download:

next.php

Full analysis: https://app.any.run/tasks/d0ab8543-30d0-43fb-9d8a-e42bfe4181f1
Verdict: Malicious activity
Analysis date: April 21, 2021, 15:00:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/plain
File info: ASCII text, with no line terminators
MD5:

7F256D2188BA0031C49B4A4A3D323605

SHA1:

9630769A896A401E4AE9DC151E62FAEEBABD1D80

SHA256:

E3F29C82084DC56EC67CF9E88EB71B756D6969D44DD990D82C74EC72C1A04462

SSDEEP:

3:YWMICvkP1EaJFeEJJ+bMHY:YWMICsP1DFtJ+bGY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 1788)

    • Actions looks like stealing of personal data

      • pingsender.exe (PID: 2752)
      • pingsender.exe (PID: 2304)

    • Steals credentials from Web Browsers

      • pingsender.exe (PID: 2752)
      • pingsender.exe (PID: 2304)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • rundll32.exe (PID: 3460)

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 1616)

    • Drops a file that was compiled in debug mode

      • firefox.exe (PID: 1616)

    • Loads DLL from Mozilla Firefox

      • pingsender.exe (PID: 2752)
      • pingsender.exe (PID: 2304)

    • Checks supported languages

      • pingsender.exe (PID: 2752)
      • pingsender.exe (PID: 2304)

    • Reads the computer name

      • pingsender.exe (PID: 2752)
      • pingsender.exe (PID: 2304)

  • INFO

    • Changes default file association

      • rundll32.exe (PID: 3460)

    • Checks supported languages

      • firefox.exe (PID: 3376)
      • rundll32.exe (PID: 3460)
      • firefox.exe (PID: 2396)
      • firefox.exe (PID: 2564)
      • firefox.exe (PID: 2480)
      • firefox.exe (PID: 2504)
      • firefox.exe (PID: 3568)
      • firefox.exe (PID: 2964)
      • firefox.exe (PID: 1032)
      • firefox.exe (PID: 1616)
      • firefox.exe (PID: 124)
      • SearchProtocolHost.exe (PID: 1788)
      • firefox.exe (PID: 3800)
      • firefox.exe (PID: 3212)
      • firefox.exe (PID: 3012)
      • firefox.exe (PID: 872)
      • firefox.exe (PID: 2692)
      • firefox.exe (PID: 3560)
      • firefox.exe (PID: 2664)
      • firefox.exe (PID: 272)
      • firefox.exe (PID: 324)
      • firefox.exe (PID: 2720)
      • firefox.exe (PID: 2600)
      • firefox.exe (PID: 3208)
      • firefox.exe (PID: 1904)
      • firefox.exe (PID: 2660)
      • firefox.exe (PID: 2424)
      • firefox.exe (PID: 2208)
      • firefox.exe (PID: 3568)

    • Reads the computer name

      • firefox.exe (PID: 3376)
      • rundll32.exe (PID: 3460)
      • firefox.exe (PID: 2480)
      • firefox.exe (PID: 2504)
      • firefox.exe (PID: 3568)
      • firefox.exe (PID: 2964)
      • firefox.exe (PID: 2396)
      • firefox.exe (PID: 124)
      • firefox.exe (PID: 1616)
      • firefox.exe (PID: 3800)
      • firefox.exe (PID: 3012)
      • SearchProtocolHost.exe (PID: 1788)
      • firefox.exe (PID: 3212)
      • firefox.exe (PID: 3560)
      • firefox.exe (PID: 2692)
      • firefox.exe (PID: 872)
      • firefox.exe (PID: 2664)
      • firefox.exe (PID: 272)
      • firefox.exe (PID: 2720)
      • firefox.exe (PID: 2600)
      • firefox.exe (PID: 3208)
      • firefox.exe (PID: 1904)
      • firefox.exe (PID: 2208)
      • firefox.exe (PID: 2660)
      • firefox.exe (PID: 3568)
      • firefox.exe (PID: 2424)

    • Application launched itself

      • firefox.exe (PID: 3376)
      • firefox.exe (PID: 2564)
      • firefox.exe (PID: 1032)
      • firefox.exe (PID: 1616)
      • firefox.exe (PID: 324)
      • firefox.exe (PID: 2720)

