URL:

http://www.mediafire.com/file/g8qrbivyljdaany/Acunetix_Web_Vulnerability_Scanner_12.0.190515149_pass_111.zip/file

Full analysis: https://app.any.run/tasks/32cef938-bb5d-4f44-9208-d94e3898c3b7
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: July 20, 2020, 10:53:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
Indicators:
MD5:

295776E293D14A074A6B74989C4A59C4

SHA1:

D5173A46F92F61CF42DEA11FAE5A23DAB44D1E88

SHA256:

C4ACB0647BA964E662F1C51B779584725BE5700EB93EAEE5DD5116A5A6C40A76

SSDEEP:

3:N1KJS4w3eGUoeUXPJPy/KP5XYYsC66hQUxgrUzEWGd:Cc4w3eGqO8CxXY3C6wxy9WGd

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • TempSetup.exe (PID: 2620)

    • Application was dropped or rewritten from another process

      • TempSetup.exe (PID: 2620)
      • svchost.exe (PID: 3176)
      • svchost.exe (PID: 3544)
      • Service Provider License.exe (PID: 3744)
      • Activation.exe (PID: 3976)
      • Service Provider License.exe (PID: 2812)

    • Connects to CnC server

      • svchost.exe (PID: 3544)

    • Loads dropped or rewritten executable

      • Service Provider License.exe (PID: 2812)

  • SUSPICIOUS

    • Creates files in the program directory

      • firefox.exe (PID: 3936)

    • Creates files in the user directory

      • TempSetup.exe (PID: 2620)
      • svchost.exe (PID: 3176)
      • svchost.exe (PID: 3544)

    • Executable content was dropped or overwritten

      • acunetix_12.0.190515149.exe (PID: 1460)
      • WinRAR.exe (PID: 2484)
      • TempSetup.exe (PID: 2620)
      • ~acunetix_12_0_190515149.exe (PID: 2628)
      • svchost.exe (PID: 3176)
      • Service Provider License.exe (PID: 2812)

    • Creates executable files which already exist in Windows

      • TempSetup.exe (PID: 2620)
      • svchost.exe (PID: 3176)

    • Starts CMD.EXE for commands execution

      • Service Provider License.exe (PID: 2812)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 4028)

  • INFO

    • Reads Internet Cache Settings

      • firefox.exe (PID: 4048)
      • firefox.exe (PID: 3936)

    • Application launched itself

      • firefox.exe (PID: 3936)

    • Reads CPU info

      • firefox.exe (PID: 3936)

    • Manual execution by user

      • acunetix_12.0.190515149.exe (PID: 1460)
      • WinRAR.exe (PID: 3832)
      • WinRAR.exe (PID: 2484)
      • Service Provider License.exe (PID: 3744)
      • Service Provider License.exe (PID: 2812)

    • Application was dropped or rewritten from another process

      • ~acunetix_12_0_190515149.tmp (PID: 3224)

