analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

open this file to install the software you need (1).exe

Full analysis: https://app.any.run/tasks/a5774c22-c95c-4755-b89a-53afe31d7e60
Verdict: Malicious activity
Analysis date: July 13, 2020, 06:43:30
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

22344C7598D883DEA1495984B1EA7FBE

SHA1:

1AB66C88E0379A88E1698E2CF7C9135C4BBB7D44

SHA256:

37262AC81222CAC6A2348BB45EC87AE96EDB9E4F9EE317772A861F9ABAFBD6FD

SSDEEP:

393216:hN7rbYLTPbvENud6K8kuK8nClIJEYdc22MMes0F76duS:vrsTOud6tc8nFJhOTanF7g

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • open this file to install the software you need (1).exe (PID: 1360)
      • setup-stub.exe (PID: 2308)
      • open this file to install the software you need (1).exe (PID: 2128)
      • maintenanceservice_installer.exe (PID: 3716)
      • setup.exe (PID: 2616)
      • csrss.exe (PID: 388)
      • default-browser-agent.exe (PID: 2976)
      • firefox.exe (PID: 916)
      • firefox.exe (PID: 4008)
      • firefox.exe (PID: 2824)
      • csrss.exe (PID: 344)
      • firefox.exe (PID: 4028)
      • firefox.exe (PID: 4076)
      • firefox.exe (PID: 2400)
      • firefox.exe (PID: 1456)
      • firefox.exe (PID: 2352)
      • firefox.exe (PID: 2344)
      • pingsender.exe (PID: 2960)
      • pingsender.exe (PID: 124)
      • SearchProtocolHost.exe (PID: 676)

    • Application was dropped or rewritten from another process

      • Firefox Installer.exe (PID: 4044)
      • setup-stub.exe (PID: 2308)
      • setup.exe (PID: 2616)
      • maintenanceservice_installer.exe (PID: 3716)
      • firefox.exe (PID: 2824)
      • maintenanceservice.exe (PID: 2736)
      • default-browser-agent.exe (PID: 2976)
      • firefox.exe (PID: 916)
      • ns9EC5.tmp (PID: 2224)
      • firefox.exe (PID: 4008)
      • readerdc_en_xa_crd_install.exe (PID: 2712)
      • gccheck_small.exe (PID: 3720)
      • firefox.exe (PID: 4028)
      • gtcheck.exe (PID: 2452)
      • gccheck_small.exe (PID: 2720)
      • firefox.exe (PID: 4076)
      • firefox.exe (PID: 2344)
      • firefox.exe (PID: 2352)
      • firefox.exe (PID: 1456)
      • pingsender.exe (PID: 124)
      • pingsender.exe (PID: 2960)
      • setup.exe (PID: 272)
      • firefox.exe (PID: 2400)

    • Actions looks like stealing of personal data

      • setup-stub.exe (PID: 2308)
      • download.exe (PID: 1712)
      • 9B172B02-F924-493B-A8EA-85BF5BDCE688 (PID: 3956)

    • Loads the Task Scheduler COM API

      • default-browser-agent.exe (PID: 2976)

    • Changes settings of System certificates

      • readerdc_en_xa_crd_install.exe (PID: 2712)
      • msiexec.exe (PID: 3832)
      • setup-stub.exe (PID: 2308)

  • SUSPICIOUS

    • Creates a software uninstall entry

      • open this file to install the software you need (1).exe (PID: 1360)
      • setup.exe (PID: 2616)
      • maintenanceservice_installer.exe (PID: 3716)

    • Executable content was dropped or overwritten

      • open this file to install the software you need (1).exe (PID: 2128)
      • Firefox Installer.exe (PID: 4044)
      • open this file to install the software you need (1).exe (PID: 1360)
      • setup-stub.exe (PID: 2308)
      • download.exe (PID: 1712)
      • setup.exe (PID: 2616)
      • maintenanceservice_installer.exe (PID: 3716)
      • readerdc_en_xa_crd_install.exe (PID: 2712)
      • firefox.exe (PID: 4028)
      • 9B172B02-F924-493B-A8EA-85BF5BDCE688 (PID: 3956)
      • msiexec.exe (PID: 3832)

