| URL: | https://advanced-ip-scanner.en.softonic.com/ |
| Full analysis: | https://app.any.run/tasks/8c2004fa-3dea-4093-afd0-401ed1fd5d88 |
| Verdict: | Malicious activity |
| Analysis date: | February 23, 2024, 16:06:13 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | DB8DE16FB00D69438FC2248EB26332F2 |
| SHA1: | 956E042B7E5A527BE5ED0C283944676C581E1C86 |
| SHA256: | 6DB49658A71AE481D1BCA6F2A589AADCD132793890AB70B6185149906A01601E |
| SSDEEP: | 3:N84a5IWHu0LivHLGK3:24aWWF0LGK3 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1308 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1432.3.1255375708\565846866" -childID 2 -isForBrowser -prefsHandle 2968 -prefMapHandle 2964 -prefsLen 34225 -prefMapSize 244195 -jsInitHandle 912 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {097c1665-8cfd-4952-9e8e-729cfa25ade0} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" 2980 1665af70 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 1432 | "C:\Program Files\Mozilla Firefox\firefox.exe" https://advanced-ip-scanner.en.softonic.com/ | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 1652 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1432.14.370200465\771119087" -childID 13 -isForBrowser -prefsHandle 5864 -prefMapHandle 5852 -prefsLen 31122 -prefMapSize 244195 -jsInitHandle 912 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a736cfd-1cae-425c-9b9c-cae166c19fe1} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" 6288 1c59db20 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 1812 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1432.12.1091086359\389994843" -childID 11 -isForBrowser -prefsHandle 6128 -prefMapHandle 6268 -prefsLen 31122 -prefMapSize 244195 -jsInitHandle 912 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4a10d9c-123f-435d-97bb-38133130123e} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" 6136 1cd02840 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 1876 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1432.0.981854879\1973490050" -parentBuildID 20230710165010 -prefsHandle 1120 -prefMapHandle 1112 -prefsLen 28523 -prefMapSize 244195 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b2bb408-e17a-496b-ab85-fab8b1b6378f} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" 1204 d1a7bc0 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2120 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1432.13.1654078001\171871397" -childID 12 -isForBrowser -prefsHandle 3844 -prefMapHandle 6288 -prefsLen 31122 -prefMapSize 244195 -jsInitHandle 912 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {45dffef3-4200-4e5f-9bc1-58bf9ac2c0c0} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" 672 1ada89b0 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2304 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1432.1.1373502737\708591823" -parentBuildID 20230710165010 -prefsHandle 1416 -prefMapHandle 1412 -prefsLen 28600 -prefMapSize 244195 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6c8e80cb-a3fd-4cd4-9d27-8fd4d1700fa3} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" 1428 d11cd50 socket | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2324 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1432.5.385517673\1691141150" -childID 4 -isForBrowser -prefsHandle 7636 -prefMapHandle 7700 -prefsLen 29209 -prefMapSize 244195 -jsInitHandle 912 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {50eced66-bdad-48b4-a908-fb7063ccfe1d} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" 7612 195a0110 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2440 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1432.2.1335891920\1420338705" -childID 1 -isForBrowser -prefsHandle 1612 -prefMapHandle 1964 -prefsLen 24491 -prefMapSize 244195 -jsInitHandle 912 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd55162a-6046-4a27-9662-0a5a98593563} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" 2056 128903f0 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| 2656 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1432.7.113097916\137819175" -childID 6 -isForBrowser -prefsHandle 3312 -prefMapHandle 3308 -prefsLen 31122 -prefMapSize 244195 -jsInitHandle 912 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {77a21099-b4e8-4c7f-b8ae-1cdb82a5d372} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" 2804 1b5f2280 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 115.0.2 Modules
| |||||||||||||||
| (PID) Process: | (3656) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Launcher |
Value: F80FE84F01000000 | |||
| (PID) Process: | (1432) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Browser |
Value: F593EB4F01000000 | |||
| (PID) Process: | (1432) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Installer\308046B0AF4A39CB |