    • Creates files in the user directory

      • firefox.exe (PID: 3936)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
65
Monitored processes
20
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe firefox.exe firefox.exe firefox.exe winrar.exe no specs winrar.exe acunetix_12.0.190515149.exe tempsetup.exe ~acunetix_12_0_190515149.exe ~acunetix_12_0_190515149.tmp no specs svchost.exe svchost.exe service provider license.exe no specs service provider license.exe cmd.exe no specs taskkill.exe no specs activation.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1460"C:\Users\admin\Desktop\Acunetix Web Vulnerability Scanner 12.0.190515149\Acunetix Web Vulnerability Scanner 12.0.190515149\acunetix_12.0.190515149.exe" C:\Users\admin\Desktop\Acunetix Web Vulnerability Scanner 12.0.190515149\Acunetix Web Vulnerability Scanner 12.0.190515149\acunetix_12.0.190515149.exe
explorer.exe
User:
admin
Company:
Acunetix Ltd.
Integrity Level:
MEDIUM
Description:
Acunetix Trial Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\desktop\acunetix web vulnerability scanner 12.0.190515149\acunetix web vulnerability scanner 12.0.190515149\acunetix_12.0.190515149.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1696"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3936.0.1308508035\1074231350" -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3936 "\\.\pipe\gecko-crash-server-pipe.3936" 1188 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
2456"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3936.20.761147808\943402983" -childID 3 -isForBrowser -prefsHandle 7696 -prefMapHandle 7700 -prefsLen 7297 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3936 "\\.\pipe\gecko-crash-server-pipe.3936" 7680 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
2468"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3936.13.1861635396\1422746037" -childID 2 -isForBrowser -prefsHandle 2768 -prefMapHandle 2772 -prefsLen 5996 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3936 "\\.\pipe\gecko-crash-server-pipe.3936" 2788 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
2484"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\Acunetix Web Vulnerability Scanner 12.0.190515149_pass_111.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2620"C:\Users\admin\AppData\Local\TempSetup.exe" C:\Users\admin\AppData\Local\TempSetup.exe
acunetix_12.0.190515149.exe
User:
admin
Company:
Intel Corporation
Integrity Level:
MEDIUM
Description:
hkcmd Module
Exit code:
0
Version:
8.1.1.7800
Modules
Images
c:\users\admin\appdata\local\tempsetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2628"C:\Users\admin\Desktop\Acunetix Web Vulnerability Scanner 12.0.190515149\Acunetix Web Vulnerability Scanner 12.0.190515149\~acunetix_12_0_190515149.exe" C:\Users\admin\Desktop\Acunetix Web Vulnerability Scanner 12.0.190515149\Acunetix Web Vulnerability Scanner 12.0.190515149\~acunetix_12_0_190515149.exe
acunetix_12.0.190515149.exe
User:
admin
Company:
Acunetix Ltd.
Integrity Level:
MEDIUM
Description:
Acunetix Trial Setup
Exit code:
1
Version:
Modules
Images
c:\users\admin\desktop\acunetix web vulnerability scanner 12.0.190515149\acunetix web vulnerability scanner 12.0.190515149\~acunetix_12_0_190515149.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2812"C:\Users\admin\Desktop\Acunetix Web Vulnerability Scanner 12.0.190515149\Acunetix Web Vulnerability Scanner 12.0.190515149\Crack\Service Provider License.exe" C:\Users\admin\Desktop\Acunetix Web Vulnerability Scanner 12.0.190515149\Acunetix Web Vulnerability Scanner 12.0.190515149\Crack\Service Provider License.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225547
Modules
Images
c:\users\admin\desktop\acunetix web vulnerability scanner 12.0.190515149\acunetix web vulnerability scanner 12.0.190515149\crack\service provider license.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\temp\dup2patcher.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\comdlg32.dll
3024"C:\Program Files\Mozilla Firefox\firefox.exe" "http://www.mediafire.com/file/g8qrbivyljdaany/Acunetix_Web_Vulnerability_Scanner_12.0.190515149_pass_111.zip/file"C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
3176"C:\Users\admin\AppData\Roaming\Intel Corporation\Intel(R) Common User Interface\8.1.1.7800\svchost.exe" C:\Users\admin\AppData\Roaming\Intel Corporation\Intel(R) Common User Interface\8.1.1.7800\svchost.exe
TempSetup.exe
User:
admin
Company:
Intel Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\appdata\roaming\intel corporation\intel(r) common user interface\8.1.1.7800\svchost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
4 838
Read events
4 553
Write events
279
Delete events
6

Modification events

(PID) Process:(3024) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Launcher
Value:
A74D920400000000
(PID) Process:(3936) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Browser
Value:
A84D920400000000
(PID) Process:(3936) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry
Value:
1
(PID) Process:(3936) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3936) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A3000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3936) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3936) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3832) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3832) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3832) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\132\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
8
Suspicious files
280
Text files
106
Unknown types
178

Dropped files

PID
Process
Filename
Type
3936firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
3936firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shm —
MD5:—
SHA256:—
3936firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js —
MD5:—
SHA256:—
3936firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp —
MD5:—
SHA256:—
3936firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm —
MD5:—
SHA256:—
3936firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm —
MD5:—
SHA256:—
3936firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4.tmp —
MD5:—
SHA256:—
3936firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-child-current.binbinary
MD5:—
SHA256:—
3936firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\cache2\entries\28FCB344008F4FC1360930FE499F30E0780C972Fcompressed
MD5:—
SHA256:—
3936firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\cache2\entries\7CB60097FCFB0F4BE7BD943E2A442BB6B71C4AD4image
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
88
TCP/UDP connections
208
DNS requests
432
Threats
22

