File name:

C4PROLoader.exe

Full analysis: https://app.any.run/tasks/83d743be-8996-4181-b86e-0eb54f92df80
Verdict: Malicious activity
Analysis date: March 10, 2024, 17:29:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
raccoonclipper
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

84533D18EB7E5AEA1DD0E022ACF81D8C

SHA1:

AC7EE8356BD60353D5A6C5DE9B540695216DEA55

SHA256:

0124803B8FA8822D637B2E0F233673C6CEBAEC63BCB980CCD6C2F842B25E10C6

SSDEEP:

98304:bDs7D8ruvCT8Or+sdQuhuHZVk0aucCARgKScGX4z/gW1vRwtlXoWMbGVBUM00Dhi:bk5U65SQ4/KxT7syKGzlOySh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • C4PROLoader.exe (PID: 3864)
      • C4PROLoader.exe (PID: 1040)
      • C4PROLoader.exe (PID: 2908)
      • fodhelper.exe (PID: 1740)

    • RACCOONCLIPPER has been detected (YARA)

      • fodhelper.exe (PID: 3948)

  • SUSPICIOUS

    • The executable file from the user directory is run by the CMD process

      • C4PROLoader.exe (PID: 1040)

    • Reads the Internet Settings

      • C4PROLoader.exe (PID: 3864)
      • C4PROLoader.exe (PID: 1040)
      • C4PROLoader.exe (PID: 2908)
      • powershell.exe (PID: 3936)
      • powershell.exe (PID: 3180)
      • C4.exe (PID: 3164)

    • Starts CMD.EXE for commands execution

      • C4PROLoader.exe (PID: 3864)

    • Reads security settings of Internet Explorer

      • C4PROLoader.exe (PID: 3864)
      • C4PROLoader.exe (PID: 1040)
      • C4PROLoader.exe (PID: 2908)

    • Base64-obfuscated command line is found

      • C4PROLoader.exe (PID: 1040)
      • C4PROLoader.exe (PID: 2908)

    • BASE64 encoded PowerShell command has been detected

      • C4PROLoader.exe (PID: 1040)
      • C4PROLoader.exe (PID: 2908)

    • Starts POWERSHELL.EXE for commands execution

      • C4PROLoader.exe (PID: 1040)
      • C4PROLoader.exe (PID: 2908)

    • Application launched itself

      • C4PROLoader.exe (PID: 1040)

    • Executable content was dropped or overwritten

      • C4PROLoader.exe (PID: 2908)
      • C4PROLoader.exe (PID: 1040)
      • fodhelper.exe (PID: 1740)

    • Using PowerShell to operate with local accounts

      • powershell.exe (PID: 3936)
      • powershell.exe (PID: 3180)

    • The process executes via Task Scheduler

      • fodhelper.exe (PID: 3948)

  • INFO

    • Reads the machine GUID from the registry

      • C4PROLoader.exe (PID: 3864)
      • C4PROLoader.exe (PID: 1040)
      • C4.exe (PID: 3164)

    • Checks supported languages

      • C4PROLoader.exe (PID: 3864)
      • C4PROLoader.exe (PID: 1040)
      • C4PROLoader.exe (PID: 2908)
      • fodhelper.exe (PID: 3948)
      • C4.exe (PID: 3164)
      • fodhelper.exe (PID: 1740)

    • Reads the computer name

      • C4PROLoader.exe (PID: 3864)
      • C4PROLoader.exe (PID: 1040)
      • C4PROLoader.exe (PID: 2908)
      • C4.exe (PID: 3164)

    • Create files in a temporary directory

      • C4PROLoader.exe (PID: 1040)
      • C4PROLoader.exe (PID: 2908)

    • Application launched itself

      • msedge.exe (PID: 1236)
      • msedge.exe (PID: 3980)

    • Manual execution by a user

      • msedge.exe (PID: 3980)

    • Drops the executable file immediately after the start

      • msedge.exe (PID: 3980)

