File name:

info_importantMetaspin_Affilaites2025.com.txt

Full analysis: https://app.any.run/tasks/db4470fe-3943-4b55-8f45-40e629d0d853
Verdict: Malicious activity
Analysis date: June 04, 2025, 19:42:23
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 6 sections
MD5:

36E9E32809074B4433B3982441391A92

SHA1:

E269AE34CAC50A99CC8DC4FF606C659B3E2C46D6

SHA256:

ECA7889B628FB20AE86772DA86F6672D393BCEE3FF0E7A49A2F1E4F161CF8BC4

SSDEEP:

49152:zE/XUraxm5O9QMal0QRO8tXUYWmF052FmEQX2gpOmSP:z9rem5Oid4YWmF00kEQX2gpOpP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • python-3.13.4-amd64.exe (PID: 5428)

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • info_importantMetaspin_Affilaites2025.com.txt.exe (PID: 2644)
      • python-3.13.4-amd64.exe (PID: 5428)

    • Executable content was dropped or overwritten

      • python-3.13.4-amd64.exe (PID: 5428)
      • python-3.13.4-amd64.exe (PID: 6744)
      • info_importantMetaspin_Affilaites2025.com.txt.exe (PID: 2644)
      • Crtuim.com (PID: 7244)
      • MediaCoder.exe (PID: 7780)

    • Searches for installed software

      • python-3.13.4-amd64.exe (PID: 5428)

    • Creates a software uninstall entry

      • python-3.13.4-amd64.exe (PID: 5428)
      • Crtuim.com (PID: 7244)

    • The process drops C-runtime libraries

      • python-3.13.4-amd64.exe (PID: 5428)
      • msiexec.exe (PID: 6820)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6820)

    • Process drops legitimate windows executable

      • python-3.13.4-amd64.exe (PID: 5428)
      • Crtuim.com (PID: 7244)
      • msiexec.exe (PID: 6820)

    • Starts application with an unusual extension

      • info_importantMetaspin_Affilaites2025.com.txt.exe (PID: 2644)

    • Connects to unusual port

      • regsvr32.exe (PID: 6168)

    • Process drops python dynamic module

      • msiexec.exe (PID: 6820)

    • The process executes via Task Scheduler

      • regsvr32.exe (PID: 6168)

  • INFO

    • The sample compiled with english language support

      • info_importantMetaspin_Affilaites2025.com.txt.exe (PID: 2644)
      • firefox.exe (PID: 6032)
      • python-3.13.4-amd64.exe (PID: 5428)
      • Crtuim.com (PID: 7244)
      • msiexec.exe (PID: 6820)

    • Checks supported languages

      • info_importantMetaspin_Affilaites2025.com.txt.exe (PID: 2644)
      • python-3.13.4-amd64.exe (PID: 5428)
      • python-3.13.4-amd64.exe (PID: 6744)
      • msiexec.exe (PID: 6820)
      • Crtuim.com (PID: 7244)
      • _tinreg64.exe (PID: 5952)
      • MediaCoder.exe (PID: 7780)

    • Reads mouse settings

      • info_importantMetaspin_Affilaites2025.com.txt.exe (PID: 2644)

    • Reads the computer name

      • info_importantMetaspin_Affilaites2025.com.txt.exe (PID: 2644)
      • python-3.13.4-amd64.exe (PID: 5428)
      • msiexec.exe (PID: 6820)
      • Crtuim.com (PID: 7244)
      • MediaCoder.exe (PID: 7780)

    • The process uses AutoIt

      • info_importantMetaspin_Affilaites2025.com.txt.exe (PID: 2644)

    • Manual execution by a user

      • firefox.exe (PID: 5968)
      • MediaCoder.exe (PID: 7780)

    • Launching a file from the Downloads directory

      • firefox.exe (PID: 6032)

    • Checks proxy server information

      • slui.exe (PID: 6584)

