URL:

https://claude-code-app.gitlab.io/

Full analysis: https://app.any.run/tasks/719c3c7a-2a1d-4443-a9a1-1b13dd82b86f
Verdict: Malicious activity
Analysis date: April 10, 2026, 02:03:02
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-scr
susp-clipboard
clickfix
Indicators:
MD5:

DA31C9FD4805346FE9CDE02BDEC684FA

SHA1:

3FF9555F6EB252282C797D2CCC0D0C29A51D8D53

SHA256:

E0C820BA1D3D054285C328E3636B70E15F85FF0C5A59AA0ABEA6B419C6D0D20F

SSDEEP:

3:N8UoIGatE/21nK:2UoIGV/D

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Suspicious clipboard command

      • [System Process] (PID: 0)

  • INFO

    • Application launched itself

      • firefox.exe (PID: 1296)
      • firefox.exe (PID: 2432)
      • firefox.exe (PID: 8456)
      • firefox.exe (PID: 8476)

    • Manual execution by a user

      • powershell.exe (PID: 3416)
      • cmd.exe (PID: 4056)

    • Checks current location (POWERSHELL)

      • powershell.exe (PID: 3416)

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 8476)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
168
Monitored processes
33
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs svchost.exe powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs #SUSP-CLIPBOARD [system process] no specs

Process information

PID
CMD
Path
Indicators
Parent process
0[System Process]
[System Process]
Integrity Level:
UNKNOWN
1296"C:\Program Files\Mozilla Firefox\firefox.exe" https://claude-code-app.gitlab.io/C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\windows\system32\bcrypt.dll
c:\program files\mozilla firefox\vcruntime140_1.dll
c:\windows\system32\crypt32.dll
1404"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3780 -prefsLen 27095 -prefMapHandle 3776 -prefMapSize 268611 -jsInitHandle 3772 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 3764 -initialChannelId {cc121c20-0ea3-4b65-a8f7-a68950ac8a58} -parentPid 8476 -crashReporter "\\.\pipe\gecko-crash-server-pipe.8476" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcp140.dll
1980\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2232C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2432"C:\Program Files\Mozilla Firefox\firefox.exe" https://claude-code-app.gitlab.io/C:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
3076"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4732 -prefsLen 39429 -prefMapHandle 5240 -prefMapSize 273045 -jsInitHandle 5244 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 5164 -initialChannelId {501e5721-107c-4ca8-a5ee-cb7156314fa9} -parentPid 2432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_1.dll
3380\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3416"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
3692"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250227124745 -prefsHandle 3596 -prefsLen 37299 -prefMapHandle 3600 -prefMapSize 273045 -ipcHandle 3608 -initialChannelId {474ae38f-5d23-4362-8ecd-b29c14c1f58d} -parentPid 2432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2432" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rddC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
1
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_1.dll
c:\windows\system32\crypt32.dll
Total events
5 660
Read events
5 660
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
632
Text files
177
Unknown types
1

