File name:

answers

Full analysis: https://app.any.run/tasks/c7a89b18-0b56-45d6-ba84-96a56973f73e
Verdict: Malicious activity
Analysis date: February 22, 2020, 01:00:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/html
File info: HTML document, UTF-8 Unicode text, with very long lines
MD5:

5BA1D905D8F8DEC624A643B0D883F17F

SHA1:

FB6D67D374090627B23F35CCB86D55424E45BB2B

SHA256:

0BD113F9C86C51B223FFDE70AB1FD983E621F591772A9F65C263540D877F0773

SSDEEP:

384:Gw51UFSxqdVvWCDvLUKELu4VYyDpzOe/8P49ovyR8uwFYCDCkCpCnTUIwu:GwFxqL4K/M/ptuvy2PX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Update.exe (PID: 3012)
      • Update.exe (PID: 2288)
      • Squirrel.exe (PID: 2452)
      • Update.exe (PID: 1900)
      • Update.exe (PID: 620)
      • Update.exe (PID: 2012)

    • Loads dropped or rewritten executable

      • Discord.exe (PID: 2592)
      • Discord.exe (PID: 3832)
      • Discord.exe (PID: 2512)
      • Discord.exe (PID: 2648)
      • Discord.exe (PID: 3344)
      • Discord.exe (PID: 3732)
      • Discord.exe (PID: 3920)
      • Discord.exe (PID: 604)
      • Discord.exe (PID: 2792)
      • Discord.exe (PID: 4020)
      • Discord.exe (PID: 2696)
      • Discord.exe (PID: 2388)
      • Discord.exe (PID: 280)
      • Discord.exe (PID: 2824)
      • Discord.exe (PID: 2740)
      • Discord.exe (PID: 3796)

    • Changes the autorun value in the registry

      • reg.exe (PID: 3240)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Update.exe (PID: 3012)
      • DiscordSetup.exe (PID: 3440)
      • Discord.exe (PID: 604)

    • Starts itself from another location

      • Update.exe (PID: 3012)

    • Uses REG.EXE to modify Windows registry

      • Discord.exe (PID: 2592)

    • Application launched itself

      • Discord.exe (PID: 2592)
      • Discord.exe (PID: 3920)
      • Discord.exe (PID: 604)
      • Discord.exe (PID: 2512)
      • Discord.exe (PID: 2740)

    • Creates files in the user directory

      • Update.exe (PID: 2288)
      • Discord.exe (PID: 2512)
      • Discord.exe (PID: 604)

    • Modifies the open verb of a shell class

      • reg.exe (PID: 2432)

    • Creates a software uninstall entry

      • Update.exe (PID: 3012)

    • Reads Environment values

      • Update.exe (PID: 1900)
      • Update.exe (PID: 620)
      • Update.exe (PID: 2012)

    • Starts CMD.EXE for commands execution

      • Discord.exe (PID: 2824)

  • INFO

    • Reads internet explorer settings

      • iexplore.exe (PID: 3756)
      • iexplore.exe (PID: 2844)
      • iexplore.exe (PID: 3408)
      • iexplore.exe (PID: 3552)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3200)
      • iexplore.exe (PID: 3756)
      • iexplore.exe (PID: 3408)
      • iexplore.exe (PID: 3552)

    • Creates files in the user directory

      • iexplore.exe (PID: 3756)
      • iexplore.exe (PID: 3200)
      • iexplore.exe (PID: 3408)

    • Changes internet zones settings

      • iexplore.exe (PID: 3200)

    • Application launched itself

      • iexplore.exe (PID: 2844)
      • iexplore.exe (PID: 3200)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3200)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2844)
      • iexplore.exe (PID: 3756)
      • iexplore.exe (PID: 3200)
      • Update.exe (PID: 2012)
      • iexplore.exe (PID: 3552)
      • iexplore.exe (PID: 3408)