    • Reads the software policy settings

      • slui.exe (PID: 6584)
      • msiexec.exe (PID: 6820)
      • info_importantMetaspin_Affilaites2025.com.txt.exe (PID: 2644)

    • Create files in a temporary directory

      • python-3.13.4-amd64.exe (PID: 6744)
      • python-3.13.4-amd64.exe (PID: 5428)
      • info_importantMetaspin_Affilaites2025.com.txt.exe (PID: 2644)
      • Crtuim.com (PID: 7244)
      • MediaCoder.exe (PID: 7780)

    • Application launched itself

      • firefox.exe (PID: 6032)
      • firefox.exe (PID: 5968)

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 6032)
      • msiexec.exe (PID: 6820)

    • Creates files or folders in the user directory

      • python-3.13.4-amd64.exe (PID: 5428)
      • msiexec.exe (PID: 6820)
      • Crtuim.com (PID: 7244)
      • MediaCoder.exe (PID: 7780)

    • Launching a file from a Registry key

      • python-3.13.4-amd64.exe (PID: 5428)

    • Reads the machine GUID from the registry

      • python-3.13.4-amd64.exe (PID: 5428)
      • msiexec.exe (PID: 6820)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 6820)

    • Reads Microsoft Office registry keys

      • Crtuim.com (PID: 7244)

    • Reads Environment values

      • Crtuim.com (PID: 7244)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:04:30 13:38:10+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.16
CodeSize: 734208
InitializedDataSize: 954880
UninitializedDataSize: -
EntryPoint: 0x2549c
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
CompanyName: DataSprint Team
FileDescription: DataSprint - High-Performance Spreadsheet Application
FileVersion: 1.0.0.1
InternalName: DataSprint
LegalCopyright: Copyright © 2025
OriginalFileName: DataSprint.exe
ProductName: DataSprint
ProductVersion: 1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
23
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start info_importantmetaspin_affilaites2025.com.txt.exe firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs slui.exe firefox.exe no specs python-3.13.4-amd64.exe python-3.13.4-amd64.exe msiexec.exe crtuim.com firefox.exe no specs _tinreg64.exe no specs mediacoder.exe firefox.exe no specs regsvr32.exe

