URL:

https://l.instagram.com/?u=https%3A%2F%2Fbit.ly%2F3KksM9N&e=ATN8fRWa-RCO46kBfeQGSprZRvZcqCqORyXVZi0YPRd3ONXmNetEQRgUyVRWRNHPbtLBCYfITNOUcvSkJXmNTg&s=1

Full analysis: https://app.any.run/tasks/9e7c2de9-cd60-41c2-8387-7b020d6852ed
Verdict: Malicious activity
Analysis date: January 18, 2022, 18:46:37
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

473D4D33F52CA85EE8BEE79A5BCB8CC8

SHA1:

E880A22EB38139F62BB2C8E0E0A174002B0A78AA

SHA256:

19EA2C6342D988880DCA8B98EE026422F6F71CF184ACA972A9652AF8C581366B

SSDEEP:

3:N8LDEKyGa5R8AWCXjstSykC8Kmq3wqLkxWQ9IQzcwrt1u8DstqErvn:2EKyNPzsYykCxwqdQ9rzcetUS+qq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Reads the computer name

      • firefox.exe (PID: 3500)
      • firefox.exe (PID: 996)
      • firefox.exe (PID: 2404)
      • firefox.exe (PID: 3324)
      • firefox.exe (PID: 3472)
      • firefox.exe (PID: 1740)

    • Checks supported languages

      • firefox.exe (PID: 3816)
      • firefox.exe (PID: 2404)
      • firefox.exe (PID: 3500)
      • firefox.exe (PID: 3472)
      • firefox.exe (PID: 1740)
      • firefox.exe (PID: 996)
      • firefox.exe (PID: 3324)

    • Application launched itself

      • firefox.exe (PID: 3816)
      • firefox.exe (PID: 3500)

    • Reads CPU info

      • firefox.exe (PID: 3500)

    • Reads the date of Windows installation

      • firefox.exe (PID: 3500)

    • Creates files in the program directory

      • firefox.exe (PID: 3500)

    • Dropped object may contain Bitcoin addresses

      • firefox.exe (PID: 3500)

    • Creates files in the user directory

      • firefox.exe (PID: 3500)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
7
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
996"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3500.6.387968129\664981605" -childID 1 -isForBrowser -prefsHandle 2796 -prefMapHandle 2792 -prefsLen 245 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3500 "\\.\pipe\gecko-crash-server-pipe.3500" 2808 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\rpcrt4.dll
1740"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3500.20.1100399054\1954023180" -childID 3 -isForBrowser -prefsHandle 3460 -prefMapHandle 3092 -prefsLen 7399 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3500 "\\.\pipe\gecko-crash-server-pipe.3500" 3544 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
2404"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3500.0.885938514\1766791676" -parentBuildID 20201112153044 -prefsHandle 1116 -prefMapHandle 1108 -prefsLen 1 -prefMapSize 238726 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3500 "\\.\pipe\gecko-crash-server-pipe.3500" 1188 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
3324"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3500.27.791338708\1863012569" -childID 4 -isForBrowser -prefsHandle 3836 -prefMapHandle 3724 -prefsLen 7470 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3500 "\\.\pipe\gecko-crash-server-pipe.3500" 3848 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msasn1.dll
3472"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3500.13.1785447372\1999469669" -childID 2 -isForBrowser -prefsHandle 3052 -prefMapHandle 3048 -prefsLen 6644 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3500 "\\.\pipe\gecko-crash-server-pipe.3500" 3072 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
3500"C:\Program Files\Mozilla Firefox\firefox.exe" https://l.instagram.com/?u=https%3A%2F%2Fbit.ly%2F3KksM9N&e=ATN8fRWa-RCO46kBfeQGSprZRvZcqCqORyXVZi0YPRd3ONXmNetEQRgUyVRWRNHPbtLBCYfITNOUcvSkJXmNTg&s=1C:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
3816"C:\Program Files\Mozilla Firefox\firefox.exe" "https://l.instagram.com/?u=https%3A%2F%2Fbit.ly%2F3KksM9N&e=ATN8fRWa-RCO46kBfeQGSprZRvZcqCqORyXVZi0YPRd3ONXmNetEQRgUyVRWRNHPbtLBCYfITNOUcvSkJXmNTg&s=1"C:\Program Files\Mozilla Firefox\firefox.exe—Explorer.EXE
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
Total events
9 003
Read events
8 979
Write events
24
Delete events
0

Modification events

(PID) Process:(3816) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Launcher
Value:
9EF386EC63010000
(PID) Process:(3500) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Browser
Value:
7BFD86EC63010000
(PID) Process:(3500) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry
Value:
0
(PID) Process:(3500) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\DllPrefetchExperiment
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
0
(PID) Process:(3500) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|DisableTelemetry
Value:
1
(PID) Process:(3500) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|DisableDefaultBrowserAgent
Value:
0
(PID) Process:(3500) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|ServicesSettingsServer
Value:
https://firefox.settings.services.mozilla.com/v1
(PID) Process:(3500) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|SecurityContentSignatureRootHash
Value:
97:E8:BA:9C:F1:2F:B3:DE:53:CC:42:A4:E6:57:7E:D6:4D:F4:93:C2:47:B4:14:FE:A0:36:81:8D:38:23:56:0E
(PID) Process:(3500) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3500) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000003B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
0
Suspicious files
133
Text files
36
Unknown types
44

