URL:

https://mega.nz/folder/vcNjBZjR#N8xOcUK6FO4DjsdcyLcnqQ

Full analysis: https://app.any.run/tasks/56aaadf9-b427-4f26-ad1e-7048f6027cb3
Verdict: Malicious activity
Analysis date: November 02, 2024, 10:34:37
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MD5:

FEF5C839A20DB9F4D3435E8B14AD7153

SHA1:

9B8F9BBF68D19053330BB21A036A36C0CA1891EA

SHA256:

D16A80B81E445524E6247FB7221EE7DCE483DCB2531391793B6EB4CCC11A4A67

SSDEEP:

3:N8X/iuyKwf/P3MbmhuBExn:26vfyWumx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Fortnite-Unban-Method.exe (PID: 8828)
      • Fortnite-Unban-Method.exe (PID: 9120)
      • Fortnite-Unban-Method.exe (PID: 7172)

    • Process drops legitimate windows executable

      • firefox.exe (PID: 6352)
      • Fortnite-Unban-Method.exe (PID: 8828)
      • Fortnite-Unban-Method.exe (PID: 9120)
      • Fortnite-Unban-Method.exe (PID: 7172)

    • Process drops python dynamic module

      • Fortnite-Unban-Method.exe (PID: 8828)
      • Fortnite-Unban-Method.exe (PID: 9120)

    • The process drops C-runtime libraries

      • Fortnite-Unban-Method.exe (PID: 8828)
      • Fortnite-Unban-Method.exe (PID: 9120)

    • Application launched itself

      • Fortnite-Unban-Method.exe (PID: 8828)

    • Starts CMD.EXE for commands execution

      • Fortnite-Unban-Method.exe (PID: 7172)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 7496)

  • INFO

    • Application launched itself

      • firefox.exe (PID: 4436)
      • firefox.exe (PID: 6352)

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 6352)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
18
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs fortnite-unban-method.exe fortnite-unban-method.exe fortnite-unban-method.exe cmd.exe no specs conhost.exe no specs attrib.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1336"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6012 -childID 4 -isForBrowser -prefsHandle 6004 -prefMapHandle 6000 -prefsLen 31161 -prefMapSize 244343 -jsInitHandle 1108 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {91eab6c9-d088-4c0f-a8d2-e8aa14042c21} 6352 "\\.\pipe\gecko-crash-server-pipe.6352" 1937f7d8850 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
3604"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4408 -childID 2 -isForBrowser -prefsHandle 4440 -prefMapHandle 4436 -prefsLen 36339 -prefMapSize 244343 -jsInitHandle 1108 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1322afe8-52d7-49e9-b6fd-ccd0a41e12b1} 6352 "\\.\pipe\gecko-crash-server-pipe.6352" 1937b26f690 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
4436"C:\Program Files\Mozilla Firefox\firefox.exe" "https://mega.nz/folder/vcNjBZjR#N8xOcUK6FO4DjsdcyLcnqQ"C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\program files\mozilla firefox\vcruntime140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\program files\mozilla firefox\vcruntime140_1.dll
5236"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5296 -parentBuildID 20240213221259 -sandboxingKind 0 -prefsHandle 5284 -prefMapHandle 5292 -prefsLen 34789 -prefMapSize 244343 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d9a4e3ff-026d-4420-af2a-ac2384b64c67} 6352 "\\.\pipe\gecko-crash-server-pipe.6352" 1937c32eb10 utilityC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
5824"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6340 -childID 6 -isForBrowser -prefsHandle 6120 -prefMapHandle 6204 -prefsLen 31161 -prefMapSize 244343 -jsInitHandle 1108 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f34a6e4b-91d0-4d1a-ba07-16740300c73b} 6352 "\\.\pipe\gecko-crash-server-pipe.6352" 1937f7d8bd0 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
6316"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2192 -parentBuildID 20240213221259 -prefsHandle 2184 -prefMapHandle 2180 -prefsLen 30705 -prefMapSize 244343 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3bf2d9d8-657d-41c6-a238-44076a8aee2d} 6352 "\\.\pipe\gecko-crash-server-pipe.6352" 19368883110 socketC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
6352"C:\Program Files\Mozilla Firefox\firefox.exe" https://mega.nz/folder/vcNjBZjR#N8xOcUK6FO4DjsdcyLcnqQC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
6472"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1800 -parentBuildID 20240213221259 -prefsHandle 1736 -prefMapHandle 1716 -prefsLen 30705 -prefMapSize 244343 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9752b5c1-2718-41be-99fa-baa1f06d9695} 6352 "\\.\pipe\gecko-crash-server-pipe.6352" 193746c2d10 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
1
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
6812"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3004 -childID 1 -isForBrowser -prefsHandle 2808 -prefMapHandle 2880 -prefsLen 26798 -prefMapSize 244343 -jsInitHandle 1108 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fec3d7a6-c4af-466a-9c0f-adc843263daa} 6352 "\\.\pipe\gecko-crash-server-pipe.6352" 1937a38b150 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
7096"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6124 -childID 5 -isForBrowser -prefsHandle 6132 -prefMapHandle 6136 -prefsLen 31161 -prefMapSize 244343 -jsInitHandle 1108 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {66c0791a-00ce-433d-a0d8-a3ab2e5a3ba1} 6352 "\\.\pipe\gecko-crash-server-pipe.6352" 1937f7d8a10 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
Total events
16 104
Read events
16 102
Write events
2
Delete events
0

