| URL: | https://js.te5.com/public/css/reset.css |
| Full analysis: | https://app.any.run/tasks/3f06e47e-7ccb-4803-ba39-ce3ba24ccc47 |
| Verdict: | Malicious activity |
| Analysis date: | July 20, 2023, 09:36:23 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | 0313109B1A2C0A1F66E2C74436DA2A5E |
| SHA1: | 703169F5AE0F21D84E929723EA96374AE5AF5794 |
| SHA256: | FFCB93FC1911EC27AA813BD19804D0A145AEFC6BD29371E05DF33FEE3F21BD94 |
| SSDEEP: | 3:N8u2OQHJvKXzAtgn:2p/HJkstgn |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 620 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1116.8.678175022\48723945" -childID 6 -isForBrowser -prefsHandle 3864 -prefMapHandle 3860 -prefsLen 29657 -prefMapSize 243323 -jsInitHandle 912 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e874d5e5-54c7-4ca6-ad0d-f25b26e7cfbe} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" 3888 217ec840 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 868 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1116.2.602689880\1786125046" -childID 1 -isForBrowser -prefsHandle 2216 -prefMapHandle 2220 -prefsLen 24503 -prefMapSize 243323 -jsInitHandle 912 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b3cbc67-8c76-49c7-ad4a-3228cb8768e7} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" 2232 efa79b0 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 1116 | "C:\Program Files\Mozilla Firefox\firefox.exe" https://js.te5.com/public/css/reset.css | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 1604 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1116.5.657091193\1737105354" -parentBuildID 20230710165010 -prefsHandle 3064 -prefMapHandle 3036 -prefsLen 27916 -prefMapSize 243323 -appDir "C:\Program Files\Mozilla Firefox\browser" - {525ce4a4-f2bc-46f2-b5eb-24eb4619d033} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" 3080 1f9c0f20 rdd | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2040 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1116.9.38147789\1972060942" -childID 7 -isForBrowser -prefsHandle 4068 -prefMapHandle 4056 -prefsLen 32990 -prefMapSize 243323 -jsInitHandle 912 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc3f0254-0caf-40fb-bb54-b2c99a39cfbb} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" 4124 217ec9b0 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2208 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1116.10.1070066299\1107407262" -childID 8 -isForBrowser -prefsHandle 8552 -prefMapHandle 8612 -prefsLen 32486 -prefMapSize 243323 -jsInitHandle 912 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4fd712d3-9614-4eb8-b401-40e759d7b7e0} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" 8544 23ae1840 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2420 | "C:\Program Files\Mozilla Firefox\default-browser-agent.exe" do-task "308046B0AF4A39CB" | C:\Program Files\Mozilla Firefox\default-browser-agent.exe | taskeng.exe | ||||||||||||
User: admin Company: Mozilla Foundation Integrity Level: MEDIUM Description: Firefox Default Browser Agent Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2548 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1116.4.1191287690\107851715" -childID 3 -isForBrowser -prefsHandle 2660 -prefMapHandle 2664 -prefsLen 24580 -prefMapSize 243323 -jsInitHandle 912 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3750c35c-9258-4f73-a5b4-882419cf5ba9} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" 2648 1e12b3f0 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2552 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1116.7.2118599618\910907379" -childID 5 -isForBrowser -prefsHandle 3712 -prefMapHandle 3660 -prefsLen 29657 -prefMapSize 243323 -jsInitHandle 912 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {07b61b9e-ae6d-4820-9af9-81d6556d32a9} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" 3724 217ec6d0 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2596 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1116.0.531311760\193202945" -parentBuildID 20230710165010 -prefsHandle 1100 -prefMapHandle 1092 -prefsLen 25853 -prefMapSize 243323 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d48a9479-1781-40d7-a174-e09a35ec7181} 1116 "\\.\pipe\gecko-crash-server-pipe.1116" 1172 d57e1a0 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| (PID) Process: | (3888) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | delete value | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Launcher |
Value: 09611C1E1E000000 | |||
| (PID) Process: | (3888) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | delete value | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Browser |
Value: AD681C1E1E000000 | |||
| (PID) Process: | (1116) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry |
Value: 1 | |||
| (PID) Process: | (1116) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\DllPrefetchExperiment |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe |
Value: 0 | |||
| (PID) Process: | (1116) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableTelemetry |
Value: 1 | |||
