| URL: | https://oldreddit.com/ |
| Full analysis: | https://app.any.run/tasks/85d16df3-d0da-45d0-8d6e-f804543e11b4 |
| Verdict: | Malicious activity |
| Analysis date: | February 15, 2024, 23:08:22 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | 40EC8B789CC50BD9C4217D1AA505DBE4 |
| SHA1: | 1259A5C238A7557CDCB4748E9A99E6D298C4B929 |
| SHA256: | 9FB1ACD684A21A2EDAA1FCE7E1C17DF7FB91322B5EE079FC06272E4838744132 |
| SSDEEP: | 3:N8AhAuR:2ARR |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 116 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3672.14.342114897\1433875559" -childID 13 -isForBrowser -prefsHandle 1236 -prefMapHandle 4388 -prefsLen 31275 -prefMapSize 244195 -jsInitHandle 848 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {984e255a-4522-4c6a-9ef7-f4ff89c0f83b} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" 4392 137679b0 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 448 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3672.7.398884103\689620520" -childID 6 -isForBrowser -prefsHandle 4196 -prefMapHandle 4200 -prefsLen 29102 -prefMapSize 244195 -jsInitHandle 848 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {329aaf12-d1fb-485d-80fe-825bbd02fd31} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" 4184 217cd6d0 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 492 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3672.11.1424847807\741869477" -childID 10 -isForBrowser -prefsHandle 4336 -prefMapHandle 3212 -prefsLen 31275 -prefMapSize 244195 -jsInitHandle 848 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd673e2b-3608-46cc-9761-56c62d2a93ed} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" 4024 1f187b20 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 1020 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3672.16.1198656306\207394492" -childID 15 -isForBrowser -prefsHandle 3376 -prefMapHandle 3380 -prefsLen 31275 -prefMapSize 244195 -jsInitHandle 848 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ddb5d14-d85d-4515-b24a-1fe13187e9e7} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" 4368 2010a280 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 1392 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3672.8.1585911871\1995393376" -childID 7 -isForBrowser -prefsHandle 1960 -prefMapHandle 1996 -prefsLen 29628 -prefMapSize 244195 -jsInitHandle 848 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b71d1773-2c55-4b00-a6b0-1c0e375269ba} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" 8656 22957280 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 1408 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3672.9.1453111016\927152786" -childID 8 -isForBrowser -prefsHandle 3836 -prefMapHandle 3840 -prefsLen 31122 -prefMapSize 244195 -jsInitHandle 848 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a5af994-9f54-4f7a-aaa3-dc28acc37574} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" 8416 142fe560 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 1596 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3672.5.1858485501\128138948" -childID 4 -isForBrowser -prefsHandle 3864 -prefMapHandle 3584 -prefsLen 29102 -prefMapSize 244195 -jsInitHandle 848 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4142fcd7-5cd3-46fe-87ff-040765616ad1} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" 3908 217cd280 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2068 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3672.17.1890214441\232083644" -childID 16 -isForBrowser -prefsHandle 2184 -prefMapHandle 2172 -prefsLen 31275 -prefMapSize 244195 -jsInitHandle 848 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {26209eb4-5a3a-48a2-b3a1-52efe662b03a} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" 2112 2010a840 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2172 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3672.18.1794401881\243522454" -parentBuildID 20230710165010 -prefsHandle 4308 -prefMapHandle 7828 -prefsLen 36773 -prefMapSize 244195 -appDir "C:\Program Files\Mozilla Firefox\browser" - {47a41bd1-0945-4d14-b41b-1a9ea020d9cf} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" 7612 13713660 rdd | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2176 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3672.4.495368377\2066714571" -childID 3 -isForBrowser -prefsHandle 3584 -prefMapHandle 3636 -prefsLen 34225 -prefMapSize 244195 -jsInitHandle 848 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3638afa-c5d9-4b93-ad68-3c6066ce6a4b} 3672 "\\.\pipe\gecko-crash-server-pipe.3672" 3664 20453110 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| (PID) Process: | (2472) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Launcher |
Value: D05FA54E01000000 | |||
| (PID) Process: | (3672) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Browser |
Value: 099FA64E01000000 | |||
| (PID) Process: | (3672) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Installer\308046B0AF4A39CB |
| Operation: | delete value | Name: | installer.taskbarpin.win10.enabled |
Value: | |||
| (PID) Process: | (3672) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry |
Value: 0 | |||
