URL:

https://poce-my.sharepoint.com/:o:/g/personal/adrien_sandray

Full analysis: https://app.any.run/tasks/a0cc6370-5ad7-4c56-9920-18af839a7cfa
Verdict: Malicious activity
Analysis date: February 28, 2023, 16:01:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

D0F7067CD03A978BD766B1BE0E8C5F7D

SHA1:

887D564EFCF2ACABA352D89AD575BCBD5E0FB90F

SHA256:

A113D0F4784EAFB1390DDFF52CC51FA14E7022F2F40AE9097C83714AD38666E4

SSDEEP:

3:N8Ol6K+ArL5+KVFSE/6Ccn:2Ol6K+AfNan

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • firefox.exe (PID: 3348)
      • firefox.exe (PID: 3240)

    • Drops the executable file immediately after the start

      • firefox.exe (PID: 3348)

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 3348)

    • Manual execution by a user

      • firefox.exe (PID: 3240)

    • Drops a file that was compiled in debug mode

      • firefox.exe (PID: 3348)

    • Create files in a temporary directory

      • firefox.exe (PID: 3348)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
9
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start opera.exe firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1016"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3348.0.669452259\735847996" -parentBuildID 20201112153044 -prefsHandle 1128 -prefMapHandle 1120 -prefsLen 1 -prefMapSize 238726 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3348 "\\.\pipe\gecko-crash-server-pipe.3348" 1204 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
1240"C:\Program Files\Opera\opera.exe" "https://poce-my.sharepoint.com/:o:/g/personal/adrien_sandray"C:\Program Files\Opera\opera.exe
Explorer.EXE
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera Internet Browser
Exit code:
0
Version:
1748
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\opera\opera.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\psapi.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\rpcrt4.dll
1636"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3348.21.1762068250\108403668" -childID 4 -isForBrowser -prefsHandle 1748 -prefMapHandle 4224 -prefsLen 7307 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3348 "\\.\pipe\gecko-crash-server-pipe.3348" 4108 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
1872"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3348.13.322624786\1935994192" -childID 2 -isForBrowser -prefsHandle 2960 -prefMapHandle 2872 -prefsLen 6644 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3348 "\\.\pipe\gecko-crash-server-pipe.3348" 2916 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
2280"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3348.20.567171586\1031462788" -childID 3 -isForBrowser -prefsHandle 1840 -prefMapHandle 1776 -prefsLen 7307 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3348 "\\.\pipe\gecko-crash-server-pipe.3348" 4192 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
2996"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3348.34.2074430290\1192806642" -childID 5 -isForBrowser -prefsHandle 3820 -prefMapHandle 3836 -prefsLen 7307 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3348 "\\.\pipe\gecko-crash-server-pipe.3348" 3948 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
3240"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe—Explorer.EXE
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
3348"C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
3468"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3348.6.1476616816\548403111" -childID 1 -isForBrowser -prefsHandle 4372 -prefMapHandle 4368 -prefsLen 181 -prefMapSize 238726 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 3348 "\\.\pipe\gecko-crash-server-pipe.3348" 4384 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
Total events
19 046
Read events
18 880
Write events
166
Delete events
0

Modification events

(PID) Process:(1240) opera.exeKey:HKEY_CURRENT_USER\Software\Opera Software
Operation:writeName:Last CommandLine v2
Value:
C:\Program Files\Opera\opera.exe "https://poce-my.sharepoint.com/:o:/g/personal/adrien_sandray"
(PID) Process:(1240) opera.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3240) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Launcher
Value:
EE3F38B00E000000
(PID) Process:(3348) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Browser
Value:
C28F39B00E000000
(PID) Process:(3348) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry
Value:
0
(PID) Process:(3348) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\DllPrefetchExperiment
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
0
(PID) Process:(3348) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|DisableTelemetry
Value:
1
(PID) Process:(3348) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|DisableDefaultBrowserAgent
Value:
0
(PID) Process:(3348) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|ServicesSettingsServer
Value:
https://firefox.settings.services.mozilla.com/v1
(PID) Process:(3348) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|SecurityContentSignatureRootHash
Value:
97:E8:BA:9C:F1:2F:B3:DE:53:CC:42:A4:E6:57:7E:D6:4D:F4:93:C2:47:B4:14:FE:A0:36:81:8D:38:23:56:0E
Executable files
8
Suspicious files
96
Text files
94
Unknown types
36

