URL:

https://oko.sh/idn4m7

Full analysis: https://app.any.run/tasks/35f83756-0514-4126-a0ce-81596602602d
Verdict: Malicious activity
Analysis date: May 05, 2019, 22:19:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

D0B03464DDED340569B2663556E6A2DE

SHA1:

395630E6A158553670F255FA4E7031C3EE7BE5C7

SHA256:

81847BCADD03558174088AD7421465A9D118FA93E7EBFF8077134F2FF5CE506B

SSDEEP:

3:N8HsC:29

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • FORTNITE LAG SPIKES FIX v8.51.exe (PID: 3508)
      • FORTNITE LAG SPIKES FIX v8.51.exe (PID: 2084)

    • Runs PING.EXE for delay simulation

      • cmd.exe (PID: 2588)

  • SUSPICIOUS

    • Creates files in the program directory

      • firefox.exe (PID: 300)

    • Starts CMD.EXE for commands execution

      • FORTNITE LAG SPIKES FIX v8.51.exe (PID: 2084)

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 300)

  • INFO

    • Reads settings of System Certificates

      • firefox.exe (PID: 300)

    • Dropped object may contain Bitcoin addresses

      • firefox.exe (PID: 300)

    • Reads CPU info

      • firefox.exe (PID: 300)

    • Application launched itself

      • firefox.exe (PID: 300)

    • Creates files in the user directory

      • firefox.exe (PID: 300)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
61
Monitored processes
24
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start drop and start start firefox.exe firefox.exe no specs firefox.exe firefox.exe firefox.exe firefox.exe fortnite lag spikes fix v8.51.exe no specs fortnite lag spikes fix v8.51.exe cmd.exe no specs ping.exe no specs ping.exe no specs ping.exe no specs ping.exe no specs ping.exe no specs ping.exe no specs ping.exe no specs ping.exe no specs ping.exe no specs ping.exe no specs ping.exe no specs ping.exe no specs ping.exe no specs ping.exe no specs ping.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
300"C:\Program Files\Mozilla Firefox\firefox.exe" https://oko.sh/idn4m7C:\Program Files\Mozilla Firefox\firefox.exe
explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
65.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
580ping localhost -n 2 C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
1096ping localhost-n 2 C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
1136ping localhost -n 2 C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
1784ping localhost -n 2 C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
1796ping localhost -n 5 C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
2040ping localhost -n 2 C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
2080"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="300.20.1238313004\131825448" -childID 3 -isForBrowser -prefsHandle 3764 -prefMapHandle 3784 -prefsLen 5824 -prefMapSize 180950 -schedulerPrefs 0001,2 -parentBuildID 20190225143501 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 300 "\\.\pipe\gecko-crash-server-pipe.300" 3788 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
65.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
2084"C:\Users\admin\Downloads\FORTNITE LAG SPIKES FIX v8.51.exe" C:\Users\admin\Downloads\FORTNITE LAG SPIKES FIX v8.51.exe
firefox.exe
User:
admin
Company:
ExtroTech Team ®
Integrity Level:
HIGH
Description:
www.youtube.com/extrotech
Exit code:
0
Version:
8. 5. 1. 0
Modules
Images
c:\users\admin\downloads\fortnite lag spikes fix v8.51.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2140ping localhost -n 5 C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
Total events
2 029
Read events
2 013
Write events
16
Delete events
0

Modification events

(PID) Process:(300) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(300) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000071000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(300) firefox.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(300) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(300) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
2
Suspicious files
786
Text files
255
Unknown types
305

