URL:

HTTP://fg.ds.b1.download.windowsupdate.com/

Full analysis: https://app.any.run/tasks/e88a7422-eb5f-4630-ad30-c9ac8507d16a
Verdict: Malicious activity
Analysis date: January 23, 2022, 20:31:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

47C0A1BA11077FB1B8B1A6D37F075FA5

SHA1:

383C02999E0CA120899C23E8FD2CCC32F64D1E0F

SHA256:

0A0D433E9A3240D31990565E4A4CA3F829645B10F97E0EC2EFA2C922053830DE

SSDEEP:

3:CKDIg4L0Wd9r4E3:CYHG3d9L

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Reads CPU info

      • firefox.exe (PID: 3856)

    • Reads the computer name

      • firefox.exe (PID: 3876)
      • firefox.exe (PID: 3472)
      • firefox.exe (PID: 3856)
      • firefox.exe (PID: 4020)
      • firefox.exe (PID: 836)
      • firefox.exe (PID: 2844)
      • firefox.exe (PID: 3476)

    • Checks supported languages

      • firefox.exe (PID: 1408)
      • firefox.exe (PID: 3472)
      • firefox.exe (PID: 836)
      • firefox.exe (PID: 3876)
      • firefox.exe (PID: 2844)
      • firefox.exe (PID: 4020)
      • firefox.exe (PID: 3856)
      • firefox.exe (PID: 3476)

    • Application launched itself

      • firefox.exe (PID: 3856)
      • firefox.exe (PID: 1408)

    • Creates files in the program directory

      • firefox.exe (PID: 3856)

    • Creates files in the user directory

      • firefox.exe (PID: 3856)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
8
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1408"C:\Program Files\Mozilla Firefox\firefox.exe" "HTTP://fg.ds.b1.download.windowsupdate.com/"C:\Program Files\Mozilla Firefox\firefox.exe—Explorer.EXE
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
3856"C:\Program Files\Mozilla Firefox\firefox.exe" HTTP://fg.ds.b1.download.windowsupdate.com/C:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
3876"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3856.0.885938514\1766791676" -parentBuildID 20201112153044 -prefsHandle 1100 -prefMapHandle 816 -prefsLen 1 -prefMapSize 238726 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3856 "\\.\pipe\gecko-crash-server-pipe.3856" 1192 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msasn1.dll
836"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3856.6.387968129\664981605" -childID 1 -isForBrowser -prefsHandle 2132 -prefMapHandle 2128 -prefsLen 245 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3856 "\\.\pipe\gecko-crash-server-pipe.3856" 2144 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
3472"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3856.13.461783567\500121572" -childID 2 -isForBrowser -prefsHandle 3228 -prefMapHandle 3224 -prefsLen 6644 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3856 "\\.\pipe\gecko-crash-server-pipe.3856" 3240 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msasn1.dll
4020"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3856.20.1269734455\604046154" -childID 3 -isForBrowser -prefsHandle 3708 -prefMapHandle 3744 -prefsLen 7378 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3856 "\\.\pipe\gecko-crash-server-pipe.3856" 3736 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
3476"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3856.21.1640560613\1778262101" -childID 4 -isForBrowser -prefsHandle 3832 -prefMapHandle 3828 -prefsLen 7378 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3856 "\\.\pipe\gecko-crash-server-pipe.3856" 3724 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
2844"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3856.34.165780432\378951340" -childID 5 -isForBrowser -prefsHandle 3984 -prefMapHandle 3980 -prefsLen 7378 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3856 "\\.\pipe\gecko-crash-server-pipe.3856" 4012 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
83.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\kernel32.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
Total events
8 181
Read events
8 157
Write events
24
Delete events
0

Modification events

(PID) Process:(1408) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Launcher
Value:
30FC34E641010000
(PID) Process:(3856) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Browser
Value:
E10335E641010000
(PID) Process:(3856) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry
Value:
0
(PID) Process:(3856) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\DllPrefetchExperiment
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
0
(PID) Process:(3856) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|DisableTelemetry
Value:
1
(PID) Process:(3856) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|DisableDefaultBrowserAgent
Value:
0
(PID) Process:(3856) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|ServicesSettingsServer
Value:
https://firefox.settings.services.mozilla.com/v1
(PID) Process:(3856) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|SecurityContentSignatureRootHash
Value:
97:E8:BA:9C:F1:2F:B3:DE:53:CC:42:A4:E6:57:7E:D6:4D:F4:93:C2:47:B4:14:FE:A0:36:81:8D:38:23:56:0E
(PID) Process:(3856) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3856) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000003B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
0
Suspicious files
106
Text files
30
Unknown types
19

