File name:

lcb.zip

Full analysis: https://app.any.run/tasks/82b307d3-2e6e-47b1-b9e3-ca7ebfca500f
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 19:04:47
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
discord
exfiltration
stealer
evasion
github
discordrat
rat
ims-api
generic
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

C786498C085F0B9F6DA9FE29F278206A

SHA1:

9B4ADCBCC7B738B6E2707B2701050AB7528F5782

SHA256:

12188EB597E8A396A9F9F28E1878B53A8CE7D51B55EAE1F0ECD60285034FF5B5

SSDEEP:

98304:b+rO9T3AHCV+u+tPKkEIZXOKvEzsWUdC4C/vH/PjQpAVPQUL9MxkBgNkUOaQUb4o:aECwRR5d9EmhtW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 7444)

    • DISCORDRAT has been detected (YARA)

      • X Worm Nuker.exe (PID: 2268)

  • SUSPICIOUS

    • Base64-obfuscated command line is found

      • lcb_spoof_crack.exe (PID: 8164)

    • BASE64 encoded PowerShell command has been detected

      • lcb_spoof_crack.exe (PID: 8164)

    • Starts POWERSHELL.EXE for commands execution

      • lcb_spoof_crack.exe (PID: 8164)

    • Reads security settings of Internet Explorer

      • lcb_spoof_crack.exe (PID: 8164)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • X Worm Nuker.exe (PID: 2268)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • X Worm Nuker.exe (PID: 2268)

    • Executable content was dropped or overwritten

      • lcb_spoof_crack.exe (PID: 8164)

    • The process connected to a server suspected of theft

      • X Worm Nuker.exe (PID: 2268)

  • INFO

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 6644)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 7444)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 7304)
      • BackgroundTransferHost.exe (PID: 6644)
      • BackgroundTransferHost.exe (PID: 7828)
      • BackgroundTransferHost.exe (PID: 7392)
      • BackgroundTransferHost.exe (PID: 2148)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 6644)
      • X Worm Nuker.exe (PID: 2268)

    • Reads the computer name

      • lcb_spoof_crack.exe (PID: 8164)
      • X Worm Nuker.exe (PID: 2268)
      • ShellExperienceHost.exe (PID: 4212)

    • Manual execution by a user

      • lcb_spoof_crack.exe (PID: 8164)
      • lcb_spoof_crack.exe (PID: 2140)
      • firefox.exe (PID: 2616)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 6644)
      • X Worm Nuker.exe (PID: 2268)
      • slui.exe (PID: 7704)

    • Checks supported languages

      • lcb_spoof_crack.exe (PID: 8164)
      • X Worm Nuker.exe (PID: 2268)
      • ShellExperienceHost.exe (PID: 4212)

    • Process checks computer location settings

      • lcb_spoof_crack.exe (PID: 8164)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7444)

    • Disables trace logs

      • X Worm Nuker.exe (PID: 2268)

    • Reads the machine GUID from the registry

      • X Worm Nuker.exe (PID: 2268)

    • Reads Environment values

      • X Worm Nuker.exe (PID: 2268)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 8160)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 8160)

    • Application launched itself

      • firefox.exe (PID: 2616)
      • firefox.exe (PID: 5392)

    • Create files in a temporary directory

      • lcb_spoof_crack.exe (PID: 8164)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.kmz | Google Earth saved working session (33.3)
.zip | ZIP compressed archive (22.2)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:03:24 19:03:04
ZipCRC: 0x607d33c0
ZipCompressedSize: 6050097
ZipUncompressedSize: 8043008
ZipFileName: lcb_spoof_crack.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
167
Monitored processes
29
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe rundll32.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs lcb_spoof_crack.exe no specs lcb_spoof_crack.exe powershell.exe no specs conhost.exe no specs lcb_spoof_crack.exe no specs #DISCORDRAT x worm nuker.exe firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs svchost.exe firefox.exe no specs shellexperiencehost.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
904"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5268 -childID 5 -isForBrowser -prefsHandle 3204 -prefMapHandle 5256 -prefsLen 31243 -prefMapSize 244583 -jsInitHandle 1524 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf3407fa-9afd-4deb-8385-d74d00ac2a10} 5392 "\\.\pipe\gecko-crash-server-pipe.5392" 2057eaf7690 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
1128"C:\Users\admin\AppData\Local\Temp\lcb_spoof_crack.exe" C:\Users\admin\AppData\Local\Temp\lcb_spoof_crack.exe—lcb_spoof_crack.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225781
Modules
Images
c:\users\admin\appdata\local\temp\lcb_spoof_crack.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2140"C:\Users\admin\Desktop\lcb\lcb_spoof_crack.exe" C:\Users\admin\Desktop\lcb\lcb_spoof_crack.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\lcb\lcb_spoof_crack.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2148"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2268"C:\Users\admin\AppData\Local\Temp\X Worm Nuker.exe" C:\Users\admin\AppData\Local\Temp\X Worm Nuker.exe
lcb_spoof_crack.exe
User:
admin
Integrity Level:
HIGH
Description:
Discord rat
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\x worm nuker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2616"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\program files\mozilla firefox\vcruntime140.dll
c:\program files\mozilla firefox\vcruntime140_1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\windows\system32\crypt32.dll
4212"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\wincorlib.dll
4776C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
5392"C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
Total events
24 920
Read events
24 854
Write events
53
Delete events
13