Dropped files

PID
Process
Filename
Type
300firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
300firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\cache2\trash12669 —
MD5:—
SHA256:—
300firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js —
MD5:—
SHA256:—
300firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cert9.db-journal —
MD5:—
SHA256:—
300firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp —
MD5:—
SHA256:—
300firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm —
MD5:—
SHA256:—
300firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.binbinary
MD5:—
SHA256:—
300firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-child-current.binbinary
MD5:—
SHA256:—
300firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\cache2\entries\FDA0505FB3889AAA375DDD3676C5455F22555F3Ader
MD5:—
SHA256:—
300firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.jstext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
73
TCP/UDP connections
254
DNS requests
727
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
300
firefox.exe
POST
200
172.217.21.195:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
300
firefox.exe
POST
200
172.217.21.195:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
300
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
300
firefox.exe
POST
200
52.85.182.65:80
http://ocsp.sca1b.amazontrust.com/
US
der
471 b
whitelisted
300
firefox.exe
POST
200
172.217.21.195:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
300
firefox.exe
POST
200
2.21.242.245:80
http://ocsp.int-x3.letsencrypt.org/
NL
der
527 b
whitelisted
300
firefox.exe
POST
200
172.217.21.195:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
300
firefox.exe
POST
200
2.21.242.245:80
http://ocsp.int-x3.letsencrypt.org/
NL
der
527 b
whitelisted
300
firefox.exe
POST
200
172.217.21.195:80
http://ocsp.pki.goog/GTSGIAG3
US
der
471 b
whitelisted
300
firefox.exe
POST
200
2.21.242.245:80
http://ocsp.int-x3.letsencrypt.org/
NL
der
527 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
300
firefox.exe
52.27.144.31:443
aus5.mozilla.org
Amazon.com, Inc.
US
unknown
300
firefox.exe
104.27.88.82:443
oko.sh
Cloudflare Inc
US
shared
300
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
300
firefox.exe
2.16.106.152:80
detectportal.firefox.com
Akamai International B.V.
—
whitelisted
300
firefox.exe
54.200.51.65:443
search.services.mozilla.com
Amazon.com, Inc.
US
unknown
300
firefox.exe
172.217.16.202:443
fonts.googleapis.com
Google Inc.
US
whitelisted
300
firefox.exe
88.85.66.163:443
native.propellerclick.com
Webzilla B.V.
NL
unknown
300
firefox.exe
104.27.38.110:443
clk.sh
Cloudflare Inc
US
shared
300
firefox.exe
108.177.15.99:443
www.google.com
Google Inc.
US
whitelisted
300
firefox.exe
172.217.21.195:80
ocsp.pki.goog
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
detectportal.firefox.com
  • 2.16.106.152
  • 2.16.106.209
  • 23.62.98.16
  • 23.62.98.18
whitelisted
oko.sh
  • 104.27.88.82
  • 104.27.89.82
suspicious
aus5.mozilla.org
  • 52.27.144.31
  • 34.218.159.169
  • 34.216.134.104
  • 52.43.79.30
  • 34.214.241.105
  • 52.32.77.100
  • 52.40.226.98
  • 35.164.82.230
whitelisted
balrog-aus5.r53-2.services.mozilla.com
  • 35.164.82.230
  • 52.40.226.98
  • 52.32.77.100
  • 34.214.241.105
  • 52.43.79.30
  • 34.216.134.104
  • 34.218.159.169
  • 52.27.144.31
whitelisted
a1089.dscd.akamai.net
  • 2.16.106.209
  • 2.16.106.152
  • 23.62.98.18
  • 23.62.98.16
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
search.services.mozilla.com
  • 54.200.51.65
  • 52.10.42.204
  • 52.27.229.90
whitelisted
cs9.wac.phicdn.net
  • 93.184.220.29
whitelisted
search.r53-2.services.mozilla.com
  • 52.27.229.90
  • 52.10.42.204
  • 54.200.51.65
whitelisted
tiles.services.mozilla.com
  • 34.214.69.153
  • 35.165.22.140
  • 35.164.218.3
  • 35.164.130.113
  • 35.166.92.58
  • 52.35.250.5
  • 52.34.132.219
  • 52.26.103.165
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://oko.sh/idn4m7