Dropped files

PID
Process
Filename
Type
3348firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
1240opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\sessions\opr8AC6.tmptext
MD5:—
SHA256:—
1240opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\global_history.dattext
MD5:—
SHA256:—
1240opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\sessions\opr9A0A.tmptext
MD5:—
SHA256:—
1240opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\tasks.xmlxml
MD5:—
SHA256:—
1240opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opr2C98.tmpxml
MD5:—
SHA256:—
1240opera.exeC:\Users\admin\AppData\Local\Opera\Opera\cache\sesn\opr00003.tmphtml
MD5:—
SHA256:—
1240opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opr2C2A.tmptext
MD5:—
SHA256:—
1240opera.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\16ec093b8f51508f.customDestinations-ms~RF10c37f0.TMPbinary
MD5:DBC8C3C79F0DFF4745A5E25E13611AEF
SHA256:70C54F2C53CF246603B8DE4755D95C5AA51BF4B232340BEA5879724A1F84F675
3348firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.binbinary
MD5:994A33896BB41A278A315D0D796422B6
SHA256:54EC50A20FFF8CC016710E49437CF6A11D3FE5EE7B28C185E4A9AAFEE2908B63
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
19
TCP/UDP connections
54
DNS requests
98
Threats
38

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3348
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt
US
text
8 b
whitelisted
3348
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
US
text
8 b
whitelisted
3348
firefox.exe
POST
200
216.58.207.195:80
http://ocsp.pki.goog/gts1c3
US
der
472 b
whitelisted
1240
opera.exe
GET
200
185.26.182.110:80
http://redir.opera.com/favicons/google/favicon.ico
unknown
image
5.30 Kb
whitelisted
3348
firefox.exe
POST
200
23.33.119.27:80
http://r3.o.lencr.org/
NO
der
503 b
shared
3348
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
US
text
8 b
whitelisted
3348
firefox.exe
GET
200
2.22.61.59:80
http://ciscobinary.openh264.org/openh264-win32-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
unknown
compressed
479 Kb
whitelisted
3348
firefox.exe
POST
200
23.33.119.27:80
http://r3.o.lencr.org/
NO
der
503 b
shared
3348
firefox.exe
POST
200
23.33.119.27:80
http://r3.o.lencr.org/
NO
der
503 b
shared
3348
firefox.exe
POST
200
23.33.119.27:80
http://r3.o.lencr.org/
NO
der
503 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1240
opera.exe
13.107.136.8:443
poce-my.sharepoint.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
suspicious
1240
opera.exe
82.145.216.15:443
sitecheck2.opera.com
Opera Software AS
NO
suspicious
1240
opera.exe
185.26.182.94:443
certs.opera.com
Opera Software AS
—
whitelisted
1240
opera.exe
185.26.182.110:80
redir.opera.com
Opera Software AS
—
unknown
3348
firefox.exe
35.241.9.150:443
firefox.settings.services.mozilla.com
GOOGLE
US
suspicious
3348
firefox.exe
34.107.221.82:80
detectportal.firefox.com
GOOGLE
US
whitelisted
3348
firefox.exe
35.164.234.103:443
location.services.mozilla.com
AMAZON-02
US
unknown
3348
firefox.exe
23.33.119.27:80
r3.o.lencr.org
Akamai International B.V.
NO
unknown
3348
firefox.exe
173.194.73.95:443
safebrowsing.googleapis.com
GOOGLE
US
whitelisted
3348
firefox.exe
54.148.187.127:443
push.services.mozilla.com
AMAZON-02
US
unknown

DNS requests

Domain
IP
Reputation
poce-my.sharepoint.com
  • 13.107.136.8
suspicious
certs.opera.com
  • 185.26.182.94
whitelisted
sitecheck2.opera.com
  • 82.145.216.15
whitelisted
redir.opera.com
  • 185.26.182.110
whitelisted
www.google.com
  • 216.58.207.228
malicious
detectportal.firefox.com
  • 34.107.221.82
whitelisted
firefox.settings.services.mozilla.com
  • 35.241.9.150
whitelisted
example.org
  • 93.184.216.34
whitelisted
ipv4only.arpa
  • 192.0.0.171
whitelisted
location.services.mozilla.com
  • 35.164.234.103
whitelisted

Threats

PID
Process
Class
Message
1240
opera.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
1240
opera.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
1240
opera.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
1240
opera.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
1240
opera.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
1240
opera.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
1240
opera.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
1240
opera.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
1240
opera.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
1240
opera.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://poce-my.sharepoint.com/:o:/g/personal/adrien_sandray