    • Application launched itself

      • open this file to install the software you need (1).exe (PID: 2128)

    • Reads Internet Cache Settings

      • setup-stub.exe (PID: 2308)
      • readerdc_en_xa_crd_install.exe (PID: 2712)

    • Creates files in the program directory

      • setup-stub.exe (PID: 2308)
      • setup.exe (PID: 2616)
      • maintenanceservice.exe (PID: 2736)
      • maintenanceservice_installer.exe (PID: 3716)
      • firefox.exe (PID: 4028)
      • 9B172B02-F924-493B-A8EA-85BF5BDCE688 (PID: 3956)

    • Creates COM task schedule object

      • setup.exe (PID: 2616)
      • msiexec.exe (PID: 3832)

    • Loads DLL from Mozilla Firefox

      • setup.exe (PID: 2616)
      • default-browser-agent.exe (PID: 2976)
      • csrss.exe (PID: 388)
      • csrss.exe (PID: 344)

    • Modifies the open verb of a shell class

      • setup.exe (PID: 2616)
      • msiexec.exe (PID: 3832)

    • Starts application with an unusual extension

      • setup.exe (PID: 2616)
      • readerdc_en_xa_crd_install.exe (PID: 2712)

    • Creates files in the user directory

      • setup.exe (PID: 2616)
      • readerdc_en_xa_crd_install.exe (PID: 2712)

    • Reads internet explorer settings

      • readerdc_en_xa_crd_install.exe (PID: 2712)

    • Adds / modifies Windows certificates

      • readerdc_en_xa_crd_install.exe (PID: 2712)
      • msiexec.exe (PID: 3832)
      • setup-stub.exe (PID: 2308)

    • Disables SEHOP

      • msiexec.exe (PID: 3832)

    • Creates files in the Windows directory

      • MsiExec.exe (PID: 692)
      • wusa.exe (PID: 308)
      • msiexec.exe (PID: 3832)

    • Removes files from Windows directory

      • MsiExec.exe (PID: 692)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • setup.exe (PID: 2616)
      • download.exe (PID: 1712)
      • firefox.exe (PID: 4028)
      • msiexec.exe (PID: 3832)

    • Reads settings of System Certificates

      • setup-stub.exe (PID: 2308)
      • readerdc_en_xa_crd_install.exe (PID: 2712)
      • msiexec.exe (PID: 3832)

    • Manual execution by user

      • firefox.exe (PID: 2824)

    • Application launched itself

      • firefox.exe (PID: 4028)
      • msiexec.exe (PID: 3832)

    • Creates files in the user directory

      • firefox.exe (PID: 4028)

    • Dropped object may contain TOR URL's

      • firefox.exe (PID: 4028)

    • Reads CPU info

      • firefox.exe (PID: 4028)

    • Reads Internet Cache Settings

      • pingsender.exe (PID: 2960)
      • pingsender.exe (PID: 124)
      • firefox.exe (PID: 4028)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 692)
      • msiexec.exe (PID: 3832)
      • MsiExec.exe (PID: 2196)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3832)

    • Starts application with an unusual extension

      • msiexec.exe (PID: 3832)

    • Application was dropped or rewritten from another process

      • MSIB342.tmp (PID: 2796)

    • Creates files in the program directory

      • msiexec.exe (PID: 3832)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

ProductVersion: 1.0.0.0
LegalCopyright: American Power and Gas
FileVersion: 1.0.0.0
FileDescription: -
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 1.0.0.0
FileVersionNumber: 1.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 5
ImageVersion: 6
OSVersion: 5
EntryPoint: 0x38af
UninitializedDataSize: 16896
InitializedDataSize: 489984
CodeSize: 29696
LinkerVersion: 10
PEType: PE32
TimeStamp: 2012:02:24 20:20:04+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 24-Feb-2012 19:20:04
Detected languages:
  • English - United States
FileDescription: -
FileVersion: 1.0.0.0
LegalCopyright: American Power and Gas
ProductVersion: 1.0.0.0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000D0

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 24-Feb-2012 19:20:04
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0000728C
0x00007400
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.49971
.rdata
0x00009000
0x00002B6E
0x00002C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.49793
.data
0x0000C000
0x00072B9C
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
1.80494
.ndata
0x0007F000
0x000E1000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00160000
0x0000C778
0x0000C800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.08671
.reloc
0x0016D000
0x00000FD6
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
3.33841

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.2266
957
UNKNOWN
English - United States
RT_MANIFEST
2
0
3752
UNKNOWN
English - United States
RT_ICON
3
0
2216
UNKNOWN
English - United States
RT_ICON
4
0
1384
UNKNOWN
English - United States
RT_ICON
5
0
1128
UNKNOWN
English - United States
RT_ICON
6
0
744
UNKNOWN
English - United States
RT_ICON
7
0
296
UNKNOWN
English - United States
RT_ICON
103
3.18266
104
UNKNOWN
English - United States
RT_GROUP_ICON
105
2.73893
514
UNKNOWN
English - United States
RT_DIALOG
106
2.91148
248
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
VERSION.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
81
Monitored processes
39
Malicious processes
24
Suspicious processes
5

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start open this file to install the software you need (1).exe open this file to install the software you need (1).exe firefox installer.exe setup-stub.exe download.exe setup.exe ns9ec5.tmp no specs maintenanceservice_installer.exe maintenanceservice.exe no specs default-browser-agent.exe no specs csrss.exe no specs firefox.exe no specs firefox.exe no specs csrss.exe no specs firefox.exe firefox.exe no specs readerdc_en_xa_crd_install.exe gtcheck.exe no specs gccheck_small.exe no specs conhost.exe no specs gccheck_small.exe no specs conhost.exe no specs firefox.exe firefox.exe searchprotocolhost.exe no specs firefox.exe firefox.exe firefox.exe pingsender.exe conhost.exe no specs pingsender.exe conhost.exe no specs 9b172b02-f924-493b-a8ea-85bf5bdce688 setup.exe no specs msiexec.exe msiexec.exe no specs msiexec.exe no specs wusa.exe no specs msib342.tmp no specs

Process information

PID
CMD
Path
Indicators
Parent process
2128"C:\Users\admin\Downloads\open this file to install the software you need (1).exe" C:\Users\admin\Downloads\open this file to install the software you need (1).exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Version:
1.0.0.0
1360"C:\Users\admin\Downloads\open this file to install the software you need (1).exe" /UAC:2012C /NCRC C:\Users\admin\Downloads\open this file to install the software you need (1).exe
open this file to install the software you need (1).exe
User:
admin
Integrity Level:
HIGH
Version:
1.0.0.0
4044"C:\Users\admin\AppData\Local\Temp\Firefox Installer\Firefox Installer.exe"C:\Users\admin\AppData\Local\Temp\Firefox Installer\Firefox Installer.exe
open this file to install the software you need (1).exe
User:
admin
Company:
Mozilla
Integrity Level:
HIGH
Description:
Firefox
Exit code:
0
Version:
18.05
2308.\setup-stub.exeC:\Users\admin\AppData\Local\Temp\7zSCCFFBADF\setup-stub.exe
Firefox Installer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
HIGH
Description:
Firefox Installer
Exit code:
0
Version:
76.0.1
1712"C:\Users\admin\AppData\Local\Temp\nsgE249.tmp\download.exe" /LaunchedFromStub /INI=C:\Users\admin\AppData\Local\Temp\nsgE249.tmp\config.iniC:\Users\admin\AppData\Local\Temp\nsgE249.tmp\download.exe
setup-stub.exe
User:
admin
Company:
Mozilla
Integrity Level:
HIGH
Description:
Firefox
Exit code:
0
Version:
18.05
2616.\setup.exe /LaunchedFromStub /INI=C:\Users\admin\AppData\Local\Temp\nsgE249.tmp\config.iniC:\Users\admin\AppData\Local\Temp\7zS0B6B0890\setup.exe
download.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
HIGH
Description:
Firefox Installer
Exit code:
0
Version:
78.0.2
2224"C:\Users\admin\AppData\Local\Temp\nsn981C.tmp\ns9EC5.tmp" "C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe"C:\Users\admin\AppData\Local\Temp\nsn981C.tmp\ns9EC5.tmp—setup.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
3716"C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe"C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe
ns9EC5.tmp
User:
admin
Company:
Mozilla Corporation
Integrity Level:
HIGH
Description:
Mozilla Maintenance Service Installer
Exit code:
0
Version:
78.0.2
2736"C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe" installC:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe—maintenanceservice_installer.exe
User:
admin
Company:
Mozilla Foundation
Integrity Level:
HIGH
Exit code:
0
Version:
78.0.2
2976"C:\Program Files\Mozilla Firefox\default-browser-agent.exe" register-task 308046B0AF4A39CBC:\Program Files\Mozilla Firefox\default-browser-agent.exe—setup.exe
User:
admin
Company:
Mozilla Foundation
Integrity Level:
HIGH
Description:
Firefox Default Browser Agent
Exit code:
0
Version:
78.0.2
Total events
15 772
Read events
8 277
Write events
0
Delete events
0