Dropped files

PID
Process
Filename
Type
2432firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
2432firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs-1.jstext
MD5:74762609A221B9A369385A317DF47CF9
SHA256:CD7B42D64B7F42912CEFFD9CB71D4D792E0480BFB5EF87F9C6A5F862571F2093
2432firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-child-current.binbinary
MD5:73A2E89AF4D3D52D0167E7B3805E20E5
SHA256:AB2871B600E4E7A13DF4552B1172DA5EEA32C9BA8E3D2153F1987FE2B124CFC4
2432firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\SiteSecurityServiceState.binbinary
MD5:E9FC63C07B759DBBFF723E765CEB686A
SHA256:A5ED92F7B634A6B92E47A24895FC6092A2C560C6A9F29B71CA9E47B4ED27312D
2432firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
2432firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite —
MD5:—
SHA256:—
2432firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\activity-stream.contile.jsontext
MD5:8A8BF236D0CF59E793971338B09CEA83
SHA256:D31492474188EEE2DEF30D8D23D191121131EE3EA7D3D3E874D4A3E5EB38C401
2432firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-walbinary
MD5:82CE2B0C3EF33F4408F177690696E498
SHA256:B118EE3DC4A3B51EAE4C5B284B3923AC4D221F13554CCC3267460828AAA8EDF0
2432firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\datareporting\glean\db\data.safe.binbinary
MD5:AE7CD383F54334C047FDBC3E5575B03A
SHA256:3F51246665C15038B8F7876A117B3E2C3F349D89CF981B520376DD1F883049A3
2432firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
434
TCP/UDP connections
142
DNS requests
224
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2432
firefox.exe
GET
101
34.107.243.93:443
https://push.services.mozilla.com/
US
—
—
whitelisted
—
—
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQ3L3%2F%2Fa6ADK8NraY2GXzVaYrHG4AQUb6t%2B2v%2BXQ3LsO2d33oJhNYhHQoUCEzMAAAAGb6JMMcOVb6sAAAAAAAY%3D
US
binary
958 b
whitelisted
2432
firefox.exe
GET
200
151.101.193.91:443
https://firefox.settings.services.mozilla.com/v1/buckets/monitor/collections/changes/changeset?collection=url-parser-default-unknown-schemes-interventions&bucket=main&_expected=0
US
text
274 b
whitelisted
2432
firefox.exe
GET
200
35.185.44.232:443
https://claude-code-app.gitlab.io/
US
html
8.89 Kb
unknown
2432
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
US
text
90 b
whitelisted
2432
firefox.exe
GET
200
34.160.144.191:443
https://content-signature-2.cdn.mozilla.net/g/chains/202402/remote-settings.content-signature.mozilla.org-2026-03-08-09-54-23.chain
US
text
5.18 Kb
whitelisted
2432
firefox.exe
GET
200
34.160.144.191:443
https://content-signature-2.cdn.mozilla.net/g/chains/202402/remote-settings.content-signature.mozilla.org-2026-05-27-11-40-34.chain
US
text
5.18 Kb
whitelisted
2432
firefox.exe
GET
200
34.160.144.191:443
https://content-signature-2.cdn.mozilla.net/g/chains/202402/remote-settings.content-signature.mozilla.org-2026-05-27-11-40-34.chain
US
text
5.18 Kb
whitelisted
2432
firefox.exe
GET
200
151.101.193.91:443
https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
US
text
330 b
whitelisted
2432
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
US
text
8 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6260
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
5276
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
48.192.1.64:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5532
SearchApp.exe
23.11.206.107:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
—
—
23.11.41.157:80
ocsp.digicert.com
AKAMAI-AMS
NL
whitelisted
—
—
204.79.197.203:80
oneocsp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
2432
firefox.exe
151.101.193.91:443
firefox.settings.services.mozilla.com
FASTLY
US
whitelisted
2432
firefox.exe
35.185.44.232:443
claude-code-app.gitlab.io
GOOGLE-CLOUD-PLATFORM
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
  • 40.127.240.158
whitelisted
activation-v2.sls.microsoft.com
  • 48.192.1.64
whitelisted
www.bing.com
  • 23.11.206.107
  • 92.123.104.9
  • 92.123.104.5
  • 92.123.104.63
  • 92.123.104.8
  • 92.123.104.62
  • 92.123.104.61
  • 92.123.104.67
  • 92.123.104.66
  • 92.123.104.65
whitelisted
ocsp.digicert.com
  • 23.11.41.157
whitelisted
oneocsp.microsoft.com
  • 204.79.197.203
whitelisted
google.com
  • 142.251.127.139
  • 142.251.127.100
  • 142.251.127.101
  • 142.251.127.113
  • 142.251.127.102
  • 142.251.127.138
  • 2a00:1450:4001:c13::64
  • 2a00:1450:4001:c13::8a
  • 2a00:1450:4001:c13::65
  • 2a00:1450:4001:c13::71
whitelisted
firefox.settings.services.mozilla.com
  • 151.101.193.91
  • 151.101.1.91
  • 151.101.129.91
  • 151.101.65.91
whitelisted
mozilla.map.fastly.net
  • 151.101.193.91
  • 151.101.1.91
  • 151.101.129.91
  • 151.101.65.91
  • 2a04:4e42::347
  • 2a04:4e42:400::347
  • 2a04:4e42:600::347
  • 2a04:4e42:200::347
whitelisted
claude-code-app.gitlab.io
  • 35.185.44.232
  • 2600:1901:0:7b8a::
unknown
detectportal.firefox.com
  • 34.107.221.82
whitelisted

Threats

PID
Process
Class
Message
6260
svchost.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
2232
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
2232
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
2232
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
2232
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] DNS Query to Cloudflare Worker App
2232
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] DNS Query to Cloudflare Worker App
2232
svchost.exe
Misc activity
ET INFO Observed DNS Query to Cloudflare Developer Domain (workers .dev)
2232
svchost.exe
Misc activity
ET INFO Observed DNS Query to Cloudflare Developer Domain (workers .dev)
8476
firefox.exe
Misc activity
ET INFO Observed Cloudflare Developer Domain (workers .dev) in TLS SNI
2232
svchost.exe
Misc activity
ET INFO Observed DNS Query to Cloudflare Developer Domain (workers .dev)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://claude-code-app.gitlab.io/