URL:

bateandholland.com/zveuadyyeydg/dgfheytdggwdg/vhwuetrtedgwg/wiodhgyjuhfg/ur9jhg

Full analysis: https://app.any.run/tasks/8226292b-8bc2-4e5b-91ed-fbcabf3a9108
Verdict: Malicious activity
Analysis date: May 31, 2025, 12:24:51
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
phishing
Indicators:
MD5:

99C91F25A4DA254AADF0952D022C58AB

SHA1:

81673A5F2465DC2A1EC9E324EBDB359215BDF1C2

SHA256:

F5A46FFDF9937A067029223444982F6C772DD31AC7B0695A7D6E60B84329E603

SSDEEP:

3:tiNKkLkK6cK6DKTNSQAUCSJS4fIn:tuTkKfkAbScXn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • PHISHING has been detected (SURICATA)

      • firefox.exe (PID: 4020)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Application launched itself

      • firefox.exe (PID: 4020)
      • firefox.exe (PID: 5556)

    • Reads the software policy settings

      • slui.exe (PID: 7596)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
20
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start firefox.exe no specs #PHISHING firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs sppextcomobj.exe no specs slui.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
772"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5664 -childID 10 -isForBrowser -prefsHandle 5040 -prefMapHandle 5348 -prefsLen 31324 -prefMapSize 244583 -jsInitHandle 1412 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f973f1e-5e6e-4ade-b7a1-8d499a7c5550} 4020 "\\.\pipe\gecko-crash-server-pipe.4020" 1d3d6336bd0 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
1164C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2740"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2664 -childID 1 -isForBrowser -prefsHandle 2872 -prefMapHandle 2868 -prefsLen 26911 -prefMapSize 244583 -jsInitHandle 1412 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6748563b-3979-4b56-a193-07d79f595795} 4020 "\\.\pipe\gecko-crash-server-pipe.4020" 1d3d06b5f50 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\vcruntime140_1.dll
4020"C:\Program Files\Mozilla Firefox\firefox.exe" bateandholland.com/zveuadyyeydg/dgfheytdggwdg/vhwuetrtedgwg/wiodhgyjuhfg/ur9jhgC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
4608"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1076 -childID 11 -isForBrowser -prefsHandle 5752 -prefMapHandle 5756 -prefsLen 31324 -prefMapSize 244583 -jsInitHandle 1412 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8867bce-2f57-4cec-94d0-b9673867fe30} 4020 "\\.\pipe\gecko-crash-server-pipe.4020" 1d3d6336150 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140.dll
4628"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5044 -childID 6 -isForBrowser -prefsHandle 5296 -prefMapHandle 5036 -prefsLen 31243 -prefMapSize 244583 -jsInitHandle 1412 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ca118d12-1fac-48f2-b210-a6f685dc9a6a} 4020 "\\.\pipe\gecko-crash-server-pipe.4020" 1d3d6369690 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
4700"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1904 -parentBuildID 20240213221259 -prefsHandle 1828 -prefMapHandle 1804 -prefsLen 31031 -prefMapSize 244583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c9ca5b6-2c85-47d1-b970-5ac4d4c6f96e} 4020 "\\.\pipe\gecko-crash-server-pipe.4020" 1d3cbde5410 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
5176"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5672 -childID 9 -isForBrowser -prefsHandle 5660 -prefMapHandle 5344 -prefsLen 31324 -prefMapSize 244583 -jsInitHandle 1412 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {95d428e0-db17-4c29-9344-dfcef60d7e3f} 4020 "\\.\pipe\gecko-crash-server-pipe.4020" 1d3d6336690 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\vcruntime140_1.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\crypt32.dll
5556"C:\Program Files\Mozilla Firefox\firefox.exe" "bateandholland.com/zveuadyyeydg/dgfheytdggwdg/vhwuetrtedgwg/wiodhgyjuhfg/ur9jhg"C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\mozglue.dll
c:\program files\mozilla firefox\vcruntime140_1.dll
c:\program files\mozilla firefox\vcruntime140.dll
c:\windows\system32\crypt32.dll
6652"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2120 -parentBuildID 20240213221259 -prefsHandle 2104 -prefMapHandle 2100 -prefsLen 31031 -prefMapSize 244583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {70c77889-95c2-4023-bbb7-67de0539105f} 4020 "\\.\pipe\gecko-crash-server-pipe.4020" 1d3bed80910 socketC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\vcruntime140_1.dll
Total events
20 091
Read events
20 090
Write events
1
Delete events
0