Modification events

No data
Executable files
544
Suspicious files
139
Text files
478
Unknown types
257

Dropped files

PID
Process
Filename
Type
1360open this file to install the software you need (1).exeC:\Users\admin\AppData\Local\Temp\Firefox Installer\3CXPhone6(2).msi —
MD5:—
SHA256:—
4044Firefox Installer.exeC:\Users\admin\AppData\Local\Temp\7zSCCFFBADF\postSigningData —
MD5:—
SHA256:—
1360open this file to install the software you need (1).exeC:\Users\admin\AppData\Local\Temp\Firefox Installer\newest.icoimage
MD5:78C49835301428E1E039673F9AFEFAEA
SHA256:2153B66684B0D7A0A00334D246348899095A693086CF9A0ECA508B6661FD6523
1360open this file to install the software you need (1).exeC:\Users\admin\AppData\Local\Temp\Firefox Installer\Firefox Installer.exeexecutable
MD5:4E768DD187019C6875777975F82E0700
SHA256:F838C3B5493DB5585B3AA3EFA343B8A9E5EFCA8D6BECE3629394336718F1B6F1
4044Firefox Installer.exeC:\Users\admin\AppData\Local\Temp\7zSCCFFBADF\setup-stub.exeexecutable
MD5:C4F7D6853D25B1A03005C2358A630E36
SHA256:46815FC813EA676B74A40180D344C94C3DA7F9F1906C4422F5987B6874150ADA
2308setup-stub.exeC:\Users\admin\AppData\Local\Temp\nsgE249.tmp\bgstub.jpgimage
MD5:7C2899CE7038A456C772F45F21CF9EFE
SHA256:A201E838CAEC6EAC014A6FACAF3AE5B8FD625BEA510C856B332C535958E4CAB2
1360open this file to install the software you need (1).exeC:\Users\admin\AppData\Local\Temp\nsy81F9.tmp\NAct.dllexecutable
MD5:B781C5004E993CB38352B153B036443D
SHA256:D6EAE53AB03F4EF27F1D0EC8E8EF2BAE42AB7F8086E527A0BE3E6D553FEDE889
1360open this file to install the software you need (1).exeC:\Users\admin\AppData\Local\Temp\Firefox Installer\readerdc_en_xa_crd_install.exeexecutable
MD5:C3012B659E4D289077B21CD1ACB9F6EB
SHA256:1286AD32A4FAAAF058347A39EF39A2BB02B3BBDF6CE36FF2DDD2D259E7B869D2
1360open this file to install the software you need (1).exeC:\Users\admin\AppData\Local\apgremote\uninst.exeexecutable
MD5:069A883972374E850CF54F450A8F65A8
SHA256:64CD9F710D05C2AA2B6E7DF6F997A13E2407968E7AE4685714F06AC639A99C18
2308setup-stub.exeC:\Users\admin\AppData\Local\Temp\nsgE249.tmp\System.dllexecutable
MD5:17ED1C86BD67E78ADE4712BE48A7D2BD
SHA256:BD046E6497B304E4EA4AB102CAB2B1F94CE09BDE0EEBBA4C59942A732679E4EB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
47
DNS requests
88
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2712
readerdc_en_xa_crd_install.exe
GET
302
15.188.154.177:80
http://stats.adobe.com/b/ss/adbacdcprod/1/H.25.4/s08367932714374?AQB=1&ndh=1&t=13%2F6%2F2020%207%3A45%3A20%201%20-60&ce=UTF-8&ns=adobecorp&pageName=acdc_rdr_adm_launched&g=res%3A%2F%2FC%3A%5CUsers%5Cadmin%5CAppData%5CLocal%5CTemp%5CFirefox%20Installer%5Creaderdc_en_xa_crd_install.exe%2F160&ch=acdc_reader&events=event96&products=%3Breader_adm&c1=adm&c2=acdc%20downloads&c3=get.adobe.com&c4=en_us&c5=en_us%3Aacdc_rdr_adm_launched&v18=new&v22=monday%20-%2012%3A30am&v73=acdc_reader&s=1280x720&c=32&j=1.5&v=Y&k=N&bw=620&bh=358&ct=lan&hp=N&AQE=1
