Malware analysis http://cbc.com/ Malicious activity | ANY.RUN

Add for printing

URL:	http://cbc.com/
Full analysis:	https://app.any.run/tasks/70ca1c4b-b062-46eb-82b2-7ba8da5b4f25
Verdict:	Malicious activity
Analysis date:	July 06, 2025, 04:36:42
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	discord
MD5:	DCA77D8F67EF655ACD7A252DAF55EF4F
SHA1:	DBE7F8F35942D6A96156E014DE75A72D30C7F5C0
SHA256:	1920F39E043169CE11DEF3B93D3CD882D4C47565549600D2178296E023D8E5C1
SSDEEP:	3:N1KdHcGTK:CaR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
No suspicious indicators.
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

181

Monitored processes

1

Malicious processes

0

Suspicious processes

0

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
5012	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --webtransport-developer-mode --string-annotations --always-read-main-dll --field-trial-handle=2180,i,6161488519127897921,10116046693238162506,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:3	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe		msedge.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Version: 133.0.3065.92

Add for printing

Total events

0

Read events

0

Write events

0

Delete events

0

Modification events

No data

Add for printing

Executable files

13

Suspicious files

118

Text files

106

Unknown types

1

Dropped files

PID	Process	Filename		Type
5012	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b7		compressed
		MD5:35B5D9F676749FBB797019B9540174F5	SHA256:AE96909DB92D89724804DABFD870B8B62D7BDA8E02B7327FE835ECF97097D5F3
5012	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State		binary
		MD5:F054A7D6E382DF24018FE84986B710A2	SHA256:4E5235C6B40BCE6C5FD0554D554FCDB38E8016DCDDFA9CAB63103407CAF8DAEB
5012	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b8		image
		MD5:1E3396C535FC0A9427419F4B52C60F32	SHA256:72B9997A6CCCD039106652716C04F2236664100871C579052F7F2460600AEF1B
5012	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b9		binary
		MD5:B4444A4A9DE5D7FB6749D003417EAA77	SHA256:284A3BEC0248D067741A4EBC36FFD29A0610C8CB58DDFFFF0C86D11CCA67ADA2
5012	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\bf821c83-32ff-44af-bee0-73e4b7c9a322.tmp		binary
		MD5:F054A7D6E382DF24018FE84986B710A2	SHA256:4E5235C6B40BCE6C5FD0554D554FCDB38E8016DCDDFA9CAB63103407CAF8DAEB
5012	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bb		text
		MD5:C813A1B87F1651D642CDCAD5FCA7A7D8	SHA256:DF670E09F278FEA1D0684AFDCD0392A83D7041585BA5996F7B527974D7D98EC3
5012	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bc		text
		MD5:CF2D86B24B1E5F44953F183E05C970B4	SHA256:CA128B01DB8FDF7397B9BA4A5DC21E3349BE348C35BECB79AA2FF76669BB8486
5012	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ba		binary
		MD5:0C1D5FBBF96A0437FCABD2517F5B98C6	SHA256:7625DEDDC431FB69150A751DE921BC94A302D7377A117CF79AAC021313BF77B4
5012	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000be		text
		MD5:226541550A51911C375216F718493F65	SHA256:CAECFF4179910CE0FF470F9FA9EB4349E8FB717FA1432CF19987450A4E1EF4A5
5012	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bf		compressed
		MD5:2E86A72F4E82614CD4842950D2E0A716	SHA256:C1334E604DBBFFDF38E9E2F359938569AFE25F7150D1C39C293469C1EE4F7B6F

