URL:

https://msn.com

Full analysis: https://app.any.run/tasks/b5f349a1-10cb-45e7-846a-f42a7929c054
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 27, 2019, 19:04:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

C9FB8056737DA188F99586AC8BA8604F

SHA1:

1715DDBDBFBABA1AE92E9137DDD1A2B60FE8B3F6

SHA256:

5C19622DAED778B8E351FCDBE5018AF04522562D22003DF77A51D02999B8DEEB

SSDEEP:

3:N8d2:24

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • DCDSetup1.2.exe (PID: 992)
      • DCDSetup1.2.exe (PID: 2248)
      • DCDSetup1.2.exe (PID: 3416)
      • dpinst.exe (PID: 2872)
      • dpinst.exe (PID: 2908)
      • DYMO.WebApi.Win.Host.exe (PID: 1416)
      • dpinst.exe (PID: 3492)
      • DYMO.WebApi.Win.Host.exe (PID: 3656)
      • DYMO.OfficeHelper.exe (PID: 3704)
      • DYMOConnectPnPService.exe (PID: 2620)
      • DYMOConnectLauncher.exe (PID: 2772)
      • mDNSResponder.exe (PID: 1252)

    • Changes the autorun value in the registry

      • DCDSetup1.2.exe (PID: 2248)
      • DYMO.WebApi.Win.Host.exe (PID: 1416)
      • DYMO.OfficeHelper.exe (PID: 3704)

    • Downloads executable files from the Internet

      • firefox.exe (PID: 2160)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 3100)
      • firefox.exe (PID: 2160)
      • DYMO.WebApi.Win.Host.exe (PID: 1416)
      • DYMOConnectLauncher.exe (PID: 2772)
      • DYMO.WebApi.Win.Host.exe (PID: 3656)

    • Changes settings of System certificates

      • DYMO.WebApi.Win.Host.exe (PID: 1416)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 2160)
      • DCDSetup1.2.exe (PID: 2248)
      • MSIEXEC.EXE (PID: 3176)
      • msiexec.exe (PID: 932)
      • dpinst.exe (PID: 3492)
      • DrvInst.exe (PID: 3376)
      • dpinst.exe (PID: 2872)
      • DrvInst.exe (PID: 1916)
      • dpinst.exe (PID: 2908)

    • Creates files in the program directory

      • firefox.exe (PID: 2160)
      • DYMO.WebApi.Win.Host.exe (PID: 1416)
      • DYMO.WebApi.Win.Host.exe (PID: 3656)

    • Starts itself from another location

      • DCDSetup1.2.exe (PID: 3416)

    • Starts Microsoft Installer

      • DCDSetup1.2.exe (PID: 2248)

    • Creates COM task schedule object

      • msiexec.exe (PID: 932)

    • Executed as Windows Service

      • mDNSResponder.exe (PID: 1252)
      • vssvc.exe (PID: 3300)
      • DYMOConnectPnPService.exe (PID: 2620)

    • Creates files in the Windows directory

      • dpinst.exe (PID: 3492)
      • msiexec.exe (PID: 932)
      • DrvInst.exe (PID: 3376)
      • DrvInst.exe (PID: 1916)
      • DrvInst.exe (PID: 3824)

    • Executed via COM

      • DrvInst.exe (PID: 3376)
      • DrvInst.exe (PID: 1916)
      • DrvInst.exe (PID: 3824)

    • Creates files in the driver directory

      • DrvInst.exe (PID: 3376)
      • DrvInst.exe (PID: 1916)
      • DrvInst.exe (PID: 3824)

    • Removes files from Windows directory

      • DrvInst.exe (PID: 1916)
      • DrvInst.exe (PID: 3824)
      • DrvInst.exe (PID: 3376)
      • msiexec.exe (PID: 932)

    • Creates files in the user directory

      • DYMO.WebApi.Win.Host.exe (PID: 1416)
      • DYMOConnectLauncher.exe (PID: 2772)

    • Modifies the open verb of a shell class

      • msiexec.exe (PID: 932)

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 932)

    • Reads Environment values

      • DYMO.WebApi.Win.Host.exe (PID: 3656)

  • INFO

    • Reads CPU info

      • firefox.exe (PID: 2160)

    • Application launched itself

      • firefox.exe (PID: 2160)
      • msiexec.exe (PID: 932)
      • firefox.exe (PID: 2264)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 564)
      • MsiExec.exe (PID: 2552)
      • MsiExec.exe (PID: 3668)
      • msiexec.exe (PID: 932)

    • Reads Internet Cache Settings

      • firefox.exe (PID: 2160)

    • Reads settings of System Certificates

      • firefox.exe (PID: 2160)

    • Creates files in the program directory

      • msiexec.exe (PID: 932)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 932)

    • Searches for installed software

      • msiexec.exe (PID: 932)