    • Reads the hosts file

      • Discord.exe (PID: 2592)
      • Discord.exe (PID: 2512)
      • Discord.exe (PID: 604)
      • Discord.exe (PID: 2740)

    • Dropped object may contain Bitcoin addresses

      • iexplore.exe (PID: 3408)
      • iexplore.exe (PID: 3552)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3200)
      • iexplore.exe (PID: 2844)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2844)
      • iexplore.exe (PID: 3200)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.htm/html | HyperText Markup Language with DOCTYPE (80.6)
.html | HyperText Markup Language (19.3)

EXIF

HTML

Title: IANA — Common questions regarding abuse issues
ContentType: text/html; charset=utf-8
viewport: width=device-width, initial-scale=1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
82
Monitored processes
35
Malicious processes
8
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start iexplore.exe iexplore.exe iexplore.exe discordsetup.exe update.exe squirrel.exe no specs discord.exe no specs update.exe no specs discord.exe no specs reg.exe reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs discord.exe discord.exe no specs discord.exe no specs update.exe discord.exe no specs iexplore.exe discord.exe no specs discord.exe discord.exe no specs discord.exe no specs update.exe discord.exe no specs discord.exe discord.exe no specs discord.exe no specs update.exe cmd.exe no specs iexplore.exe discord.exe no specs discord.exe no specs discord.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
280C:\Users\admin\AppData\Local\Discord\app-0.0.305\Discord.exe --reporter-url=https://sentry.io/api/146342/minidump/?sentry_key=384ce4413de74fe0be270abe03b2b35a --application-name=Discord "--crashes-directory=C:\Users\admin\AppData\Local\Temp\Discord Crashes" --v=1C:\Users\admin\AppData\Local\Discord\app-0.0.305\Discord.exe
Discord.exe
User:
admin
Company:
Discord Inc.
Integrity Level:
MEDIUM
Description:
Discord
Exit code:
0
Version:
0.0.305
Modules
Images
c:\systemroot\system32\ntdll.dll
c:\users\admin\appdata\local\discord\app-0.0.305\discord.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\discord\app-0.0.305\ffmpeg.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
604"C:\Users\admin\AppData\Local\Discord\app-0.0.305\Discord.exe" --squirrel-firstrunC:\Users\admin\AppData\Local\Discord\app-0.0.305\Discord.exe
Discord.exe
User:
admin
Company:
Discord Inc.
Integrity Level:
MEDIUM
Description:
Discord
Exit code:
0
Version:
0.0.305
Modules
Images
c:\users\admin\appdata\local\discord\app-0.0.305\discord.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\discord\app-0.0.305\ffmpeg.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
620C:\Users\admin\AppData\Local\Discord\Update.exe --check https://discordapp.com/api/updates/stableC:\Users\admin\AppData\Local\Discord\Update.exe
Discord.exe
User:
admin
Company:
GitHub
Integrity Level:
MEDIUM
Description:
Update
Exit code:
0
Version:
1.1.1.0
Modules
Images
c:\users\admin\appdata\local\discord\update.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1900C:\Users\admin\AppData\Local\Discord\Update.exe --check https://discordapp.com/api/updates/stableC:\Users\admin\AppData\Local\Discord\Update.exe
Discord.exe
User:
admin
Company:
GitHub
Integrity Level:
MEDIUM
Description:
Update
Exit code:
0
Version:
1.1.1.0
Modules
Images
c:\windows\system32\imm32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\usp10.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernelbase.dll
c:\systemroot\system32\ntdll.dll
c:\users\admin\appdata\local\discord\update.exe
c:\windows\system32\mscoree.dll
1900C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /fC:\Windows\System32\reg.exe—Discord.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1908C:\Windows\system32\cmd.exe /q /d /s /c "undefined\NVIDIA^ Corporation\NVSMI\nvidia-smi.exe"C:\Windows\system32\cmd.exe—Discord.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2012C:\Users\admin\AppData\Local\Discord\Update.exe --check https://discordapp.com/api/updates/stableC:\Users\admin\AppData\Local\Discord\Update.exe
Discord.exe
User:
admin
Company:
GitHub
Integrity Level:
MEDIUM
Description:
Update
Exit code:
0
Version:
1.1.1.0
Modules
Images
c:\users\admin\appdata\local\discord\update.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2288C:\Users\admin\AppData\Local\Discord\Update.exe --createShortcut Discord.exe --setupIcon C:\Users\admin\AppData\Local\Discord\app.icoC:\Users\admin\AppData\Local\Discord\Update.exe—Discord.exe
User:
admin
Company:
GitHub
Integrity Level:
MEDIUM
Description:
Update
Exit code:
0
Version:
1.1.1.0
Modules
Images
c:\users\admin\appdata\local\discord\update.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2388"C:\Users\admin\AppData\Local\Discord\app-0.0.305\Discord.exe" --type=utility --enable-features=SharedArrayBuffer --lang=en-US --no-sandbox --no-sandbox --service-request-channel-token=13508019319492902713 --mojo-platform-channel-handle=2464 /prefetch:8C:\Users\admin\AppData\Local\Discord\app-0.0.305\Discord.exe—Discord.exe
User:
admin
Company:
Discord Inc.
Integrity Level:
MEDIUM
Description:
Discord
Exit code:
0
Version:
0.0.305
Modules
Images
c:\users\admin\appdata\local\discord\app-0.0.305\discord.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\discord\app-0.0.305\ffmpeg.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
2432C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\admin\AppData\Local\Discord\app-0.0.305\Discord.exe\" --url -- \"%1\"" /fC:\Windows\System32\reg.exe—Discord.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
13 497
Read events
3 671
Write events
6 649
Delete events
3 177