Dropped files

PID
Process
Filename
Type
3500firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
3500firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite —
MD5:—
SHA256:—
3500firefox.exeC:\Users\admin\AppData\Local\Temp\mz_etilqs_XmqdNOR5lhiCrhRbinary
MD5:—
SHA256:—
3500firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\settings\main\ms-language-packs\asrouter.ftltext
MD5:—
SHA256:—
3500firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\settings\main\ms-language-packs\asrouter.ftl.tmptext
MD5:—
SHA256:—
3500firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-walbinary
MD5:—
SHA256:—
3500firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.binbinary
MD5:994A33896BB41A278A315D0D796422B6
SHA256:54EC50A20FFF8CC016710E49437CF6A11D3FE5EE7B28C185E4A9AAFEE2908B63
3500firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-new.bin —
MD5:—
SHA256:—
3500firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache.bin —
MD5:—
SHA256:—
3500firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.jsonbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
36
TCP/UDP connections
115
DNS requests
178
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3500
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3500
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3500
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3500
firefox.exe
GET
200
172.96.184.185:80
http://kyra.gcannamarie3my.xyz/QVpDSTQsUEFSVE5FUi1TQVRJVkEsMTY0MjMwMzcyMCxodHRwczovL3d3dy5mYWNlYm9vay5jb20vLElNT05FVElaRUlU
NL
compressed
496 b
malicious
3500
firefox.exe
GET
302
172.96.184.185:80
http://kyra.gcannamarie3my.xyz/_meetups/?click_id=partner-sativa&country_code=GB&lp=IMONETIZEIT&user_agent=WEB&user_ip=185.217.117.55&guid=21e329e47024cea1a018a264e46d1ba4
NL
compressed
496 b
malicious
3500
firefox.exe
GET
200
172.96.184.185:80
http://kyra.gcannamarie3my.xyz/_meetups/r.php?click_id=sativa&country_code=GB&lp=IMONETIZEIT&user_agent=WEB&user_ip=185.217.117.55&guid=4a592c0fd26968255ab4c4ee19f7f68e
NL
compressed
435 b
malicious
3500
firefox.exe
POST
200
142.250.185.163:80
http://ocsp.pki.goog/gts1c3
US
der
471 b
whitelisted
3500
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3500
firefox.exe
POST
200
2.16.186.26:80
http://r3.o.lencr.org/
unknown
der
503 b
shared
3500
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3500
firefox.exe
99.86.3.56:443
content-signature-2.cdn.mozilla.net
AT&T Services, Inc.
US
unknown
3500
firefox.exe
34.215.15.15:443
location.services.mozilla.com
Amazon.com, Inc.
US
unknown
3500
firefox.exe
31.13.84.52:443
l.instagram.com
Facebook, Inc.
IE
unknown
3500
firefox.exe
216.58.212.170:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
3500
firefox.exe
65.9.58.116:443
firefox-settings-attachments.cdn.mozilla.net
AT&T Services, Inc.
US
unknown
3500
firefox.exe
143.204.215.89:443
snippets.cdn.mozilla.net
—
US
malicious
3500
firefox.exe
143.204.215.65:443
snippets.cdn.mozilla.net
—
US
suspicious
3500
firefox.exe
143.204.215.37:443
firefox.settings.services.mozilla.com
—
US
malicious
3500
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3500
firefox.exe
52.35.145.245:443
push.services.mozilla.com
Amazon.com, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
detectportal.firefox.com
  • 34.107.221.82
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
l.instagram.com
  • 31.13.84.52
suspicious
instagram.c10r.instagram.com
  • 31.13.84.52
  • 2a03:2880:f207:c4:face:b00c:0:43fe
suspicious
firefox.settings.services.mozilla.com
  • 143.204.215.37
  • 143.204.215.75
  • 143.204.215.95
  • 143.204.215.126
whitelisted
location.services.mozilla.com
  • 34.215.15.15
  • 52.11.104.45
  • 54.187.205.23
  • 35.163.112.241
  • 52.89.132.147
  • 35.82.27.113
whitelisted
locprod2-elb-us-west-2.prod.mozaws.net
  • 35.82.27.113
  • 52.89.132.147
  • 35.163.112.241
  • 54.187.205.23
  • 52.11.104.45
  • 34.215.15.15
whitelisted
safebrowsing.googleapis.com
  • 216.58.212.170
  • 2a00:1450:4001:802::200a
whitelisted
example.org
  • 93.184.216.34
whitelisted
ipv4only.arpa
  • 192.0.0.171
  • 192.0.0.170
whitelisted

Threats

PID
Process
Class
Message
3500
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
3500
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
3500
firefox.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3500
firefox.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3500
firefox.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3500
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
3500
firefox.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://l.instagram.com/?u=https%3A%2F%2Fbit.ly%2F3KksM9N&e=ATN8fRWa-RCO46kBfeQGSprZRvZcqCqORyXVZi0YPRd3ONXmNetEQRgUyVRWRNHPbtLBCYfITNOUcvSkJXmNTg&s=1