    • Reads CPU info

      • firefox.exe (PID: 3376)
      • firefox.exe (PID: 1616)
      • firefox.exe (PID: 2720)

    • Creates files in the user directory

      • firefox.exe (PID: 3376)
      • firefox.exe (PID: 1616)
      • firefox.exe (PID: 2720)

    • Creates files in the program directory

      • firefox.exe (PID: 3376)
      • firefox.exe (PID: 1616)
      • firefox.exe (PID: 2720)

    • Reads the date of Windows installation

      • firefox.exe (PID: 3376)
      • firefox.exe (PID: 1616)

    • Dropped object may contain Bitcoin addresses

      • firefox.exe (PID: 1616)

    • Checks Windows Trust Settings

      • pingsender.exe (PID: 2304)
      • pingsender.exe (PID: 2752)

    • Manual execution by user

      • firefox.exe (PID: 324)

    • Reads settings of System Certificates

      • pingsender.exe (PID: 2304)
      • pingsender.exe (PID: 2752)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
71
Monitored processes
31
Malicious processes
0
Suspicious processes
4

Behavior graph

Click at the process to see the details
start rundll32.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs searchprotocolhost.exe no specs firefox.exe no specs firefox.exe no specs pingsender.exe pingsender.exe firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
124"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1616.0.352727784\746233716" -parentBuildID 20201112153044 -prefsHandle 1116 -prefMapHandle 1108 -prefsLen 1 -prefMapSize 227510 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1616 "\\.\pipe\gecko-crash-server-pipe.1616" 1204 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
1
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
272"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1616.55.558162762\767824109" -childID 8 -isForBrowser -prefsHandle 2348 -prefMapHandle 4216 -prefsLen 13459 -prefMapSize 227510 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1616 "\\.\pipe\gecko-crash-server-pipe.1616" 2360 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
324"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe—Explorer.EXE
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
872"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1616.34.728642437\1422547467" -childID 5 -isForBrowser -prefsHandle 2248 -prefMapHandle 2824 -prefsLen 3942 -prefMapSize 227510 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1616 "\\.\pipe\gecko-crash-server-pipe.1616" 2760 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msasn1.dll
1032"C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
1616"C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\rpcrt4.dll
1788"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\system32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\user32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
1904"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2720.13.958954462\1555374860" -childID 2 -isForBrowser -prefsHandle 2824 -prefMapHandle 2820 -prefsLen 7469 -prefMapSize 234206 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2720 "\\.\pipe\gecko-crash-server-pipe.2720" 2836 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
2208"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2720.20.1851034166\1329245147" -childID 3 -isForBrowser -prefsHandle 3472 -prefMapHandle 3468 -prefsLen 7596 -prefMapSize 234206 -parentBuildID 20201112153044 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2720 "\\.\pipe\gecko-crash-server-pipe.2720" 3484 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\sechost.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\rpcrt4.dll
2304"C:\Program Files\Mozilla Firefox\pingsender.exe" https://incoming.telemetry.mozilla.org/submit/telemetry/4d109172-59f4-4b7c-85c5-8c916de30570/first-shutdown/Firefox/83.0/release/20201112153044?v=4 C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\ainub19x.default-1619017321676\saved-telemetry-pings\4d109172-59f4-4b7c-85c5-8c916de30570C:\Program Files\Mozilla Firefox\pingsender.exe
firefox.exe
User:
admin
Company:
Mozilla Foundation
Integrity Level:
MEDIUM
Exit code:
0
Version:
83.0
Modules
Images
c:\program files\mozilla firefox\pingsender.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
Total events
40 285
Read events
40 070
Write events
214
Delete events
1

Modification events

(PID) Process:(3460) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Value:
Adobe Acrobat Reader DC
(PID) Process:(3460) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Windows\eHome\ehshell.exe
Value:
Windows Media Center
(PID) Process:(3460) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
Firefox
(PID) Process:(3460) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Internet Explorer\iexplore.exe
Value:
Internet Explorer
(PID) Process:(3460) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Windows\system32\mspaint.exe
Value:
Paint
(PID) Process:(3460) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Windows\system32\NOTEPAD.EXE
Value:
Notepad
(PID) Process:(3460) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\PROGRA~1\MICROS~1\Office14\OIS.EXE
Value:
Microsoft Office 2010
(PID) Process:(3460) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Opera\Opera.exe
Value:
Opera Internet Browser
(PID) Process:(3460) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Windows Photo Viewer\PhotoViewer.dll
Value:
Windows Photo Viewer
(PID) Process:(3460) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\VideoLAN\VLC\vlc.exe
Value:
VLC media player
Executable files
2
Suspicious files
308
Text files
265
Unknown types
150