    • Creates files in the user directory

      • firefox.exe (PID: 2160)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 3300)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
76
Monitored processes
35
Malicious processes
13
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe firefox.exe firefox.exe firefox.exe dcdsetup1.2.exe no specs dcdsetup1.2.exe dcdsetup1.2.exe msiexec.exe no specs msiexec.exe msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs mdnsresponder.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs msiexec.exe no specs dpinst.exe drvinst.exe dpinst.exe drvinst.exe dpinst.exe drvinst.exe no specs dymo.webapi.win.host.exe dymo.webapi.win.host.exe dymo.officehelper.exe dymoconnectpnpservice.exe no specs dymoconnectlauncher.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
564C:\Windows\system32\MsiExec.exe -Embedding 15DDE1AAD7C7714627DCB6788CDF5C4EC:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
932C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
992"C:\Users\admin\Downloads\DCDSetup1.2.exe" C:\Users\admin\Downloads\DCDSetup1.2.exe—firefox.exe
User:
admin
Company:
DYMO
Integrity Level:
MEDIUM
Description:
DYMO Connect Installer
Exit code:
3221226540
Version:
1.2.974.48577
Modules
Images
c:\users\admin\downloads\dcdsetup1.2.exe
c:\systemroot\system32\ntdll.dll
1252"C:\Program Files\Bonjour\mDNSResponder.exe"C:\Program Files\Bonjour\mDNSResponder.exe
services.exe
User:
SYSTEM
Company:
Apple Inc.
Integrity Level:
SYSTEM
Description:
Bonjour Service
Exit code:
0
Version:
3,0,0,10
Modules
Images
c:\program files\bonjour\mdnsresponder.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
1416"C:\Program Files\DYMO\DYMO Connect\DYMO.WebApi.Win.Host.exe" /oC:\Program Files\DYMO\DYMO Connect\DYMO.WebApi.Win.Host.exe
msiexec.exe
User:
admin
Integrity Level:
HIGH
Description:
DYMO.WebApi.Win.Host
Exit code:
0
Version:
1.2.974.48577
Modules
Images
c:\program files\dymo\dymo connect\dymo.webapi.win.host.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1560"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2160.20.2011684699\2025691586" -childID 3 -isForBrowser -prefsHandle 3844 -prefMapHandle 3848 -prefsLen 7195 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2160 "\\.\pipe\gecko-crash-server-pipe.2160" 3860 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
1916DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{1de49b21-9a1d-030b-e54b-9e7a1135a24b}\dymo_lwv2.inf" "0" "67b7f919f" "0000052C" "WinSta0\Default" "0000039C" "208" "c:\program files\dymo\dymo connect\drivers\lwv2"C:\Windows\system32\DrvInst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2160"C:\Program Files\Mozilla Firefox\firefox.exe" https://msn.comC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
2248C:\Users\admin\AppData\Local\Temp\{A9A2BEBE-5627-4BAA-B4E2-4E1A05B89D3E}\DCDSetup1.2.exe /q"C:\Users\admin\Downloads\DCDSetup1.2.exe" /tempdisk1folder"C:\Users\admin\AppData\Local\Temp\{A9A2BEBE-5627-4BAA-B4E2-4E1A05B89D3E}" /IS_tempC:\Users\admin\AppData\Local\Temp\{A9A2BEBE-5627-4BAA-B4E2-4E1A05B89D3E}\DCDSetup1.2.exe
DCDSetup1.2.exe
User:
admin
Company:
DYMO
Integrity Level:
HIGH
Description:
DYMO Connect Installer
Exit code:
0
Version:
1.2.974.48577
Modules
Images
c:\users\admin\appdata\local\temp\{a9a2bebe-5627-4baa-b4e2-4e1a05b89d3e}\dcdsetup1.2.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2264"C:\Program Files\Mozilla Firefox\firefox.exe" "https://msn.com"C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
Total events
6 454
Read events
2 409
Write events
3 991
Delete events
54

Modification events

(PID) Process:(2160) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Browser
Value:
C391900D03000000
(PID) Process:(2264) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Launcher
Value:
842A8D0D03000000
(PID) Process:(2160) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry
Value:
1
(PID) Process:(2160) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2160) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000092000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2160) firefox.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2160) firefox.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:@%SystemRoot%\system32\p2pcollab.dll,-8042
Value:
Peer to Peer Trust
(PID) Process:(2160) firefox.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:@%SystemRoot%\system32\qagentrt.dll,-10
Value:
System Health Authentication
(PID) Process:(2160) firefox.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:@%SystemRoot%\system32\dnsapi.dll,-103
Value:
Domain Name System (DNS) Server Trust
(PID) Process:(2160) firefox.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:@%SystemRoot%\System32\fveui.dll,-843
Value:
BitLocker Drive Encryption
Executable files
667
Suspicious files
230
Text files
443
Unknown types
210