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

1 460

TCP/UDP connections

672

DNS requests

627

Threats

45

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
4900	svchost.exe	HEAD	403	208.89.74.21:80	http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/4c4fdee0-d69c-42b7-bf5c-3ec046e9dfc9?P1=1751247403&P2=404&P3=2&P4=KIOuyaltQzGUv9%2fRXevwe%2b%2fSXHyfYvf%2f5L%2fb6O%2fEjuA9bg7JGUT71DQcxatSu%2by%2f0Fb5ScE2gwu8%2bMYnHtBQiQ%3d%3d	unknown	—	—	whitelisted
—	—	HEAD	200	23.212.222.21:443	https://fs.microsoft.com/fs/windows/config.json	unknown	—	—	—
—	—	GET	200	104.126.37.155:443	https://www.bing.com/bloomfilterfiles/ExpandedDomainsFilterGlobal.json	unknown	binary	655 Kb	whitelisted
5012	msedge.exe	GET	200	121.78.127.249:80	http://cbc.com/	unknown	—	—	malicious
—	—	GET	200	23.212.222.21:443	https://fs.microsoft.com/fs/windows/config.json	unknown	binary	55 b	whitelisted
5012	msedge.exe	GET	200	121.78.127.249:80	http://cbc.com/bg.gif	unknown	—	—	malicious
4076	svchost.exe	GET	200	23.216.77.6:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
6972	RUXIMICS.exe	GET	200	23.216.77.6:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5012	msedge.exe	GET	200	121.78.127.249:80	http://cbc.com/cbc.jpg	unknown	—	—	malicious
5336	MoUsoCoreWorker.exe	GET	200	23.216.77.6:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4076	svchost.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
6972	RUXIMICS.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
5336	MoUsoCoreWorker.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
—	—	224.0.0.251:5353	—	—	—	unknown
4900	svchost.exe	208.89.74.21:80	msedge.b.tlu.dl.delivery.mp.microsoft.com	—	US	whitelisted
5012	msedge.exe	104.126.37.170:443	www.bing.com	Akamai International B.V.	DE	whitelisted
4900	svchost.exe	23.197.142.186:443	fs.microsoft.com	Akamai International B.V.	US	whitelisted
5012	msedge.exe	121.78.127.249:80	cbc.com	GABIA Inc.	KR	malicious
4076	svchost.exe	23.216.77.6:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
6972	RUXIMICS.exe	23.216.77.6:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	51.104.136.2	whitelisted
msedge.b.tlu.dl.delivery.mp.microsoft.com	208.89.74.21 208.89.74.19 208.89.74.27 208.89.74.31 208.89.74.17 208.89.74.23 208.89.74.29 199.232.210.172 199.232.214.172	whitelisted
google.com	142.250.185.110	whitelisted
www.bing.com	104.126.37.170 104.126.37.161 104.126.37.154 104.126.37.129 104.126.37.128 104.126.37.144 104.126.37.137 104.126.37.155 104.126.37.162 104.126.37.160 104.126.37.163 104.126.37.186 104.126.37.139 2.23.227.215 2.23.227.208 104.126.37.171 104.126.37.168 104.126.37.177 104.126.37.131 2.16.241.218 2.16.241.201	whitelisted
fs.microsoft.com	23.197.142.186	whitelisted
cbc.com	121.78.127.249	unknown
crl.microsoft.com	23.216.77.6 23.216.77.28	whitelisted
www.microsoft.com	184.30.21.171	whitelisted
edge.microsoft.com	150.171.27.11 150.171.28.11	whitelisted
xpaywalletcdn.azureedge.net	13.107.253.45	whitelisted

Threats

PID	Process	Class	Message
—	—	Not Suspicious Traffic	INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
—	—	Not Suspicious Traffic	INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
—	—	Not Suspicious Traffic	INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
—	—	Not Suspicious Traffic	INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
—	—	Not Suspicious Traffic	INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
—	—	Not Suspicious Traffic	INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
—	—	Not Suspicious Traffic	INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
—	—	Not Suspicious Traffic	INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
—	—	Misc activity	ET INFO Observed Discord Domain in DNS Lookup (discord .com)
—	—	Misc activity	ET INFO Observed Discord Domain in DNS Lookup (discord .com)

Add for printing

No debug info

General Info

http://cbc.com/

DCA77D8F67EF655ACD7A252DAF55EF4F

DBE7F8F35942D6A96156E014DE75A72D30C7F5C0

1920F39E043169CE11DEF3B93D3CD882D4C47565549600D2178296E023D8E5C1

3:N1KdHcGTK:CaR

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

INFO

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings