URL:

https://onlocationexp.com/nfl/super-bowl-ticket-packages

Full analysis: https://app.any.run/tasks/b722747b-9699-405d-98bc-2cf679987b60
Verdict: Malicious activity
Analysis date: September 26, 2023, 11:51:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
Indicators:
MD5:

40A343463B51430F4C7F99F477912E61

SHA1:

7E942AF61502D58A93BC259D20E1FF59D944FF7D

SHA256:

D3C822FA51C5F9072D3230B19B340D7F0FC5CED8D3C10947AA16EB47AE5A03B8

SSDEEP:

3:N8Cj9IyIqSGuARIVWECzn:2Cj91hMVez

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • firefox.exe (PID: 1872)
      • firefox.exe (PID: 3080)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
14
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1348"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3080.10.2017931134\1596349799" -childID 9 -isForBrowser -prefsHandle 7820 -prefMapHandle 7816 -prefsLen 29110 -prefMapSize 243955 -jsInitHandle 916 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3eb8cdac-1ef5-4eb2-b39b-f1e16bc8987e} 3080 "\\.\pipe\gecko-crash-server-pipe.3080" 7832 1ada9f70 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
1360"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3080.2.159686469\1392280528" -childID 1 -isForBrowser -prefsHandle 2080 -prefMapHandle 2076 -prefsLen 24255 -prefMapSize 243955 -jsInitHandle 916 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d37f4e3c-7fc4-4cc4-a633-e447eb10fe51} 3080 "\\.\pipe\gecko-crash-server-pipe.3080" 2092 12a8f560 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
1604"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3080.0.750817301\873363033" -parentBuildID 20230710165010 -prefsHandle 1116 -prefMapHandle 1108 -prefsLen 28025 -prefMapSize 243955 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac16a55c-298f-45b5-ac8f-34a07c5cf307} 3080 "\\.\pipe\gecko-crash-server-pipe.3080" 1188 d8e2000 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
1636"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3080.1.92001030\1004559205" -parentBuildID 20230710165010 -prefsHandle 1428 -prefMapHandle 1424 -prefsLen 28102 -prefMapSize 243955 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5236b472-f804-4d1b-8415-93712b1b3b9a} 3080 "\\.\pipe\gecko-crash-server-pipe.3080" 1440 f08eb60 socketC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
1804"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3080.11.1635672858\1646072964" -childID 10 -isForBrowser -prefsHandle 7648 -prefMapHandle 7644 -prefsLen 29110 -prefMapSize 243955 -jsInitHandle 916 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cad7192a-4f31-4bf6-9ff2-313c0758391d} 3080 "\\.\pipe\gecko-crash-server-pipe.3080" 7660 1ae34f70 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\vcruntime140.dll
1872"C:\Program Files\Mozilla Firefox\firefox.exe" "https://onlocationexp.com/nfl/super-bowl-ticket-packages"C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
2340"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3080.9.1074569046\1515073862" -childID 8 -isForBrowser -prefsHandle 7912 -prefMapHandle 7916 -prefsLen 29110 -prefMapSize 243955 -jsInitHandle 916 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e17c6b5f-c3dc-4ccd-abd5-d9a9e1bd9d92} 3080 "\\.\pipe\gecko-crash-server-pipe.3080" 7900 1ada9110 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\msvcrt.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
2352"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3080.3.427016402\2006733702" -childID 2 -isForBrowser -prefsHandle 2932 -prefMapHandle 2928 -prefsLen 33872 -prefMapSize 243955 -jsInitHandle 916 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ffaaf00-d9a3-4973-b12a-fd1384cca70c} 3080 "\\.\pipe\gecko-crash-server-pipe.3080" 2944 168e8f70 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
2432"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3080.8.1911969017\1539060625" -childID 7 -isForBrowser -prefsHandle 8148 -prefMapHandle 8152 -prefsLen 29110 -prefMapSize 243955 -jsInitHandle 916 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6fd65e95-1a35-4945-a14d-32d16ae1bc04} 3080 "\\.\pipe\gecko-crash-server-pipe.3080" 8136 1a4de6d0 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
c:\program files\mozilla firefox\api-ms-win-crt-runtime-l1-1-0.dll
3080"C:\Program Files\Mozilla Firefox\firefox.exe" https://onlocationexp.com/nfl/super-bowl-ticket-packagesC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\crypt32.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
Total events
15 924
Read events
15 888
Write events
36
Delete events
0

Modification events

(PID) Process:(1872) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Launcher
Value:
815441AB02000000
(PID) Process:(3080) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Browser
Value:
B73F42AB02000000
(PID) Process:(3080) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry
Value:
0
(PID) Process:(3080) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\DllPrefetchExperiment
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
0
(PID) Process:(3080) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\PreXULSkeletonUISettings
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Theme
Value:
1
(PID) Process:(3080) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\PreXULSkeletonUISettings
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Enabled
Value:
1
(PID) Process:(3080) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|DisableTelemetry
Value:
1
(PID) Process:(3080) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|DisableDefaultBrowserAgent
Value:
0
(PID) Process:(3080) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|SetDefaultBrowserUserChoice
Value:
1
(PID) Process:(3080) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent
Operation:writeName:C:\Program Files\Mozilla Firefox|AppLastRunTime
Value:
EA362D0F13B0D901
Executable files
4
Suspicious files
211
Text files
69
Unknown types
0