Modification events

(PID) Process:(3200) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
2213881036
(PID) Process:(3200) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30796059
(PID) Process:(3200) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3200) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3200) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3200) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3200) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3200) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A1000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3200) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3200) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
36
Suspicious files
98
Text files
1 079
Unknown types
43

Dropped files

PID
Process
Filename
Type
3200iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3756iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\1S965QKO.txt —
MD5:—
SHA256:—
3756iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\YXVGUWSS.txt —
MD5:—
SHA256:—
3756iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\1GGROQ6I.txt —
MD5:—
SHA256:—
3756iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\I1SGHVL0.txt —
MD5:—
SHA256:—
3756iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\YNFN3F8O.txt —
MD5:—
SHA256:—
3756iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\EF344GE5.txt —
MD5:—
SHA256:—
3756iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\IE8TV08F.txttext
MD5:—
SHA256:—
3200iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\imagestore\f7ruq93\imagestore.datbinary
MD5:—
SHA256:—
3756iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DATsmt
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
116
TCP/UDP connections
145
DNS requests
59
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3756
iexplore.exe
GET
—
13.107.5.80:80
http://api.bing.com/qsml.aspx?query=disco&maxwidth=32765&rowheight=20&sectionHeight=160&FORM=IE11SS&market=en-US
US
—
—
whitelisted
3756
iexplore.exe
GET
—
13.107.5.80:80
http://api.bing.com/qsml.aspx?query=discor&maxwidth=32765&rowheight=20&sectionHeight=160&FORM=IE11SS&market=en-US
US
—
—
whitelisted
3756
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/fd/ls/l?IG=FB20A8282A1249A880B7FC4D3D92E6D7&CID=08363DC2AAE567D20FEB33BAABFC6658&Type=Event.CPT&DATA={"pp":{"S":"L","FC":40,"BC":74,"SE":-1,"TC":-1,"H":106,"BP":108,"CT":119,"IL":2},"ad":[-1,-1,1264,644,1264,1680,0]}&P=SERP&DA=Ch1b
US
compressed
37.6 Kb
whitelisted
3756
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/rs/2Z/28/cj,nj/3f1e2270/f8c6dd44.js
US
text
773 b
whitelisted
3756
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/rs/2Z/2g/cj,nj/4c7364c5/40e1b425.js
US
text
816 b
whitelisted
3756
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/rb/15/cj,nj/1a10eb03/af615ab8.js?bu=DiovZHB4c21naq8BsQEvnAEv
US
text
7.65 Kb
whitelisted
3756
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/rs/3P/p2/cj,nj/1beceeda/3baa9af7.js
US
text
425 b
whitelisted
3756
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/rs/6j/5u/cj,nj/a9e57fe1/1f2a14b8.js
US
text
1.83 Kb
whitelisted
3756
iexplore.exe
POST
204
204.79.197.200:80
http://www.bing.com/fd/ls/lsp.aspx?
US
image
11.2 Kb
whitelisted
3756
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/search?q=discord&src=IE-TopResult&FORM=IE11TR&conversationid=
US
html
37.6 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3200
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3756
iexplore.exe
13.107.5.80:80
api.bing.com
Microsoft Corporation
US
whitelisted
3756
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3756
iexplore.exe
40.126.1.138:443
login.microsoftonline.com
Microsoft Corporation
US
unknown
3756
iexplore.exe
40.90.137.126:443
login.live.com
Microsoft Corporation
US
unknown
3756
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3756
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
3756
iexplore.exe
104.18.25.243:80
ocsp.msocsp.com
Cloudflare Inc
US
shared
3756
iexplore.exe
2.16.106.113:80
a4.bing.com
Akamai International B.V.
—
whitelisted
3756
iexplore.exe
162.159.129.233:443
discordapp.com
Cloudflare Inc
—
shared