Dropped files

PID
Process
Filename
Type
3376firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
3376firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite —
MD5:—
SHA256:—
3376firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.jstext
MD5:—
SHA256:—
3376firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.jstext
MD5:—
SHA256:—
3376firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\settings\main\ms-language-packs\asrouter.ftl.tmptext
MD5:—
SHA256:—
3376firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\settings\main\ms-language-packs\asrouter.ftltext
MD5:—
SHA256:—
3376firefox.exeC:\Users\admin\AppData\Local\Temp\mz_etilqs_Oc5QjRSnogAfs1Ubinary
MD5:—
SHA256:—
3376firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.binbinary
MD5:F061FA551509AC90AFAD93AE2B7B834D
SHA256:02BAB4AA77268FCC013770FBDAFA7848597969EE270900BE7DD2F2FEFA4C7F84
3376firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-child-current.binbinary
MD5:D1CE24ED2A5F560611AF8688026B9887
SHA256:D981B09A132B0264AD4423FE9ED7D6A5181B94C7E3D09C68EE334635135C5F57
3376firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
41
TCP/UDP connections
113
DNS requests
269
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1616
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
1616
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
1616
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
1616
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
1616
firefox.exe
POST
200
23.32.238.67:80
http://r3.o.lencr.org/
US
der
503 b
shared
1616
firefox.exe
POST
200
13.32.23.35:80
http://ocsp.sca1b.amazontrust.com/
US
der
471 b
whitelisted
1616
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
1616
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3376
firefox.exe
POST
200
142.250.185.195:80
http://ocsp.pki.goog/gts1o1core
US
der
471 b
whitelisted
1616
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3376
firefox.exe
65.9.66.111:443
firefox.settings.services.mozilla.com
AT&T Services, Inc.
US
suspicious
3376
firefox.exe
13.32.25.69:443
content-signature-2.cdn.mozilla.net
Amazon.com, Inc.
US
suspicious
3376
firefox.exe
34.210.195.81:443
push.services.mozilla.com
Amazon.com, Inc.
US
unknown
3376
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3376
firefox.exe
216.58.212.138:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
3376
firefox.exe
142.250.185.195:80
ocsp.pki.goog
Google Inc.
US
whitelisted
3376
firefox.exe
65.9.66.58:443
firefox-settings-attachments.cdn.mozilla.net
AT&T Services, Inc.
US
suspicious
3376
firefox.exe
34.216.80.151:443
shavar.services.mozilla.com
Amazon.com, Inc.
US
unknown
3376
firefox.exe
65.9.66.70:443
snippets.cdn.mozilla.net
AT&T Services, Inc.
US
suspicious
3376
firefox.exe
34.107.221.82:80
detectportal.firefox.com
—
US
whitelisted

DNS requests

Domain
IP
Reputation
detectportal.firefox.com
  • 34.107.221.82
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
whitelisted
example.org
  • 93.184.216.34
whitelisted
ipv4only.arpa
  • 192.0.0.170
  • 192.0.0.171
whitelisted
firefox.settings.services.mozilla.com
  • 65.9.66.111
  • 65.9.66.57
  • 65.9.66.92
  • 65.9.66.20
whitelisted
location.services.mozilla.com
  • 44.236.127.247
  • 44.237.173.75
  • 44.238.41.205
  • 52.10.171.58
  • 34.216.198.143
  • 34.210.121.31
whitelisted
locprod2-elb-us-west-2.prod.mozaws.net
  • 34.210.121.31
  • 34.216.198.143
  • 52.10.171.58
  • 44.238.41.205
  • 44.237.173.75
  • 44.236.127.247
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
cs9.wac.phicdn.net
  • 93.184.220.29
whitelisted
content-signature-2.cdn.mozilla.net
  • 13.32.25.69
  • 13.32.25.81
  • 13.32.25.34
  • 13.32.25.96
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
next.php