Modification events

(PID) Process:(6352) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
0
(PID) Process:(6352) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
Executable files
195
Suspicious files
1 389
Text files
184
Unknown types
0

Dropped files

PID
Process
Filename
Type
6352firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
6352firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
6352firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cookies.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
6352firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
6352firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\SiteSecurityServiceState.binbinary
MD5:64E218B2666509DB7021F16FD96F3021
SHA256:6A1A3A094CCF722A15B480F5BD9033D0F4048E558667FC3B71146F19A22A0F86
6352firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs.jstext
MD5:1A6C4EA143BEF21202B27AD6A6520E14
SHA256:49011631EBE70FD3D0949C04EB14202061DFF1E514F3826A5C953DD12B9A5415
6352firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.json.tmpbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
6352firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs-1.jstext
MD5:1A6C4EA143BEF21202B27AD6A6520E14
SHA256:49011631EBE70FD3D0949C04EB14202061DFF1E514F3826A5C953DD12B9A5415
6352firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
6352firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
30
TCP/UDP connections
122
DNS requests
144
Threats
36

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6352
firefox.exe
POST
200
172.64.149.23:80
http://ocsp.sectigo.com/
unknown
—
—
whitelisted
6352
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
6352
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
6352
firefox.exe
POST
200
172.64.149.23:80
http://ocsp.sectigo.com/
unknown
—
—
whitelisted
6352
firefox.exe
POST
200
142.250.186.35:80
http://o.pki.goog/s/wr3/yvU
unknown
—
—
whitelisted
6352
firefox.exe
POST
200
172.64.149.23:80
http://ocsp.sectigo.com/
unknown
—
—
whitelisted
6352
firefox.exe
POST
200
142.250.186.35:80
http://o.pki.goog/wr2
unknown
—
—
whitelisted
6352
firefox.exe
POST
200
184.24.77.48:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
6352
firefox.exe
POST
200
184.24.77.54:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
6352
firefox.exe
POST
200
184.24.77.54:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5488
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1764
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6352
firefox.exe
34.117.188.166:443
contile.services.mozilla.com
—
—
whitelisted
6352
firefox.exe
31.216.145.5:443
mega.nz
Datacenter Luxembourg S.A.
LU
whitelisted
6352
firefox.exe
34.107.221.82:80
detectportal.firefox.com
GOOGLE
US
whitelisted
6352
firefox.exe
34.107.243.93:443
push.services.mozilla.com
—
—
whitelisted
6352
firefox.exe
142.250.184.202:443
safebrowsing.googleapis.com
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.142
whitelisted
detectportal.firefox.com
  • 34.107.221.82
whitelisted
mega.nz
  • 31.216.145.5
  • 31.216.144.5
  • 2a0b:e46:1:145::5
  • 2a0b:e46:1:144::5
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
contile.services.mozilla.com
  • 34.117.188.166
whitelisted
example.org
  • 93.184.215.14
whitelisted
ipv4only.arpa
  • 192.0.0.171
  • 192.0.0.170
whitelisted
spocs.getpocket.com
  • 34.117.188.166
whitelisted
prod.ads.prod.webservices.mozgcp.net
  • 34.117.188.166
unknown

Threats

PID
Process
Class
Message
2172
svchost.exe
Misc activity
ET INFO File Sharing Related Domain in DNS Lookup (mega .nz)
6352
firefox.exe
Misc activity
ET INFO File Sharing Domain Observed in TLS SNI (mega .nz)
2172
svchost.exe
Misc activity
ET INFO File Sharing Related Domain in DNS Lookup (mega .nz)
2172
svchost.exe
Misc activity
ET INFO File Sharing Related Domain in DNS Lookup (mega .nz)
6352
firefox.exe
Misc activity
ET INFO File Sharing Domain Observed in TLS SNI (mega .nz)
2172
svchost.exe
Misc activity
ET INFO Observed DNS Query to Filesharing Service (mega .co .nz)
2172
svchost.exe
Misc activity
ET INFO Observed DNS Query to Filesharing Service (mega .co .nz)
2172
svchost.exe
Misc activity
ET INFO Observed DNS Query to Filesharing Service (mega .co .nz)
2172
svchost.exe
Misc activity
ET INFO Observed DNS Query to Filesharing Service (mega .co .nz)
2172
svchost.exe
Misc activity
ET INFO Observed DNS Query to Filesharing Service (mega .co .nz)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://mega.nz/folder/vcNjBZjR#N8xOcUK6FO4DjsdcyLcnqQ