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3936
firefox.exe
GET
200
172.217.23.110:80
http://translate.google.com/translate_a/element.js?cb=googFooterTranslate
US
text
797 b
whitelisted
3936
firefox.exe
POST
200
172.217.22.67:80
http://ocsp.pki.goog/gts1o1core
US
der
471 b
whitelisted
3936
firefox.exe
GET
200
104.16.202.237:80
http://www.mediafire.com/file/g8qrbivyljdaany/Acunetix_Web_Vulnerability_Scanner_12.0.190515149_pass_111.zip/file
US
html
83.7 Kb
shared
3936
firefox.exe
GET
200
104.16.202.237:80
http://www.mediafire.com/js/prebid2.44.1.js
US
text
52.9 Kb
shared
3936
firefox.exe
GET
200
104.16.202.237:80
http://www.mediafire.com/images/icons/svg_light/icons_sprite.svg
US
image
8.14 Kb
shared
3936
firefox.exe
GET
200
104.16.203.237:80
http://static.mediafire.com/images/backgrounds/download/apps_list_sprite-v4.png
US
image
6.78 Kb
shared
3936
firefox.exe
POST
200
172.217.22.67:80
http://ocsp.pki.goog/gts1o1core
US
der
471 b
whitelisted
3936
firefox.exe
POST
200
172.217.22.67:80
http://ocsp.pki.goog/gts1o1core
US
der
472 b
whitelisted
3936
firefox.exe
GET
200
104.16.203.237:80
http://static.mediafire.com/images/backgrounds/download/social/fb_16x16.png
US
image
181 b
shared
3936
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3936
firefox.exe
2.16.177.88:80
detectportal.firefox.com
Akamai International B.V.
—
suspicious
3936
firefox.exe
34.211.106.52:443
search.services.mozilla.com
Amazon.com, Inc.
US
unknown
3936
firefox.exe
104.16.202.237:80
www.mediafire.com
Cloudflare Inc
US
unknown
3936
firefox.exe
2.20.168.110:443
c.aaxads.com
Akamai Technologies, Inc.
—
unknown
3936
firefox.exe
172.217.23.136:443
www.googletagmanager.com
Google Inc.
US
whitelisted
3936
firefox.exe
104.16.203.237:80
www.mediafire.com
Cloudflare Inc
US
unknown
3936
firefox.exe
172.217.23.110:80
translate.google.com
Google Inc.
US
whitelisted
3936
firefox.exe
172.217.18.162:443
securepubads.g.doubleclick.net
Google Inc.
US
whitelisted
3936
firefox.exe
104.19.214.37:443
cdn.otnolatrnup.com
Cloudflare Inc
US
shared
3936
firefox.exe
52.26.108.107:443
push.services.mozilla.com
Amazon.com, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
www.mediafire.com
  • 104.16.202.237
  • 104.16.203.237
shared
detectportal.firefox.com
  • 2.16.177.88
  • 2.16.177.18
whitelisted
a1089.dscd.akamai.net
  • 2.16.177.18
  • 2.16.177.88
whitelisted
search.services.mozilla.com
  • 34.211.106.52
  • 52.41.191.52
  • 54.149.192.132
whitelisted
search.r53-2.services.mozilla.com
  • 54.149.192.132
  • 52.41.191.52
  • 34.211.106.52
whitelisted
www.googletagmanager.com
  • 172.217.23.136
whitelisted
translate.google.com
  • 172.217.23.110
whitelisted
c.aaxads.com
  • 2.20.168.110
whitelisted
securepubads.g.doubleclick.net
  • 172.217.18.162
whitelisted
static.mediafire.com
  • 104.16.203.237
  • 104.16.202.237
shared

Threats

PID
Process
Class
Message
3936
firefox.exe
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
3936
firefox.exe
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Response)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Response)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Request)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Response)
—
—
Attempted User Privilege Gain
ET INFO Session Traversal Utilities for NAT (STUN Binding Response)
1052
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
1052
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://www.mediafire.com/file/g8qrbivyljdaany/Acunetix_Web_Vulnerability_Scanner_12.0.190515149_pass_111.zip/file