URL:

https://firebasestorage.googleapis.com/v0/b/remasd-6c702.firebasestorage.app/o/image.jpg?alt=media&token=c16438a4-4eeb-4116-adc7-373fbf7359b0

Full analysis: https://app.any.run/tasks/502f7980-4622-4ffb-8c1d-9485504797c0
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 31, 2026, 12:02:42
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stego
payload
ta558
apt
stegocampaign
loader
reverseloader
Indicators:
MD5:

5A5CBE743DF10239AF707723084775AB

SHA1:

7E0B215A333710A17ECE43FE86F2612037B41554

SHA256:

9746EE0BE01B3DDD21A72A5D5C9911D7228C34288311423BFB10B8A4B105983A

SSDEEP:

3:N8dHElMKKhmHEVJ/+TF+QHiZKMIU7HjRqLYPRW5KDIWMy:2FElLZH/TvC0MIOcKRW5KIo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • STEGOCAMPAIGN has been detected (SURICATA)

      • firefox.exe (PID: 1984)

    • REVERSELOADER has been detected (SURICATA)

      • firefox.exe (PID: 1984)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • firefox.exe (PID: 8344)
      • firefox.exe (PID: 1984)

    • Manual execution by a user

      • mspaint.exe (PID: 2288)

    • Drops script file

      • firefox.exe (PID: 1984)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
161
Monitored processes
15
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start firefox.exe no specs #STEGOCAMPAIGN firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs mspaint.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1116"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2420 -prefsLen 39330 -prefMapHandle 4460 -prefMapSize 272981 -jsInitHandle 4988 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 4916 -initialChannelId {42fcf681-5a22-4d5e-aeb0-85e66f615e2c} -parentPid 1984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1984" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140_1.dll
c:\windows\system32\bcrypt.dll
1848"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250227124745 -prefsHandle 3320 -prefsLen 37207 -prefMapHandle 3324 -prefMapSize 272981 -ipcHandle 3332 -initialChannelId {12b6e81c-f70d-44f6-ad41-314ccd3655d0} -parentPid 1984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1984" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rddC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
1
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_1.dll
c:\windows\system32\crypt32.dll
1984"C:\Program Files\Mozilla Firefox\firefox.exe" https://firebasestorage.googleapis.com/v0/b/remasd-6c702.firebasestorage.app/o/image.jpg?alt=media&token=c16438a4-4eeb-4116-adc7-373fbf7359b0C:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
2016"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4868 -prefsLen 45319 -prefMapHandle 4888 -prefMapSize 272981 -jsInitHandle 4900 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 2740 -initialChannelId {50f461e4-3fb0-4c8d-b48a-64e0b12e36c9} -parentPid 1984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1984" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\vcruntime140_1.dll
c:\windows\system32\bcrypt.dll
2288"C:\WINDOWS\system32\mspaint.exe" "C:\Users\admin\Downloads\image.jpg"C:\Windows\System32\mspaint.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2572"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250227124745 -prefsHandle 1944 -prefsLen 36521 -prefMapHandle 1948 -prefMapSize 272981 -ipcHandle 1912 -initialChannelId {71ba935b-04b9-4148-9017-802dbaf590e8} -parentPid 1984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1984" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
1
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\cryptbase.dll
4700"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3936 -prefsLen 45165 -prefMapHandle 3940 -prefMapSize 272981 -jsInitHandle 3944 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 3952 -initialChannelId {01fb51ad-9f9e-4681-83dd-227e4e49bae9} -parentPid 1984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1984" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\msvcp140.dll
5100"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3236 -prefsLen 31275 -prefMapHandle 3240 -prefMapSize 272981 -jsInitHandle 3244 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 3252 -initialChannelId {4e84194f-6563-4b3a-b5ea-9be8788dff41} -parentPid 1984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1984" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_1.dll
5520"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250227124745 -sandboxingKind 4 -prefsHandle 4872 -prefsLen 45400 -prefMapHandle 4876 -prefMapSize 272981 -ipcHandle 5392 -initialChannelId {e857af0a-5c68-4a6f-b3ed-e2fb86910a66} -parentPid 1984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1984" -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utilityC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
1
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\vcruntime140_1.dll
6240"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4868 -prefsLen 39330 -prefMapHandle 4872 -prefMapSize 272981 -jsInitHandle 4876 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 3796 -initialChannelId {872fe565-0123-4650-8705-0090b02fbfb4} -parentPid 1984 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1984" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\vcruntime140_1.dll
Total events
791
Read events
762
Write events
28
Delete events
1