US
—
—
whitelisted
2308
setup-stub.exe
GET
200
52.32.180.226:80
http://download-stats.mozilla.org/stub/v8/release/release/en-US/0/0/6/1/7601/1/0/0/2/0/52816160/52816160/0/0/31/30/0/0/9/6/0/0/1/68.0.1/20190717172542/78.0.2/20200708170202/1/1/0/3/52.222.155.231/0/2/1
US
—
—
whitelisted
4028
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
4028
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
4028
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
4028
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
4028
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
4028
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
4028
firefox.exe
GET
200
2.16.177.18:80
http://detectportal.firefox.com/success.txt
unknown
text
8 b
whitelisted
4028
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2308
setup-stub.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2712
readerdc_en_xa_crd_install.exe
192.147.130.63:443
get.adobe.com
Adobe Systems Inc.
US
whitelisted
2308
setup-stub.exe
52.222.158.194:443
product-details.mozilla.org
Amazon.com, Inc.
US
unknown
4028
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
4028
firefox.exe
52.222.158.168:443
firefox.settings.services.mozilla.com
Amazon.com, Inc.
US
whitelisted
4028
firefox.exe
52.222.158.66:443
product-details.mozilla.org
Amazon.com, Inc.
US
unknown
2308
setup-stub.exe
52.32.180.226:80
download-stats.mozilla.org
Amazon.com, Inc.
US
unknown
2308
setup-stub.exe
52.222.155.231:443
download-installer.cdn.mozilla.net
Amazon.com, Inc.
US
unknown
4028
firefox.exe
52.222.158.79:443
content-signature-2.cdn.mozilla.net
Amazon.com, Inc.
US
malicious
2712
readerdc_en_xa_crd_install.exe
23.210.248.251:443
dlmping2.adobe.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
product-details.mozilla.org
  • 52.222.158.194
  • 52.222.158.40
  • 52.222.158.66
  • 52.222.158.90
shared
ocsp.digicert.com
  • 93.184.220.29
whitelisted
download.mozilla.org
  • 34.234.123.70
  • 54.209.104.15
  • 52.20.200.231
whitelisted
download-installer.cdn.mozilla.net
  • 52.222.155.231
whitelisted
download-stats.mozilla.org
  • 52.32.180.226
  • 34.215.48.141
whitelisted
get.adobe.com
  • 192.147.130.63
whitelisted
dlmping2.adobe.com
  • 23.210.248.251
whitelisted
stats.adobe.com
  • 15.188.154.177
  • 15.236.175.233
  • 15.236.9.100
whitelisted
platformdl.adobe.com
  • 23.210.248.251
whitelisted
ardownload2.adobe.com
  • 23.210.248.251
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
—
—
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
open this file to install the software you need (1).exe