    • Creates files or folders in the user directory

      • fodhelper.exe (PID: 1740)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

RaccoonClipper

(PID) Process(3948) fodhelper.exe
Wallets (18)ltc1qvfghx46z8v9fyawar6qgdhj5wtrslvvx2kn438
cosmos1k6y3w45ralwcaarlgt7zcgm5htk2rw9jq5jxce
addr1q90kzt7nhxjkhm5e40nadh5ym57p24aswumdy0aggyk8mmjlvyha8wd9d0hfn2l86m0gfhfuz4tmqaek6gl6ssfv0hhqe6akq0
LKTWnwuM4eZgXdUNh5RpV3ETxNRbbbPDFT
t1Upr9Q3VMFLC8sz6spautGumgDqdSvdgsq
bc1qnl5vwuzw57rtm98wg2jh6mu0p597892q0pss27
0xB78aD0c44964c978c763cCa142C8D3f30B711e3c
Ae2tdPwUPEZKFp3DNd7g57oc3vWeZ6N2fA1uA5KqJ9qyQTyC2D2YEaGEYzL
BXgs2AAWD7gF2WUNhva7byzkpR4QbvM3YHoCJzrGebnb
TXQXx2nJnd1PpUVkZvfh7LbffUisurwd43
YWAMDRGWA6TMDAVJV5XP6CQZZMO46NLC4TK555FRDCTPLUMST5YENA4VIE
Adu5K93Evg5jsQGdwMA69onB4dJ74L87GX
1BspfXbHj1R5RcShF31KNpBW79h9zBej5J
49XPrw6TrHAVvw2pPGhdifGdfYc3iHftvSwQvmy74drQMpU4bmE3syc6mV9uSKDhbQB54Egan4AL1NMzAvYRY3jHHZdYUcm
DB84kZEkPqBUVh1KvEcN7f3KSEEhPVMNPS
bnb1gjp5822en66dsh7k0v00q0hxzwuus3c0m2v74w
88ULP41eYUCWzYVGPXuBUEJR9j8Lu17zPKvkLqyXQMt3BjKZijVqiq6786u3bveEHnemGXR78uGj28ELXmDTURC2PJYRuTH
Z1BspfXbHj1R5RcShF31KNpBW79h9zBej5J
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:03:10 17:08:35+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 13948928
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0xd4f6fe
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: -
FileVersion: 1.0.0.0
InternalName: Xgvltszua.exe
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: Xgvltszua.exe
ProductName: -
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
81
Monitored processes
39
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start c4proloader.exe no specs cmd.exe c4proloader.exe powershell.exe no specs c4proloader.exe powershell.exe no specs c4.exe no specs fodhelper.exe schtasks.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs #RACCOONCLIPPER fodhelper.exe no specs schtasks.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
764"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1456 --field-trial-handle=1252,i,12365423113159659216,10431407775292495242,131072 /prefetch:3C:\Program Files\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1020"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2316 --field-trial-handle=1252,i,12365423113159659216,10431407775292495242,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1036"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --first-renderer-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2312 --field-trial-handle=1252,i,12365423113159659216,10431407775292495242,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1040"C:\Users\admin\AppData\Local\Temp\C4PROLoader.exe" C:\Users\admin\AppData\Local\Temp\C4PROLoader.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\c4proloader.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1236"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument https://cheatz4pros.com/index.php?do=registerC:\Program Files\Microsoft\Edge\Application\msedge.exe—C4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1584"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1220 --field-trial-handle=1252,i,12365423113159659216,10431407775292495242,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1740"C:\Users\admin\AppData\Local\Temp\fodhelper.exe" C:\Users\admin\AppData\Local\Temp\fodhelper.exe
C4PROLoader.exe
User:
admin
Integrity Level:
HIGH
Exit code:
4294967295
Modules
Images
c:\users\admin\appdata\local\temp\fodhelper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1816"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1516 --field-trial-handle=1340,i,17318050431573841471,17232529100045922616,131072 /prefetch:3C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1876"C:\Windows\System32\cmd.exe" /k START "" "C:\Users\admin\AppData\Local\Temp\C4PROLoader.exe" & EXITC:\Windows\System32\cmd.exe
C4PROLoader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2032"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3644 --field-trial-handle=1252,i,12365423113159659216,10431407775292495242,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
18 615
Read events
18 503
Write events
105
Delete events
7