Dropped files

PID
Process
Filename
Type
3856firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
3856firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite —
MD5:—
SHA256:—
3856firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\places.sqlite-walsqlite-wal
MD5:E53C94E271C896989479BE4B6AAB3CF8
SHA256:5258910DE69BCB72FC16CF8F8786E5CF244B79BC71E5DCB734DC7E188249829F
3856firefox.exeC:\Users\admin\AppData\Local\Temp\mz_etilqs_P02hTzzIFSUOghTbinary
MD5:BA7170ED996F161B36D08B0A63D6F428
SHA256:FC6C95893ED897774B0914E43B19A46067B9CDD8C3F0D5E3E9937023CE067FA1
3856firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\protections.sqlite-journalbinary
MD5:1B915458AC6179B777F74EA1EC7FFA59
SHA256:9885D17DA5BD8BFA39E7140F87BAE919355464EF16AEAEF346B475E61B8750DC
3856firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-walbinary
MD5:2C5BE96330E0E795F0749EE946FD0E01
SHA256:C8D813B0B9BB4512D33E0292C535D530BCAF92DE120F38D0CD1139322F24A16E
3856firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
3856firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.binbinary
MD5:994A33896BB41A278A315D0D796422B6
SHA256:54EC50A20FFF8CC016710E49437CF6A11D3FE5EE7B28C185E4A9AAFEE2908B63
3856firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
3856firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
28
TCP/UDP connections
53
DNS requests
70
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3856
firefox.exe
GET
—
52.238.248.1:80
http://fe2.update.microsoft.com/windowsupdate/v6/shared/js/webcomtop.js?637785667145149310
US
—
—
whitelisted
3856
firefox.exe
POST
—
93.184.220.29:80
http://ocsp.digicert.com/
US
—
—
whitelisted
3856
firefox.exe
GET
200
52.238.248.1:80
http://fe2.update.microsoft.com/
US
html
5.09 Kb
whitelisted
3856
firefox.exe
GET
200
52.238.248.1:80
http://fe2.update.microsoft.com/windowsupdate/v6/thanks.aspx?ln=en&&thankspage=5
US
html
1.87 Kb
whitelisted
3856
firefox.exe
POST
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3
US
der
472 b
whitelisted
3856
firefox.exe
GET
302
52.185.71.28:80
http://windowsupdate.microsoft.com/
US
html
155 b
malicious
3856
firefox.exe
GET
200
2.16.106.171:80
http://fg.ds.b1.download.windowsupdate.com/
unknown
html
402 b
whitelisted
3856
firefox.exe
GET
302
52.238.248.1:80
http://fe2.update.microsoft.com/windowsupdate/v6/shared/js/tgar.js?637785667145149310
US
html
151 b
whitelisted
3856
firefox.exe
GET
200
52.238.248.1:80
http://fe2.update.microsoft.com/windowsupdate/v6/shared/js/resultslist.js?637785667145149310
US
text
15.6 Kb
whitelisted
3856
firefox.exe
GET
200
52.238.248.1:80
http://fe2.update.microsoft.com/windowsupdate/v6/shared/js/spupdateids.js?637785667145149310
US
text
2.24 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3856
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3856
firefox.exe
172.217.18.106:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
3856
firefox.exe
34.107.221.82:80
detectportal.firefox.com
—
US
whitelisted
3856
firefox.exe
52.185.71.28:80
windowsupdate.microsoft.com
Microsoft Corporation
US
malicious
3856
firefox.exe
65.9.82.111:443
content-signature-2.cdn.mozilla.net
AT&T Services, Inc.
US
unknown
3856
firefox.exe
65.9.82.55:443
firefox.settings.services.mozilla.com
AT&T Services, Inc.
US
unknown
3856
firefox.exe
52.238.248.1:80
fe2.update.microsoft.com
Microsoft Corporation
US
unknown
3856
firefox.exe
2.16.106.171:80
fg.ds.b1.download.windowsupdate.com
Akamai International B.V.
—
whitelisted
3856
firefox.exe
142.250.185.163:80
ocsp.pki.goog
Google Inc.
US
whitelisted
3856
firefox.exe
54.187.205.23:443
location.services.mozilla.com
Amazon.com, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
detectportal.firefox.com
  • 34.107.221.82
whitelisted
fg.ds.b1.download.windowsupdate.com
  • 2.16.106.171
  • 2.16.106.233
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
a767.dspw65.akamai.net
  • 2.16.106.233
  • 2.16.106.171
  • 2a02:26f0:6c00::210:ba38
  • 2a02:26f0:6c00::210:ba51
  • 2a02:26f0:6c00::210:ba59
malicious
firefox.settings.services.mozilla.com
  • 65.9.82.55
  • 65.9.82.93
  • 65.9.82.11
  • 65.9.82.97
whitelisted
example.org
  • 93.184.216.34
whitelisted
ipv4only.arpa
  • 192.0.0.171
  • 192.0.0.170
whitelisted
location.services.mozilla.com
  • 54.187.205.23
  • 35.163.112.241
  • 52.89.132.147
  • 35.82.27.113
  • 52.11.104.45
  • 34.215.15.15
whitelisted
locprod2-elb-us-west-2.prod.mozaws.net
  • 34.215.15.15
  • 52.11.104.45
  • 35.82.27.113
  • 52.89.132.147
  • 35.163.112.241
  • 54.187.205.23
whitelisted
windowsupdate.microsoft.com
  • 52.185.71.28
malicious

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
—
—
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
HTTP://fg.ds.b1.download.windowsupdate.com/