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
login.microsoftonline.com
  • 40.126.1.138
  • 20.190.129.162
  • 40.126.1.137
  • 40.126.1.141
  • 40.126.1.136
whitelisted
login.live.com
  • 40.90.137.126
  • 40.90.23.247
  • 40.90.137.120
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
ocsp.msocsp.com
  • 104.18.25.243
  • 104.18.24.243
whitelisted
www2.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
a4.bing.com
  • 2.16.106.113
  • 2.16.106.96
whitelisted
discordapp.com
  • 162.159.129.233
  • 162.159.135.233
  • 162.159.134.233
  • 162.159.130.233
  • 162.159.133.233
whitelisted
ocsp.trust-provider.com
  • 151.139.128.14
whitelisted

Threats

PID
Process
Class
Message
3756
iexplore.exe
Generic Protocol Command Decode
SURICATA HTTP unable to match response to request
Process
Message
DiscordSetup.exe
Elevated process: ?
DiscordSetup.exe
Start up installer:
DiscordSetup.exe
Want standard install
Discord.exe
[280:676:0222/010228.947:VERBOSE1:crash_service_main.cc(81)] Session start. cmdline is [--reporter-url=https://sentry.io/api/146342/minidump/?sentry_key=384ce4413de74fe0be270abe03b2b35a --application-name=Discord "--crashes-directory=C:\Users\admin\AppData\Local\Temp\Discord Crashes" --v=1]
Discord.exe
[280:676:0222/010228.948:VERBOSE1:crash_service.cc(275)] pipe name is \\.\pipe\Discord Crash Service dumps at C:\Users\admin\AppData\Local\Temp\Discord Crashes
Discord.exe
[280:676:0222/010228.948:VERBOSE1:crash_service_main.cc(95)] Ready to process crash requests
Discord.exe
[280:676:0222/010228.948:VERBOSE1:crash_service.cc(147)] window handle is 000602AE
Discord.exe
[280:676:0222/010228.948:VERBOSE1:crash_service.cc(279)] checkpoint is C:\Users\admin\AppData\Local\Temp\Discord Crashes\crash_checkpoint.txt server is https://sentry.io/api/146342/minidump/?sentry_key=384ce4413de74fe0be270abe03b2b35a maximum 128 reports/day reporter is electron-crash-service
Discord.exe
[280:2628:0222/010228.949:VERBOSE1:crash_service.cc(309)] client start. pid = 604
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
answers