Dropped files

PID
Process
Filename
Type
3080firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
3080firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.binbinary
MD5:098201E7EEFBB94E6D50BEC41D1C3C03
SHA256:4C7455DE1E410148C659EF5765F1555CC379742906F79558AB6A6AFBDDC7A462
3080firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage.sqlite-journalbinary
MD5:911BA05C4138A6CB2EDE04A0E0B7AD20
SHA256:30A848620595112282D99B1A596DDFCA4CD50C5057956DCD4DAFE3099CD94F14
3080firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmpbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
3080firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.jstext
MD5:33B1483937C16FDFD0FEE1AF8E9746F0
SHA256:E6280203750BB80548B14CA76986983950D872ECE01044CC936E97153F04B372
3080firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
3080firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite —
MD5:—
SHA256:—
3080firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal —
MD5:—
SHA256:—
3080firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.jstext
MD5:33B1483937C16FDFD0FEE1AF8E9746F0
SHA256:E6280203750BB80548B14CA76986983950D872ECE01044CC936E97153F04B372
3080firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.jsonbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
56
TCP/UDP connections
188
DNS requests
367
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3080
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
text
90 b
unknown
3080
firefox.exe
POST
200
95.101.54.107:80
http://r3.o.lencr.org/
unknown
der
503 b
unknown
3080
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
text
8 b
unknown
3080
firefox.exe
POST
200
18.244.175.59:80
http://ocsp.r2m02.amazontrust.com/
unknown
der
471 b
unknown
3080
firefox.exe
POST
200
95.101.54.107:80
http://r3.o.lencr.org/
unknown
der
503 b
unknown
3080
firefox.exe
POST
200
151.101.67.3:80
http://ocsp.int-r1.certainly.com/
unknown
der
523 b
unknown
3080
firefox.exe
POST
200
95.101.54.107:80
http://r3.o.lencr.org/
unknown
der
503 b
unknown
3080
firefox.exe
POST
200
172.217.16.131:80
http://ocsp.pki.goog/gts1c3
unknown
der
471 b
unknown
3080
firefox.exe
POST
200
95.101.54.107:80
http://r3.o.lencr.org/
unknown
der
503 b
unknown
3080
firefox.exe
POST
200
95.101.54.107:80
http://r3.o.lencr.org/
unknown
der
503 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3080
firefox.exe
151.101.130.132:443
onlocationexp.com
FASTLY
US
unknown
3080
firefox.exe
34.107.221.82:80
detectportal.firefox.com
GOOGLE
US
whitelisted
3080
firefox.exe
34.117.237.239:443
contile.services.mozilla.com
GOOGLE-CLOUD-PLATFORM
US
unknown
3080
firefox.exe
34.197.137.200:443
spocs.getpocket.com
AMAZON-AES
US
unknown
3080
firefox.exe
95.101.54.107:80
r3.o.lencr.org
Akamai International B.V.
DE
unknown
3080
firefox.exe
34.149.100.209:443
firefox.settings.services.mozilla.com
GOOGLE
US
unknown
3080
firefox.exe
151.101.1.26:443
polyfill.io
FASTLY
US
unknown
3080
firefox.exe
104.18.130.236:443
cdn.cookielaw.org
CLOUDFLARENET
—
unknown
3080
firefox.exe
151.101.0.70:443
assets.primesport.com
FASTLY
US
unknown
3080
firefox.exe
18.244.175.59:80
ocsp.r2m02.amazontrust.com
—
US
unknown

DNS requests

Domain
IP
Reputation
detectportal.firefox.com
  • 34.107.221.82
whitelisted
onlocationexp.com
  • 151.101.130.132
  • 151.101.2.132
  • 151.101.66.132
  • 151.101.194.132
unknown
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
contile.services.mozilla.com
  • 34.117.237.239
whitelisted
example.org
  • 93.184.216.34
whitelisted
ipv4only.arpa
  • 192.0.0.170
  • 192.0.0.171
whitelisted
spocs.getpocket.com
  • 34.197.137.200
  • 184.72.95.230
  • 44.214.229.86
  • 3.218.176.182
shared
proxyserverecs-1736642167.us-east-1.elb.amazonaws.com
  • 3.218.176.182
  • 44.214.229.86
  • 184.72.95.230
  • 34.197.137.200
shared
r3.o.lencr.org
  • 95.101.54.107
  • 95.101.54.131
  • 2.16.202.121
  • 95.101.54.200
  • 95.101.54.114
  • 95.101.54.130
  • 2.16.202.112
  • 184.24.77.67
  • 184.24.77.54
shared
firefox.settings.services.mozilla.com
  • 34.149.100.209
whitelisted

Threats

PID
Process
Class
Message
3080
firefox.exe
Device Retrieving External IP Address Detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://onlocationexp.com/nfl/super-bowl-ticket-packages