| (PID) Process: | (3672) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\DllPrefetchExperiment |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe |
Value: 0 | |||
| (PID) Process: | (3672) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\PreXULSkeletonUISettings |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Theme |
Value: 1 | |||
| (PID) Process: | (3672) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\PreXULSkeletonUISettings |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Enabled |
Value: 1 | |||
| (PID) Process: | (3672) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableTelemetry |
Value: 1 | |||
| (PID) Process: | (3672) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableDefaultBrowserAgent |
Value: 0 | |||
| (PID) Process: | (3672) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|SetDefaultBrowserUserChoice |
Value: 1 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3672 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 3672 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json | binary | |
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A | SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA | |||
| 3672 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp | binary | |
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A | SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA | |||
| 3672 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage.sqlite-journal | binary | |
MD5:83372C971A556D857446755E8B9B30BD | SHA256:B5CD864A0523072DB12A23B82F68CC98C0B85645067DF59B5426C08763688A1D | |||
| 3672 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cert9.db-journal | binary | |
MD5:370F5D80F3A4C7D82EAF0C3CE1808E35 | SHA256:5AE234FDA9D0893CB4BC2877FB16032C24401CFA2A69A268E782E0730FAD8A0C | |||
| 3672 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cert9.db | sqlite | |
MD5:516F2B9B6DA5271EAB0EF76491DB3612 | SHA256:AD0F5E4D5E692FDDF92DBAA9BD46E10A8BD6CB52F495E00A59A0BB5416951EB7 | |||
| 3672 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\activity-stream.discovery_stream.json.tmp | text | |
MD5:77B7F4C9138143D0E19F31C285E9AE78 | SHA256:206A13B0B1463360D12D89DF987102117E6285A6EA3E3793346DFCFD2BAFDDEB | |||
| 3672 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite | — | |
MD5:— | SHA256:— | |||
| 3672 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\activity-stream.discovery_stream.json | text | |
MD5:77B7F4C9138143D0E19F31C285E9AE78 | SHA256:206A13B0B1463360D12D89DF987102117E6285A6EA3E3793346DFCFD2BAFDDEB | |||
| 3672 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\glean\db\data.safe.bin | dbf | |
MD5:1C3C58F7838DDE7F753614D170F110FC | SHA256:81C14432135B2A50DC505904E87781864CA561EFEF9E94BAECA3704D04E6DB3D | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3672 | firefox.exe | POST | 200 | 142.250.186.99:80 | http://ocsp.pki.goog/gts1c3 | unknown | binary | 471 b | unknown |
3672 | firefox.exe | POST | 200 | 195.138.255.19:80 | http://r3.o.lencr.org/ | unknown | binary | 503 b | unknown |
3672 | firefox.exe | POST | 200 | 192.124.249.36:80 | http://ocsp.godaddy.com/ | unknown | binary | 2.06 Kb | unknown |
3672 | firefox.exe | POST | — | 142.250.186.99:80 | http://ocsp.pki.goog/gts1c3 | unknown | — | — | unknown |
3672 | firefox.exe | POST | 200 | 142.250.186.99:80 | http://ocsp.pki.goog/gts1c3 | unknown | binary | 472 b | unknown |
3672 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/canonical.html | unknown | text | 90 b | unknown |
3672 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | unknown | text | 8 b | unknown |
3672 | firefox.exe | POST | 200 | 142.250.186.99:80 | http://ocsp.pki.goog/gts1c3 | unknown | binary | 472 b | unknown |
3672 | firefox.exe | POST | 200 | 195.138.255.19:80 | http://r3.o.lencr.org/ | unknown | binary | 503 b | unknown |
3672 | firefox.exe | POST | 200 | 195.138.255.19:80 | http://r3.o.lencr.org/ | unknown | binary | 503 b | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3672 | firefox.exe | 3.33.130.190:443 | oldreddit.com | AMAZON-02 | US | unknown |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
3672 | firefox.exe | 142.250.185.106:443 | safebrowsing.googleapis.com | — | — | whitelisted |
3672 | firefox.exe | 142.250.186.99:80 | ocsp.pki.goog | GOOGLE | US | whitelisted |
3672 | firefox.exe | 192.124.249.36:80 | ocsp.godaddy.com | SUCURI-SEC | US | unknown |
3672 | firefox.exe | 34.107.243.93:443 | push.services.mozilla.com | GOOGLE | US | unknown |
3672 | firefox.exe | 195.138.255.19:80 | r3.o.lencr.org | AS33891 Netzbetrieb GmbH | DE | unknown |
3672 | firefox.exe | 216.58.212.132:443 | www.google.com | GOOGLE | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
detectportal.firefox.com |
| whitelisted |
oldreddit.com |
| unknown |
contile.services.mozilla.com |
| whitelisted |
spocs.getpocket.com |
| shared |
firefox.settings.services.mozilla.com |
| whitelisted |
safebrowsing.googleapis.com |
| whitelisted |
push.services.mozilla.com |
| whitelisted |
ocsp.pki.goog |
| whitelisted |
autopush.prod.mozaws.net |
| whitelisted |
pki-goog.l.google.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
3672 | firefox.exe | Not Suspicious Traffic | INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net) |