Modification events

(PID) Process:(7444) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7444) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7444) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7444) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\lcb.zip
(PID) Process:(7444) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7444) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7444) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7444) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7444) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(7444) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
5
Suspicious files
179
Text files
26
Unknown types
4

Dropped files

PID
Process
Filename
Type
6644BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\afe92738-1926-4510-9cde-4f8d9a8abf47.down_data —
MD5:—
SHA256:—
5392firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
7444WinRAR.exeC:\Users\admin\Desktop\lcb\lcb_spoof_crack.exeexecutable
MD5:EE5136686EE07730BC08F8143FBE048C
SHA256:355F58C2B357F9718038DEAE8E6F2A1E7C35C0D60153A169A7D736EC4F6E5CCA
6644BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\8fe01d16-6aaf-4235-a5af-8d9ae366a7ef.up_meta_securebinary
MD5:39B3554F21CBEC0B7AD3275B66C32095
SHA256:C32BE5BF93565B4CCEADC09EB1D3AE3D7305EB56F3B22173991CA9B9E8F2CF8F
8160powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_0ijuywwc.kf0.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6644BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dder
MD5:4872BABAF39AA62B8D32695EBB7E9173
SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999
6644BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\afe92738-1926-4510-9cde-4f8d9a8abf47.61853870-4082-4e78-b60d-4e788cac0de6.down_metabinary
MD5:8F26765DBC36190433AED69AD5085F7D
SHA256:D433960E0924453996967C7E413AA92B3FBD43E41774C5AEBAD854A3C75A8C1D
7444WinRAR.exeC:\Users\admin\Desktop\lcb\libcrypto-3-x64.dllexecutable
MD5:E7463D58D7AFF43C7D71A3847BA8201E
SHA256:2249476A14DEA73AE271D661483BDC6C15E45B931F8DBFD0BD1B84193CF420EA
6644BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:EB18E16527CA856B19E9DE705721F96E
SHA256:14F36F78269B4F3B6E9115C953A740E4E5FB9FD20456973680556073BF28DF89
6644BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\8fe01d16-6aaf-4235-a5af-8d9ae366a7ef.61853870-4082-4e78-b60d-4e788cac0de6.down_metabinary
MD5:8F26765DBC36190433AED69AD5085F7D
SHA256:D433960E0924453996967C7E413AA92B3FBD43E41774C5AEBAD854A3C75A8C1D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
35
TCP/UDP connections
109
DNS requests
141
Threats
45

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5392
firefox.exe
POST
200
142.250.181.227:80
http://o.pki.goog/we2
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6644
BackgroundTransferHost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7372
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7372
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7872
backgroundTaskHost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5392
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
5392
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
5392
firefox.exe
POST
200
142.250.181.227:80
http://o.pki.goog/s/wr3/cgo
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.32.72:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
23.54.109.203:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
7872
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.159
  • 23.48.23.141
  • 23.48.23.169
  • 23.48.23.194
  • 23.48.23.177
  • 23.48.23.173
  • 23.48.23.164
whitelisted
google.com
  • 216.58.212.142
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 40.126.32.72
  • 40.126.32.68
  • 40.126.32.134
  • 40.126.32.133
  • 20.190.160.132
  • 20.190.160.66
  • 20.190.160.4
  • 20.190.160.2
whitelisted
ocsp.digicert.com
  • 23.54.109.203
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
www.bing.com
  • 104.126.37.144
  • 104.126.37.136
  • 104.126.37.186
  • 104.126.37.179
  • 104.126.37.146
  • 104.126.37.131
  • 104.126.37.139
  • 104.126.37.185
  • 104.126.37.130
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
gateway.discord.gg
  • 162.159.134.234
  • 162.159.133.234
  • 162.159.130.234
  • 162.159.136.234
  • 162.159.135.234
whitelisted
discord.com
  • 162.159.137.232
  • 162.159.128.233
  • 162.159.135.232
  • 162.159.136.232
  • 162.159.138.232
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET INFO Discord Chat Service Domain in DNS Lookup (gateway .discord .gg)
2268
X Worm Nuker.exe
Misc activity
ET INFO Observed Discord Service Domain (gateway .discord .gg) in TLS SNI
2196
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
2268
X Worm Nuker.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
2196
svchost.exe
Misc activity
ET INFO External IP Lookup Domain in DNS Lookup (geolocation-db .com)
2196
svchost.exe
Misc activity
ET INFO Discord Chat Service Domain in DNS Lookup (discord .com)
2268
X Worm Nuker.exe
Misc activity
ET INFO Observed Discord Service Domain (discord .com) in TLS SNI
2268
X Worm Nuker.exe
Successful Credential Theft Detected
STEALER [ANY.RUN] Attempt to exfiltrate via Discord
2268
X Worm Nuker.exe
Misc activity
ET INFO External IP Lookup Domain (geolocation-db .com) in TLS SNI
2268
X Worm Nuker.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
lcb.zip