| (PID) Process: | (1116) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableDefaultBrowserAgent |
Value: 0 | |||
| (PID) Process: | (1116) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
| (PID) Process: | (1116) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
| Operation: | write | Name: | SavedLegacySettings |
Value: 4600000047010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (1116) firefox.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3416) wmpnscfg.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{02BFB594-9673-4044-A5B7-DA032BA30FF8}\{6B12237D-E8E4-441F-AB6C-411A2C63EEE5} |
| Operation: | delete key | Name: | (default) |
Value: | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1116 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\webappsstore.sqlite-wal | — | |
MD5:— | SHA256:— | |||
| 1116 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\permissions.sqlite-journal | binary | |
MD5:E3FC380BC620D3B42E38CD5D7C069979 | SHA256:513B2DB9B24DFF5E9697C244145CA2877E1BF3667C6123B40364F3DB6CD91A24 | |||
| 1116 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 1116 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\compatibility.ini | text | |
MD5:5A14BC3397EA072906B63D69FC704FEA | SHA256:03F45724EA1FE89E753AA76B40DE9078BFC9160AA1065ED9D4D98DA04B7FB3E7 | |||
| 1116 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp | binary | |
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A | SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA | |||
| 1116 | firefox.exe | C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\profile_count_308046B0AF4A39CB.json | binary | |
MD5:58728D2E9D553BB2369BDB4A618ACAE5 | SHA256:7EBC652A4B5B43608F61AC1057C51EC2EC1C8E33BBEB130794E15AF72BEB42E8 | |||
| 1116 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js | text | |
MD5:68D8893433705647CB62966BB551E8BE | SHA256:C1036A40E5FF0C395D1EFBEFE4AE3C2FDF3EDED5FB568EC20855BE5F76ABDAFC | |||
| 1116 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\ls-archive-tmp.sqlite | binary | |
MD5:446FBAA8B14B3C86BFCEF8BE65EE7D80 | SHA256:47DBD4AF1EF0E76FD0FC756D4F3A397C251F63CB1B71B1B4405FCA69C1DED6E0 | |||
| 1116 | firefox.exe | C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json | binary | |
MD5:E812E56D0B6EDF84B4A0B959F53E239F | SHA256:D55B72651CD0C5B834EAA29BA778BE7EDC357C16163A77AE778DCD61E85C3582 | |||
| 1116 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.js | text | |
MD5:68D8893433705647CB62966BB551E8BE | SHA256:C1036A40E5FF0C395D1EFBEFE4AE3C2FDF3EDED5FB568EC20855BE5F76ABDAFC | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1084 | svchost.exe | GET | 304 | 209.197.3.8:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?92a823c0c57dc84f | US | — | — | whitelisted |
1116 | firefox.exe | POST | 200 | 95.101.54.131:80 | http://r3.o.lencr.org/ | DE | binary | 503 b | shared |
1116 | firefox.exe | POST | 200 | 95.101.54.131:80 | http://r3.o.lencr.org/ | DE | binary | 503 b | shared |
1116 | firefox.exe | POST | — | 142.250.186.163:80 | http://ocsp.pki.goog/gts1c3 | US | — | — | whitelisted |
1116 | firefox.exe | POST | 200 | 95.101.54.131:80 | http://r3.o.lencr.org/ | DE | binary | 503 b | shared |
1116 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | US | text | 8 b | whitelisted |
1116 | firefox.exe | POST | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/ | US | binary | 471 b | whitelisted |
1116 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/canonical.html | US | text | 90 b | whitelisted |
1116 | firefox.exe | POST | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/ | US | binary | 471 b | whitelisted |
1116 | firefox.exe | POST | 200 | 95.101.54.131:80 | http://r3.o.lencr.org/ | DE | binary | 503 b | shared |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1116 | firefox.exe | 34.107.221.82:80 | detectportal.firefox.com | GOOGLE | US | whitelisted |
3232 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
1116 | firefox.exe | 34.117.237.239:443 | contile.services.mozilla.com | GOOGLE-CLOUD-PLATFORM | US | suspicious |
1116 | firefox.exe | 3.229.85.40:443 | spocs.getpocket.com | AMAZON-AES | US | unknown |
1116 | firefox.exe | 142.250.185.170:443 | safebrowsing.googleapis.com | GOOGLE | US | whitelisted |
1116 | firefox.exe | 35.201.103.21:443 | normandy.cdn.mozilla.net | GOOGLE | US | unknown |
1116 | firefox.exe | 34.149.100.209:443 | firefox.settings.services.mozilla.com | GOOGLE | US | suspicious |
1116 | firefox.exe | 34.117.65.55:443 | push.services.mozilla.com | GOOGLE-CLOUD-PLATFORM | US | suspicious |
Domain | IP | Reputation |
|---|---|---|
detectportal.firefox.com |
| whitelisted |
js.te5.com |
| malicious |
prod.detectportal.prod.cloudops.mozgcp.net |
| whitelisted |
contile.services.mozilla.com |
| whitelisted |
spocs.getpocket.com |
| shared |
proxyserverecs-1736642167.us-east-1.elb.amazonaws.com |
| shared |
normandy.cdn.mozilla.net |
| whitelisted |
normandy-cdn.services.mozilla.com |
| whitelisted |
safebrowsing.googleapis.com |
| whitelisted |
push.services.mozilla.com |
| whitelisted |