |
8020 | firefox.exe | POST | 200 | 172.217.18.3:80 | http://o.pki.goog/s/wr3/azY | unknown | — | — | whitelisted |
188 | firefox.exe | POST | 200 | 172.217.18.3:80 | http://o.pki.goog/s/wr3/azY | unknown | — | — | whitelisted |
7060 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
8020 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | unknown | — | — | whitelisted |
8020 | firefox.exe | POST | 200 | 172.217.18.3:80 | http://o.pki.goog/s/wr3/azY | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
5944 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1268 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
7064 | RUXIMICS.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
188 | firefox.exe | 34.160.144.191:443 | content-signature-2.cdn.mozilla.net | GOOGLE | US | whitelisted |
188 | firefox.exe | 141.193.213.11:443 | oyila.com | Cloudflare London, LLC | US | unknown |
188 | firefox.exe | 34.107.221.82:80 | detectportal.firefox.com | GOOGLE | US | whitelisted |
188 | firefox.exe | 34.36.137.203:443 | contile.services.mozilla.com | GOOGLE-CLOUD-PLATFORM | US | whitelisted |
188 | firefox.exe | 34.149.100.209:443 | firefox.settings.services.mozilla.com | GOOGLE | US | whitelisted |
188 | firefox.exe | 172.217.18.3:80 | o.pki.goog | GOOGLE | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
content-signature-2.cdn.mozilla.net |
| whitelisted |
content-signature-chains.prod.autograph.services.mozaws.net |
| whitelisted |
oyila.com |
| unknown |
detectportal.firefox.com |
| whitelisted |
prod.detectportal.prod.cloudops.mozgcp.net |
| whitelisted |
contile.services.mozilla.com |
| whitelisted |
spocs.getpocket.com |
| whitelisted |
mc.prod.ads.prod.webservices.mozgcp.net |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
— | — | Unknown Traffic | ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW) |
8020 | firefox.exe | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
8020 | firefox.exe | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
8020 | firefox.exe | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
8020 | firefox.exe | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
8020 | firefox.exe | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
8020 | firefox.exe | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
8020 | firefox.exe | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
8020 | firefox.exe | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |
8020 | firefox.exe | Generic Protocol Command Decode | SURICATA QUIC failed decrypt |