URL:

https://obsproject.com/

Full analysis: https://app.any.run/tasks/c20923ae-56c9-403f-9703-d3d4502a2678
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 11, 2020, 14:41:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
loader
Indicators:
MD5:

CC0E506F38BFF061CD1142A5399F125A

SHA1:

266F5AD3A3EAAAA13F97D3F0F3B926130E23BE81

SHA256:

5CC0E67257C0CC091D1B730FBEF709BC0BDBCE07C67E0E2160158BDC55EE7E71

SSDEEP:

3:N8OMGRyK3:2OHRZ3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • OBS-Studio-25.0.4-Full-Installer-x64.exe (PID: 3500)
      • OBS_0_659b_With_Browser_Installer.exe (PID: 3192)
      • dxwsetup.exe (PID: 2552)

    • Application was dropped or rewritten from another process

      • OBS-Studio-25.0.4-Full-Installer-x64.exe (PID: 3932)
      • OBS-Studio-25.0.4-Full-Installer-x64.exe (PID: 3500)
      • dxwebsetup.exe (PID: 3808)
      • dxwebsetup.exe (PID: 3056)
      • dxwsetup.exe (PID: 2552)
      • BingBarSetup-Partner.exe (PID: 3764)
      • RunOncePack.EXE (PID: 3508)
      • BingBarSetup-Partner.EXE (PID: 480)
      • BBSetup.exe (PID: 1524)

    • Changes the autorun value in the registry

      • dxwebsetup.exe (PID: 3056)
      • BingBarSetup-Partner.exe (PID: 3764)
      • BingBarSetup-Partner.EXE (PID: 480)

    • Actions looks like stealing of personal data

      • dxwsetup.exe (PID: 2552)
      • msiexec.exe (PID: 3400)

    • Downloads executable files from the Internet

      • dxwsetup.exe (PID: 2552)

    • Changes settings of System certificates

      • dxwsetup.exe (PID: 2552)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • OBS-Studio-25.0.4-Full-Installer-x64.exe (PID: 3500)
      • OBS_0_659b_With_Browser_Installer.exe (PID: 3192)
      • iexplore.exe (PID: 2740)
      • iexplore.exe (PID: 3020)
      • dxwebsetup.exe (PID: 3056)
      • dxwsetup.exe (PID: 2552)
      • BingBarSetup-Partner.exe (PID: 3764)
      • BingBarSetup-Partner.EXE (PID: 480)
      • BBSetup.exe (PID: 1524)
      • msiexec.exe (PID: 3400)

    • Creates a software uninstall entry

      • OBS-Studio-25.0.4-Full-Installer-x64.exe (PID: 3500)

    • Executed via COM

      • explorer.exe (PID: 3380)
      • DllHost.exe (PID: 3720)

    • Reads Internet Cache Settings

      • dxwsetup.exe (PID: 2552)
      • RunOncePack.EXE (PID: 3508)
      • BBSetup.exe (PID: 1524)

    • Creates files in the program directory

      • OBS-Studio-25.0.4-Full-Installer-x64.exe (PID: 3500)
      • BBSetup.exe (PID: 1524)

    • Executed as Windows Service

      • vssvc.exe (PID: 2340)

    • Searches for installed software

      • dxwsetup.exe (PID: 2552)

    • Creates files in the Windows directory

      • dxwsetup.exe (PID: 2552)

    • Creates COM task schedule object

      • dxwsetup.exe (PID: 2552)
      • msiexec.exe (PID: 3400)

    • Removes files from Windows directory

      • dxwsetup.exe (PID: 2552)

    • Creates files in the user directory

      • dxwsetup.exe (PID: 2552)
      • RunOncePack.EXE (PID: 3508)

    • Checks for external IP

      • RunOncePack.EXE (PID: 3508)

    • Adds / modifies Windows certificates

      • dxwsetup.exe (PID: 2552)

  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3020)
      • iexplore.exe (PID: 3072)
      • iexplore.exe (PID: 3804)
      • iexplore.exe (PID: 2740)

    • Changes internet zones settings

      • iexplore.exe (PID: 3020)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3020)
      • iexplore.exe (PID: 3804)
      • iexplore.exe (PID: 3072)
      • iexplore.exe (PID: 2740)
      • dxwsetup.exe (PID: 2552)