Modification events

(PID) Process:(3864) C4PROLoader.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3864) C4PROLoader.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3864) C4PROLoader.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3864) C4PROLoader.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1040) C4PROLoader.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1040) C4PROLoader.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1040) C4PROLoader.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1040) C4PROLoader.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3936) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3936) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
7
Suspicious files
35
Text files
120
Unknown types
61

Dropped files

PID
Process
Filename
Type
2384msedge.exe —
MD5:—
SHA256:—
1236msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datbinary
MD5:DF0BCCD68449F07F531D76F53C718178
SHA256:12025F4DA9E53A8B91892D4F6E6A9B89513F3488BFE9F1EEEC3C05F7EF96BDD8
3980msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF1867cd.TMP —
MD5:—
SHA256:—
3180powershell.exeC:\Users\admin\AppData\Local\Temp\tj3pffkh.ekk.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
3980msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
3936powershell.exeC:\Users\admin\AppData\Local\Temp\sahweijw.qf1.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2060msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics.pmabinary
MD5:886E82F2CA62ECCCE64601B30592078A
SHA256:E5E13D53601100FF3D6BB71514CBCCC4C73FE9B7EF5E930100E644187B42948E
1236msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Variationsbinary
MD5:961E3604F228B0D10541EBF921500C86
SHA256:F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
2908C4PROLoader.exeC:\Users\admin\AppData\Local\Temp\fodhelper.exeexecutable
MD5:BE28414896E062D07B1C86124D4C7A1E
SHA256:0407E8F54490B2A24E1834D99EC0452F217499F1E5A64DE3D28439D71D16D43C
3180powershell.exeC:\Users\admin\AppData\Local\Temp\baj5whd0.gxf.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
46
DNS requests
40
Threats
12

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
unknown
—
—
224.0.0.252:5355
—
—
—
unknown
764
msedge.exe
13.107.21.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3980
msedge.exe
239.255.255.250:1900
—
—
—
unknown
764
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
764
msedge.exe
188.114.97.3:443
cheatz4pros.com
CLOUDFLARENET
NL
unknown
764
msedge.exe
162.159.137.232:443
discord.com
—
—
unknown
764
msedge.exe
142.250.186.136:443
www.googletagmanager.com
GOOGLE
US
unknown
764
msedge.exe
172.217.18.10:443
fonts.googleapis.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
config.edge.skype.com
  • 13.107.42.16
whitelisted
cheatz4pros.com
  • 188.114.97.3
  • 188.114.96.3
unknown
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
whitelisted
www.googletagmanager.com
  • 142.250.186.136
  • 142.250.74.200
whitelisted
discord.com
  • 162.159.137.232
  • 162.159.136.232
  • 162.159.135.232
  • 162.159.138.232
  • 162.159.128.233
whitelisted
fonts.googleapis.com
  • 172.217.18.10
whitelisted
fonts.gstatic.com
  • 216.58.206.35
whitelisted
www.bing.com
  • 92.123.104.56
  • 92.123.104.49
  • 92.123.104.52
  • 92.123.104.53
  • 92.123.104.58
  • 92.123.104.61
  • 92.123.104.59
  • 92.123.104.57
  • 92.123.104.55
  • 2.19.120.29
  • 2.19.120.21
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
region1.google-analytics.com
  • 216.239.32.36
  • 216.239.34.36
whitelisted

Threats

PID
Process
Class
Message
764
msedge.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
764
msedge.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
764
msedge.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
764
msedge.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discordapp .com)
764
msedge.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discordapp .com)
764
msedge.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
764
msedge.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
764
msedge.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
764
msedge.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
764
msedge.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
C4PROLoader.exe