Process information

PID
CMD
Path
Indicators
Parent process
1268"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2136 -parentBuildID 20240213221259 -prefsHandle 2128 -prefMapHandle 2124 -prefsLen 31031 -prefMapSize 244583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c0d5b04b-09d6-4e81-a57c-c6a29810ffac} 6032 "\\.\pipe\gecko-crash-server-pipe.6032" 1fdec082b10 socketC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\msvcp140.dll
2644"C:\Users\admin\Downloads\info_importantMetaspin_Affilaites2025.com.txt.exe" C:\Users\admin\Downloads\info_importantMetaspin_Affilaites2025.com.txt.exe
explorer.exe
User:
admin
Company:
DataSprint Team
Integrity Level:
MEDIUM
Description:
DataSprint - High-Performance Spreadsheet Application
Exit code:
0
Version:
1.0.0.1
Modules
Images
c:\users\admin\downloads\info_importantmetaspin_affilaites2025.com.txt.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\psapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\wsock32.dll
3176"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5408 -childID 5 -isForBrowser -prefsHandle 5328 -prefMapHandle 5332 -prefsLen 31243 -prefMapSize 244583 -jsInitHandle 1452 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e07b2ead-f8f1-4bed-94c1-0e5af15dac0b} 6032 "\\.\pipe\gecko-crash-server-pipe.6032" 1fe02330690 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
4180"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1888 -parentBuildID 20240213221259 -prefsHandle 1828 -prefMapHandle 1820 -prefsLen 31031 -prefMapSize 244583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {057406d5-a3c9-4d42-ae03-cffee5c4e88a} 6032 "\\.\pipe\gecko-crash-server-pipe.6032" 1fdf8fece10 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140.dll
4380"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2712 -childID 1 -isForBrowser -prefsHandle 2704 -prefMapHandle 2700 -prefsLen 31447 -prefMapSize 244583 -jsInitHandle 1452 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0fc6bdb2-98ca-4b04-b4a7-0773e514d2a5} 6032 "\\.\pipe\gecko-crash-server-pipe.6032" 1fdfd837d90 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\bcrypt.dll
4528"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4356 -childID 2 -isForBrowser -prefsHandle 4348 -prefMapHandle 4344 -prefsLen 36588 -prefMapSize 244583 -jsInitHandle 1452 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {29b72a5c-d994-4abd-b82b-b69206075b8a} 6032 "\\.\pipe\gecko-crash-server-pipe.6032" 1fdffdd5a10 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\vcruntime140_1.dll
5248"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5136 -childID 3 -isForBrowser -prefsHandle 5128 -prefMapHandle 5124 -prefsLen 31243 -prefMapSize 244583 -jsInitHandle 1452 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b9bbbf5b-c9dd-48e9-9b66-1b215bb4f6ed} 6032 "\\.\pipe\gecko-crash-server-pipe.6032" 1fe02330150 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\bcrypt.dll
5428"C:\Users\admin\AppData\Local\Temp\{8152D160-FD06-4A45-B66C-04A77F2DF5BA}\.cr\python-3.13.4-amd64.exe" -burn.clean.room="C:\Users\admin\Downloads\python-3.13.4-amd64.exe" -burn.filehandle.attached=584 -burn.filehandle.self=580 C:\Users\admin\AppData\Local\Temp\{8152D160-FD06-4A45-B66C-04A77F2DF5BA}\.cr\python-3.13.4-amd64.exe
python-3.13.4-amd64.exe
User:
admin
Company:
Python Software Foundation
Integrity Level:
MEDIUM
Description:
Python 3.13.4 (64-bit)
Version:
3.13.4150.0
Modules
Images
c:\users\admin\appdata\local\temp\{8152d160-fd06-4a45-b66c-04a77f2df5ba}\.cr\python-3.13.4-amd64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5576"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6956 -childID 9 -isForBrowser -prefsHandle 6900 -prefMapHandle 6888 -prefsLen 31645 -prefMapSize 244583 -jsInitHandle 1452 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e377e2a-a5e1-48b4-b2b1-4b1f482db7fc} 6032 "\\.\pipe\gecko-crash-server-pipe.6032" 1fe01d5f850 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
5952"C:\Users\admin\AppData\Local\Tronic Party\Uninstall\{D62D0FD7-2907-476C-8B28-B356A59917A5}\_tinreg64.exe" "C:\Users\admin\AppData\Local\Temp\SDL.dll" /c /rC:\Users\admin\AppData\Local\Tronic Party\Uninstall\{D62D0FD7-2907-476C-8B28-B356A59917A5}\_tinreg64.exe—Crtuim.com
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Out-of-process DLL registration helper
Exit code:
2147944213
Version:
2025.04.05.1640U
Modules
Images
c:\users\admin\appdata\local\tronic party\uninstall\{d62d0fd7-2907-476c-8b28-b356a59917a5}\_tinreg64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
40 407
Read events
37 261
Write events
3 096
Delete events
50