    • Creates files in the user directory

      • iexplore.exe (PID: 3804)
      • iexplore.exe (PID: 3020)
      • iexplore.exe (PID: 3072)
      • iexplore.exe (PID: 2740)

    • Application launched itself

      • iexplore.exe (PID: 3020)
      • msiexec.exe (PID: 3400)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3804)
      • iexplore.exe (PID: 3072)
      • iexplore.exe (PID: 2740)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3020)

    • Dropped object may contain Bitcoin addresses

      • OBS-Studio-25.0.4-Full-Installer-x64.exe (PID: 3500)
      • iexplore.exe (PID: 3020)
      • BingBarSetup-Partner.EXE (PID: 480)
      • BBSetup.exe (PID: 1524)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 2340)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3400)

    • Creates or modifies windows services

      • msiexec.exe (PID: 3400)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3020)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3020)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
73
Monitored processes
22
Malicious processes
9
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe iexplore.exe obs-studio-25.0.4-full-installer-x64.exe no specs obs-studio-25.0.4-full-installer-x64.exe explorer.exe no specs explorer.exe no specs obs_0_659b_with_browser_installer.exe no specs obs_0_659b_with_browser_installer.exe iexplore.exe dxwebsetup.exe no specs dxwebsetup.exe dxwsetup.exe vssvc.exe no specs SPPSurrogate no specs bingbarsetup-partner.exe runoncepack.exe bingbarsetup-partner.exe bbsetup.exe msiexec.exe msiexec.exe no specs regedit.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
480"C:\Users\admin\AppData\Local\Temp\IXP001.TMP\BingBarSetup-Partner.EXE" C:\Users\admin\AppData\Local\Temp\IXP001.TMP\BingBarSetup-Partner.EXE
RunOncePack.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Bing Bar Setup
Exit code:
0
Version:
7.1.362.0
Modules
Images
c:\users\admin\appdata\local\temp\ixp001.tmp\bingbarsetup-partner.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1524C:\Users\admin\AppData\Local\Temp\IXP002.TMP\BBSetup.exe cabLocation=.\BingBarPartnerConfig.cab hashLanguage=oemC:\Users\admin\AppData\Local\Temp\IXP002.TMP\BBSetup.exe
BingBarSetup-Partner.EXE
User:
admin
Company:
Microsoft Corporation.
Integrity Level:
HIGH
Description:
Bing Bar Setup
Exit code:
0
Version:
7.1.362.0
Modules
Images
c:\users\admin\appdata\local\temp\ixp002.tmp\bbsetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2340C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2364"C:\Windows\explorer.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OBS Studio\OBS Studio (64bit).lnk"C:\Windows\explorer.exe—OBS-Studio-25.0.4-Full-Installer-x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2552C:\Users\admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
dxwebsetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
DirectX Setup
Exit code:
0
Version:
4.9.0.0904
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\dxwsetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2672"C:\Windows\regedit.exe" /s "C:\Users\admin\AppData\Local\Temp\defaultCache.reg"C:\Windows\regedit.exe—MsiExec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Editor
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\regedit.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2740"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3020 CREDAT:1643816 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2936C:\Windows\system32\MsiExec.exe -Embedding 47432717A3749646A729DCFC2785528CC:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3020"C:\Program Files\Internet Explorer\iexplore.exe" https://obsproject.com/C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3056"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\dxwebsetup.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\dxwebsetup.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
DirectX 9.0 Web setup
Exit code:
0
Version:
9.29.1974.0
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\po2hn1x2\dxwebsetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
17 508
Read events
3 416
Write events
12 887
Delete events
1 205

Modification events

(PID) Process:(3020) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
1427884074
(PID) Process:(3020) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30806031
(PID) Process:(3020) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3020) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3020) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3020) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3020) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3020) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A1000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3020) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3020) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
213
Suspicious files
183
Text files
3 602
Unknown types
195