Modification events

(PID) Process:(2288) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:WindowPlacement
Value:
2C00000000000000010000000000000000000000FFFFFFFFFFFFFFFF870000004C000000C7040000B2020000
(PID) Process:(2288) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ShowThumbnail
Value:
0
(PID) Process:(2288) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:BMPWidth
Value:
0
(PID) Process:(2288) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:BMPHeight
Value:
0
(PID) Process:(2288) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ThumbXPos
Value:
0
(PID) Process:(2288) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ThumbYPos
Value:
0
(PID) Process:(2288) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ThumbWidth
Value:
0
(PID) Process:(2288) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ThumbHeight
Value:
0
(PID) Process:(2288) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:UnitSetting
Value:
0
(PID) Process:(2288) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ShowRulers
Value:
0
Executable files
0
Suspicious files
248
Text files
55
Unknown types
0

Dropped files

PID
Process
Filename
Type
1984firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
1984firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs-1.jstext
MD5:AA67738B5778177FD33C852DE2187A82
SHA256:CA9F8B9F4C97C66EFD4FC504F0B50C380C25788508FF8B1F6166F10F50B359B7
1984firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
1984firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\activity-stream.discovery_stream.jsontext
MD5:EFFB621901AE4C3C99EC4DDF2EA1635A
SHA256:357EB4C17A7C7F33BA6869E8013445582A07F437DDC8BEC9D0FD416CCBDA241A
1984firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-child-current.binbinary
MD5:5152D8F49F1AD4219D935611EFE18437
SHA256:9A6E50715E3C49A43E3D622EDE7E37ECF0767342B3039B8B0AE25BBE4FF6F66E
1984firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.json.tmptext
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
1984firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\urlCache-current.binbinary
MD5:3134ED3F12E4F4F8643DB90043B0FD7B
SHA256:26E4F122034D7A03F6DA0E707799B09CBEEBDAF8D7A3133A1F7BD894AC72EEA1
1984firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
1984firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cookies.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
1984firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.jsontext
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
78
TCP/UDP connections
51
DNS requests
80
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1984
firefox.exe
GET
101
34.107.243.93:443
https://push.services.mozilla.com/
US
—
—
unknown
1984
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
US
text
90 b
unknown
1984
firefox.exe
POST
200
172.217.16.195:80
http://o.pki.goog/we2
US
binary
280 b
whitelisted
1984
firefox.exe
POST
200
172.217.16.195:80
http://o.pki.goog/s/wr3/peI
US
binary
472 b
whitelisted
1984
firefox.exe
POST
200
172.217.16.195:80
http://o.pki.goog/we2
US
binary
280 b
whitelisted
1984
firefox.exe
GET
200
151.101.65.91:443
https://firefox.settings.services.mozilla.com/v1/
US
text
1.20 Kb
unknown
1984
firefox.exe
GET
200
151.101.65.91:443
https://firefox.settings.services.mozilla.com/v1/buckets/monitor/collections/changes/changeset?collection=url-parser-default-unknown-schemes-interventions&bucket=main&_expected=0
US
text
274 b
unknown
1984
firefox.exe
GET
200
151.101.65.91:443