Modification events

(PID) Process:(4020) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
0
Executable files
0
Suspicious files
160
Text files
24
Unknown types
25

Dropped files

PID
Process
Filename
Type
4020firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
4020firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-child-current.binbinary
MD5:22DA36CA5BA1D055ADE237F52DC825A7
SHA256:7438A5D5298BFA0ABAB51E6B35EAC0F26B830BCEFBDBEB5F07721DBA34F89E0D
4020firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite —
MD5:—
SHA256:—
4020firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\datareporting\glean\db\data.safe.bindbf
MD5:3B156E12141F8CBCE9D60CDCE2077617
SHA256:E6287E44B44ABEA20E1B2E3F415D22B9E5E5FBBC155AD9DADBABA63951B2AF6F
4020firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-walbinary
MD5:1BA8D4964161145C5D556954AA1EDC4D
SHA256:CAB9C6F17FA189C83678411A9560CFEB23497C30A69D90F8C8867197A3BCFD40
4020firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
4020firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\datareporting\glean\db\data.safe.tmpdbf
MD5:3B156E12141F8CBCE9D60CDCE2077617
SHA256:E6287E44B44ABEA20E1B2E3F415D22B9E5E5FBBC155AD9DADBABA63951B2AF6F
4020firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cert9.db-journalbinary
MD5:40D321AB920EADAF0D15D7C2A6849CEB
SHA256:99630BDC315C65527BCE7BA8879F34BD972BC77ED8F907D396D351D9FDD8DAD0
4020firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cert9.dbsqlite
MD5:AFB7AE1266761E88B18CF868A3DC6958
SHA256:CCAB6D6E499509A9A7C10E6348A0DE30687C43B69520EBB0C5F018438E4261CF
4020firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\protections.sqlite-journalbinary
MD5:97565B0B2CA5F956ECEF8E0D1EED6003
SHA256:5C93BE5D09FFD06DF33319FA891D93CF59D9B750E3260574F33ECC6B54956093
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
28
TCP/UDP connections
80
DNS requests
134
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7552
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7552
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4020
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
4020
firefox.exe
GET
301
51.68.203.145:80
http://bateandholland.com/zveuadyyeydg/dgfheytdggwdg/vhwuetrtedgwg/wiodhgyjuhfg/ur9jhg
unknown
—
—
unknown
4020
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
4020
firefox.exe
POST
200
142.250.186.163:80
http://o.pki.goog/s/wr3/FIY
unknown
—
—
whitelisted
4020
firefox.exe
POST
200
184.24.77.54:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
4020
firefox.exe
POST
200
184.24.77.54:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
8028
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
7552
svchost.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
7552
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4020
firefox.exe
51.68.203.145:80
bateandholland.com
OVH SAS
FR
unknown
4020
firefox.exe
34.36.137.203:443
contile.services.mozilla.com
GOOGLE-CLOUD-PLATFORM
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 216.58.206.78
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
contile.services.mozilla.com
  • 34.36.137.203
whitelisted
spocs.getpocket.com
  • 34.36.137.203
whitelisted
bateandholland.com
  • 51.68.203.145
unknown
detectportal.firefox.com
  • 34.107.221.82
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
mc.prod.ads.prod.webservices.mozgcp.net
  • 34.36.137.203
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] DNS Query to Cloudflare Worker App
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] DNS Query to Cloudflare Worker App
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] DNS Query to Cloudflare Worker App
2196
svchost.exe
Misc activity
ET INFO Observed DNS Query to Cloudflare workers.dev Domain
2196
svchost.exe
Misc activity
ET INFO Observed DNS Query to Cloudflare workers.dev Domain
2196
svchost.exe
Misc activity
ET INFO Observed DNS Query to Cloudflare workers.dev Domain
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge
4020
firefox.exe
Possible Social Engineering Attempted
PHISHING [ANY.RUN] Suspicious Cloudflare Worker Name observed in Phishing (TLS SNI)
4020
firefox.exe
Misc activity
ET INFO Observed Cloudflare workers.dev Domain in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
bateandholland.com/zveuadyyeydg/dgfheytdggwdg/vhwuetrtedgwg/wiodhgyjuhfg/ur9jhg