Modification events

(PID) Process:(6032) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
0
(PID) Process:(6032) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(5428) python-3.13.4-amd64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{33ef7f34-0a74-433d-abcb-6daed76d1558}
Operation:writeName:BundleCachePath
Value:
C:\Users\admin\AppData\Local\Package Cache\{33ef7f34-0a74-433d-abcb-6daed76d1558}\python-3.13.4-amd64.exe
(PID) Process:(5428) python-3.13.4-amd64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{33ef7f34-0a74-433d-abcb-6daed76d1558}
Operation:writeName:BundleUpgradeCode
Value:
{F96F59BD-3E48-5E4E-B1A4-6CAFADEFEAE8}
(PID) Process:(5428) python-3.13.4-amd64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{33ef7f34-0a74-433d-abcb-6daed76d1558}
Operation:writeName:BundleAddonCode
Value:
(PID) Process:(5428) python-3.13.4-amd64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{33ef7f34-0a74-433d-abcb-6daed76d1558}
Operation:writeName:BundleDetectCode
Value:
(PID) Process:(5428) python-3.13.4-amd64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{33ef7f34-0a74-433d-abcb-6daed76d1558}
Operation:writeName:BundlePatchCode
Value:
(PID) Process:(5428) python-3.13.4-amd64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{33ef7f34-0a74-433d-abcb-6daed76d1558}
Operation:writeName:BundleVersion
Value:
3.13.4150.0
(PID) Process:(5428) python-3.13.4-amd64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{33ef7f34-0a74-433d-abcb-6daed76d1558}
Operation:writeName:VersionMajor
Value:
3
(PID) Process:(5428) python-3.13.4-amd64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{33ef7f34-0a74-433d-abcb-6daed76d1558}
Operation:writeName:VersionMinor
Value:
13
Executable files
97
Suspicious files
221
Text files
1 304
Unknown types
87

Dropped files

PID
Process
Filename
Type
6032firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
6032firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cookies.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
6032firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite —
MD5:—
SHA256:—
6032firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-child-current.binbinary
MD5:22DA36CA5BA1D055ADE237F52DC825A7
SHA256:7438A5D5298BFA0ABAB51E6B35EAC0F26B830BCEFBDBEB5F07721DBA34F89E0D
6032firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\urlCache-current.binbinary
MD5:C09FF302D57C404B61E6A89B0B9F36E7
SHA256:6A5B4F82595799346D0E501FE6CC8629E0FD6ED27B74D0E6CB5073DDB2E3C40B
6032firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\datareporting\glean\db\data.safe.bindbf
MD5:3B156E12141F8CBCE9D60CDCE2077617
SHA256:E6287E44B44ABEA20E1B2E3F415D22B9E5E5FBBC155AD9DADBABA63951B2AF6F
6032firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
6032firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
6032firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\SiteSecurityServiceState.binbinary
MD5:1A6F7CB7871EA50350756271A64DFDE1
SHA256:2ECCB927178936B1FD102560B19EE42DCD0ABD98F88D506FDE42EBA6BD6EF1B2
6032firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.json.tmpbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
50
TCP/UDP connections
127
DNS requests
165
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6032
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
7564
svchost.exe
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6032
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
6032
firefox.exe
POST
200
142.250.184.227:80
http://o.pki.goog/s/wr3/FIY
unknown
—
—
whitelisted
6032
firefox.exe
POST
200
184.24.77.52:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
6032
firefox.exe
POST
200
184.24.77.52:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
6032
firefox.exe
POST
200
184.24.77.48:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
6032
firefox.exe
POST
200
142.250.184.227:80
http://o.pki.goog/we2
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
7564
svchost.exe
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
896
RUXIMICS.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7564
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6032
firefox.exe
34.107.221.82:80
detectportal.firefox.com
GOOGLE
US
whitelisted
6032
firefox.exe
34.36.137.203:443
contile.services.mozilla.com
GOOGLE-CLOUD-PLATFORM
US
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.19.11.120
  • 2.19.11.105
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 23.35.229.160
whitelisted
google.com
  • 142.250.185.238
whitelisted
detectportal.firefox.com
  • 34.107.221.82
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
contile.services.mozilla.com
  • 34.36.137.203
whitelisted
spocs.getpocket.com
  • 34.36.137.203
whitelisted
mc.prod.ads.prod.webservices.mozgcp.net
  • 34.36.137.203
whitelisted
example.org
  • 23.215.0.132
  • 96.7.128.186
  • 23.215.0.133
  • 96.7.128.192
whitelisted
ipv4only.arpa
  • 192.0.0.171
  • 192.0.0.170
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
info_importantMetaspin_Affilaites2025.com.txt