https://firefox.settings.services.mozilla.com/v1/buckets/monitor/collections/changes/changeset?collection=hijack-blocklists&bucket=main&_expected=0
US
text
243 b
unknown
1984
firefox.exe
GET
200
151.101.65.91:443
https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/hijack-blocklists?_expected=1605801189258
US
text
1.68 Kb
unknown
1984
firefox.exe
GET
200
34.36.137.203:443
https://contile.services.mozilla.com/v1/tiles
US
text
4.99 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
7004
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3656
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6768
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
1984
firefox.exe
151.101.65.91:443
firefox.settings.services.mozilla.com
FASTLY
US
whitelisted
1984
firefox.exe
172.217.16.170:443
firebasestorage.googleapis.com
GOOGLE
US
whitelisted
1984
firefox.exe
34.107.221.82:80
detectportal.firefox.com
GOOGLE-CLOUD-PLATFORM
US
whitelisted
1984
firefox.exe
34.36.137.203:443
contile.services.mozilla.com
GOOGLE-CLOUD-PLATFORM
US
whitelisted
1984
firefox.exe
172.217.16.195:80
o.pki.goog
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
  • 40.127.240.158
whitelisted
google.com
  • 172.217.16.174
whitelisted
self.events.data.microsoft.com
  • 104.208.16.92
whitelisted
firefox.settings.services.mozilla.com
  • 151.101.65.91
  • 151.101.1.91
  • 151.101.129.91
  • 151.101.193.91
whitelisted
mozilla.map.fastly.net
  • 151.101.65.91
  • 151.101.1.91
  • 151.101.129.91
  • 151.101.193.91
  • 2a04:4e42::347
  • 2a04:4e42:200::347
  • 2a04:4e42:400::347
  • 2a04:4e42:600::347
whitelisted
firebasestorage.googleapis.com
  • 172.217.16.170
  • 142.250.201.74
  • 216.58.206.42
  • 172.217.16.202
  • 142.250.184.234
  • 142.251.141.74
  • 142.251.208.170
  • 142.250.185.138
  • 172.217.18.10
  • 142.251.141.106
  • 142.251.140.170
  • 142.251.141.138
  • 142.250.185.170
  • 216.58.206.74
  • 142.251.208.10
  • 172.217.20.138
  • 2a00:1450:4001:806::200a
  • 2a00:1450:4001:809::200a
  • 2a00:1450:4001:807::200a
  • 2a00:1450:4001:80a::200a
whitelisted
detectportal.firefox.com
  • 34.107.221.82
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
contile.services.mozilla.com
  • 34.36.137.203
whitelisted
spocs.getpocket.com
  • 34.36.137.203
whitelisted

Threats

PID
Process
Class
Message
1984
firefox.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to connect to TLS FireBase Storage
1984
firefox.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to connect to TLS FireBase Storage
1984
firefox.exe
A Network Trojan was detected
ET MALWARE Base64 Encoded MZ In Image
1984
firefox.exe
A Network Trojan was detected
PAYLOAD [ANY.RUN] Stegocampaign Jpeg with base64 added (TA558)
1984
firefox.exe
A Network Trojan was detected
PAYLOAD [ANY.RUN] Base64 encoded PE EXE file inside JPEG image
1984
firefox.exe
A Network Trojan was detected
ET MALWARE ReverseLoader Reverse Base64 Encoded Executable In Image M2
7004
svchost.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
1984
firefox.exe
A Network Trojan was detected
ET MALWARE Base64 Encoded MZ In Image
1984
firefox.exe
A Network Trojan was detected
PAYLOAD [ANY.RUN] Base64 encoded PE EXE file inside JPEG image
1984
firefox.exe
A Network Trojan was detected
PAYLOAD [ANY.RUN] Stegocampaign Jpeg with base64 added (TA558)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://firebasestorage.googleapis.com/v0/b/remasd-6c702.firebasestorage.app/o/image.jpg?alt=media&token=c16438a4-4eeb-4116-adc7-373fbf7359b0