Dropped files

PID
Process
Filename
Type
2160firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
2160firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js —
MD5:—
SHA256:—
2160firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp —
MD5:—
SHA256:—
2160firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4.tmp —
MD5:—
SHA256:—
2160firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\allow-flashallow-digest256.pset —
MD5:—
SHA256:—
2160firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\allow-flashallow-digest256.sbstore —
MD5:—
SHA256:—
2160firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\base-track-digest256.pset —
MD5:—
SHA256:—
2160firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\base-track-digest256.sbstore —
MD5:—
SHA256:—
2160firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\block-flash-digest256.pset —
MD5:—
SHA256:—
2160firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\block-flash-digest256.sbstore —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
100
DNS requests
193
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2160
firefox.exe
POST
200
172.217.22.35:80
http://ocsp.pki.goog/gts1o1
US
der
472 b
whitelisted
2160
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
2160
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
2160
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
2160
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
2160
firefox.exe
POST
200
172.217.22.35:80
http://ocsp.pki.goog/gts1o1
US
der
472 b
whitelisted
2160
firefox.exe
GET
200
199.59.2.173:80
http://download.dymo.com/dymo/Software/Win/DCDSetup1.2.exe
US
executable
144 Mb
suspicious
2160
firefox.exe
POST
200
104.18.24.243:80
http://ocsp.msocsp.com/
US
der
1.79 Kb
whitelisted
2160
firefox.exe
POST
200
172.217.22.35:80
http://ocsp.pki.goog/gts1o1
US
der
472 b
whitelisted
2160
firefox.exe
POST
200
151.139.128.14:80
http://ocsp.sectigo.com/
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2160
firefox.exe
2.16.106.209:80
detectportal.firefox.com
Akamai International B.V.
—
whitelisted
2160
firefox.exe
35.164.109.147:443
search.services.mozilla.com
Amazon.com, Inc.
US
unknown
2160
firefox.exe
13.82.28.61:443
msn.com
Microsoft Corporation
US
whitelisted
2160
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2160
firefox.exe
35.162.117.80:443
tiles.services.mozilla.com
Amazon.com, Inc.
US
unknown
2160
firefox.exe
216.58.207.74:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
2160
firefox.exe
2.16.186.35:443
static-global-s-msn-com.akamaized.net
Akamai International B.V.
—
whitelisted
2160
firefox.exe
172.217.16.174:443
play.google.com
Google Inc.
US
whitelisted
2160
firefox.exe
104.86.44.115:443
linkmaker.itunes.apple.com
Akamai Technologies, Inc.
NL
unknown
2160
firefox.exe
54.186.106.198:443
push.services.mozilla.com
Amazon.com, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
detectportal.firefox.com
  • 2.16.106.209
  • 2.16.106.152
whitelisted
a1089.dscd.akamai.net
  • 2.16.106.152
  • 2.16.106.209
whitelisted
search.services.mozilla.com
  • 35.164.109.147
  • 52.35.182.58
  • 52.89.218.39
whitelisted
search.r53-2.services.mozilla.com
  • 52.89.218.39
  • 52.35.182.58
  • 35.164.109.147
whitelisted
push.services.mozilla.com
  • 54.186.106.198
whitelisted
autopush.prod.mozaws.net
  • 54.186.106.198
whitelisted
snippets.cdn.mozilla.net
  • 52.222.169.245
  • 52.222.169.137
  • 52.222.169.104
  • 52.222.169.17
whitelisted
d228z91au11ukj.cloudfront.net
  • 52.222.169.17
  • 52.222.169.104
  • 52.222.169.137
  • 52.222.169.245
whitelisted
msn.com
  • 13.82.28.61
whitelisted
tiles.services.mozilla.com
  • 35.162.117.80
  • 52.89.51.22
  • 54.68.132.173
  • 34.223.160.244
  • 54.148.67.145
  • 54.149.168.253
  • 34.210.52.58
  • 54.69.207.70
whitelisted

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
1080
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
1080
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
1080
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
2160
firefox.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
Process
Message
DYMO.WebApi.Win.Host.exe
Starting DYMO.WebApi.Win.Host 1.2.974.48577
DYMO.WebApi.Win.Host.exe
DYMO.WebApi.Win.Host.exe Information: 0 :
DYMO.WebApi.Win.Host.exe
Failed to remove autorun entries: No value exists with that name.
DYMO.WebApi.Win.Host.exe
DYMO.WebApi.Win.Host.exe Warning: 0 :
DYMO.WebApi.Win.Host.exe
DYMO.WebApi.Win.Host.exe Information: 0 :
DYMO.WebApi.Win.Host.exe
Starting DYMO.WebApi.Win.Host 1.2.974.48577
DYMO.WebApi.Win.Host.exe
StartHost: https://127.0.0.1:41951
DYMO.WebApi.Win.Host.exe
StartHost: https://127.0.0.1:41951
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://msn.com