Dropped files

PID
Process
Filename
Type
3072iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\CabE6AF.tmp —
MD5:—
SHA256:—
3072iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\TarE6B0.tmp —
MD5:—
SHA256:—
3072iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\OS_icons-small_white[1].pngimage
MD5:—
SHA256:—
3072iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\PJ5UD15E.htmhtml
MD5:—
SHA256:—
3072iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\blurple.min[1].csstext
MD5:—
SHA256:—
3072iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08der
MD5:—
SHA256:—
3072iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08binary
MD5:—
SHA256:—
3072iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\logo[2].pngimage
MD5:—
SHA256:—
3072iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DATsmt
MD5:—
SHA256:—
3072iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_74167E25E5476CCA2A5946AAA61BF9E1binary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
123
TCP/UDP connections
102
DNS requests
37
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3072
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2Fz5hY5qj0aEmX0H4s05bY%3D
US
der
1.47 Kb
whitelisted
3072
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2Fz5hY5qj0aEmX0H4s05bY%3D
US
der
1.47 Kb
whitelisted
3072
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQrBBNpPfHTPX6Jy6BVzyBPnBWMnQQUPnQtH89FdQR%2BP8Cihz5MQ4NRE8YCEA%2BRw%2BjERWyNyKHvIi6HbC0%3D
US
der
280 b
whitelisted
3072
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQrBBNpPfHTPX6Jy6BVzyBPnBWMnQQUPnQtH89FdQR%2BP8Cihz5MQ4NRE8YCEA%2BRw%2BjERWyNyKHvIi6HbC0%3D
US
der
280 b
whitelisted
3020
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
3804
iexplore.exe
GET
200
151.101.2.133:80
http://ocsp.globalsign.com/rootr1/ME8wTTBLMEkwRzAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDkbwjNvPLFRm7zMB3V80
US
der
1.49 Kb
whitelisted
3804
iexplore.exe
GET
200
151.101.2.133:80
http://ocsp.globalsign.com/rootr1/ME8wTTBLMEkwRzAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDkbwjNvPLFRm7zMB3V80
US
der
1.49 Kb
whitelisted
3072
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJ9L2KGL92BpjF3kAtaDtxauTmhgQUPdNQpdagre7zSmAKZdMh1Pj41g8CEAoGMEJ%2FW7ztaVc5ZZO2RR8%3D
US
der
471 b
whitelisted
3020
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
3020
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3072
iexplore.exe
149.56.72.190:443
—
OVH SAS
CA
suspicious
3072
iexplore.exe
2.21.242.197:80
isrg.trustid.ocsp.identrust.com
Akamai International B.V.
NL
whitelisted
3072
iexplore.exe
104.26.12.145:443
images.opencollective.com
Cloudflare Inc
US
unknown
3072
iexplore.exe
216.58.207.40:443
www.googletagmanager.com
Google Inc.
US
whitelisted
3072
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3072
iexplore.exe
172.217.16.195:80
ocsp.pki.goog
Google Inc.
US
whitelisted
3020
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3072
iexplore.exe
172.217.22.78:443
www.google-analytics.com
Google Inc.
US
whitelisted
3020
iexplore.exe
149.56.72.190:443
—
OVH SAS
CA
suspicious
3072
iexplore.exe
173.194.76.157:443
stats.g.doubleclick.net
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
obsproject.com
  • 2.18.233.62
whitelisted
isrg.trustid.ocsp.identrust.com
  • 2.21.242.197
  • 2.21.242.187
whitelisted
images.opencollective.com
  • 104.26.12.145
  • 104.26.13.145
whitelisted
www.googletagmanager.com
  • 216.58.207.40
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
ocsp.pki.goog
  • 172.217.16.195
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
www.google-analytics.com
  • 172.217.22.78
whitelisted
stats.g.doubleclick.net
  • 173.194.76.157
  • 173.194.76.155
  • 173.194.76.156
  • 173.194.76.154
whitelisted

Threats

PID
Process
Class
Message
1524
BBSetup.exe
Potential Corporate Privacy Violation
ET POLICY BingBar ToolBar User-Agent (BingBar)
1524
BBSetup.exe
Potential Corporate Privacy Violation
ET POLICY BingBar ToolBar User-Agent (BingBar)
3 ETPRO signatures available at the full report
Process
Message
dxwsetup.exe
DLL_PROCESS_ATTACH
dxwsetup.exe
Invalid parameter passed to C runtime function.
dxwsetup.exe
DLL_PROCESS_DETACH
dxwsetup.exe
Invalid parameter passed to C runtime function.
dxwsetup.exe
DLL_PROCESS_DETACH
dxwsetup.exe
DLL_PROCESS_ATTACH
dxwsetup.exe
DLL_PROCESS_ATTACH
dxwsetup.exe
DLL_PROCESS_ATTACH
dxwsetup.exe
DLL_PROCESS_DETACH
dxwsetup.exe
DLL_PROCESS_DETACH
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://obsproject.com/