| Operation: | delete value | Name: | installer.taskbarpin.win10.enabled |
Value: | |||
| (PID) Process: | (1432) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry |
Value: 0 | |||
| (PID) Process: | (1432) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\DllPrefetchExperiment |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe |
Value: 0 | |||
| (PID) Process: | (1432) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\PreXULSkeletonUISettings |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Theme |
Value: 1 | |||
| (PID) Process: | (1432) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\PreXULSkeletonUISettings |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe|Enabled |
Value: 1 | |||
| (PID) Process: | (1432) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableTelemetry |
Value: 1 | |||
| (PID) Process: | (1432) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|DisableDefaultBrowserAgent |
Value: 0 | |||
| (PID) Process: | (1432) firefox.exe | Key: | HKEY_CURRENT_USER\Software\Mozilla\Firefox\Default Browser Agent |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox|SetDefaultBrowserUserChoice |
Value: 1 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1432 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.bin | binary | |
MD5:B7A3C61D0C144CC5E166B1E769CA8F8C | SHA256:7FADCB77FFACA6B9E9F15C6F1CD3AAD4C20DCD90FA92429A627A3A7110CA2644 | |||
| 1432 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 1432 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js | text | |
MD5:60E0DE9E05EC76C749D80F0D15A81B21 | SHA256:08252FA62CCCCD316474E20CC7317A6B5C932B2C972234318E8CCDA39EC2EF48 | |||
| 1432 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 1432 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json | binary | |
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A | SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA | |||
| 1432 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 1432 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.js | text | |
MD5:60E0DE9E05EC76C749D80F0D15A81B21 | SHA256:08252FA62CCCCD316474E20CC7317A6B5C932B2C972234318E8CCDA39EC2EF48 | |||
| 1432 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 1432 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 1432 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cert9.db | binary | |
MD5:3B75CCB683B80B2DDC7FFE7C84D8B8BC | SHA256:95AA77B21CDB35DD2D3FBC631E1A840F09FE0DEA31856660A7AABF4BAAEA6DD7 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1432 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | unknown | text | 8 b | unknown |
1432 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/canonical.html | unknown | text | 90 b | unknown |
1432 | firefox.exe | POST | — | 142.250.185.227:80 | http://ocsp.pki.goog/gts1c3 | unknown | — | — | unknown |
1432 | firefox.exe | POST | — | 142.250.185.227:80 | http://ocsp.pki.goog/gts1c3 | unknown | — | — | unknown |
1432 | firefox.exe | POST | 200 | 142.250.185.227:80 | http://ocsp.pki.goog/gts1c3 | unknown | binary | 471 b | unknown |
1432 | firefox.exe | POST | 200 | 172.64.149.23:80 | http://ocsp.usertrust.com/ | unknown | binary | 471 b | unknown |
1432 | firefox.exe | POST | 200 | 95.101.54.107:80 | http://r3.o.lencr.org/ | unknown | binary | 503 b | unknown |
1432 | firefox.exe | POST | 200 | 95.101.54.107:80 | http://r3.o.lencr.org/ | unknown | binary | 503 b | unknown |
1432 | firefox.exe | POST | 200 | 95.101.54.107:80 | http://r3.o.lencr.org/ | unknown | binary | 503 b | unknown |
1432 | firefox.exe | POST | 200 | 172.64.149.23:80 | http://ocsp.usertrust.com/ | unknown | binary | 471 b | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1432 | firefox.exe | 35.227.233.104:443 | advanced-ip-scanner.en.softonic.com | GOOGLE | US | unknown |
1432 | firefox.exe | 34.107.221.82:80 | detectportal.firefox.com | GOOGLE | US | whitelisted |
1432 | firefox.exe | 142.250.186.170:443 | safebrowsing.googleapis.com | — | — | whitelisted |
1432 | firefox.exe | 34.117.188.166:443 | spocs.getpocket.com | — | — | unknown |
1432 | firefox.exe | 34.117.237.239:443 | contile.services.mozilla.com | GOOGLE-CLOUD-PLATFORM | US | unknown |
1432 | firefox.exe | 204.79.197.200:443 | bat.bing.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
1432 | firefox.exe | 142.250.185.227:80 | ocsp.pki.goog | GOOGLE | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
advanced-ip-scanner.en.softonic.com |
| unknown |
detectportal.firefox.com |
| whitelisted |
prod.detectportal.prod.cloudops.mozgcp.net |
| whitelisted |
example.org |
| whitelisted |
ipv4only.arpa |
| whitelisted |
contile.services.mozilla.com |
| whitelisted |
ocsp.usertrust.com |
| whitelisted |
spocs.getpocket.com |
| shared |
ocsp.comodoca.com.cdn.cloudflare.net |
| whitelisted |
gkegw.prod.ads.prod.webservices.mozgcp.net |
| unknown |