download:

/community/releases/OpenVPN-2.6.8-I001-x86.msi

Full analysis: https://app.any.run/tasks/b0559338-9395-4ecf-b070-54a8498177a7
Verdict: Malicious activity
Analysis date: January 23, 2024, 19:27:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: OpenVPN 2.6.8-I001 x86, Author: OpenVPN, Inc., Keywords: Installer, Comments: This installer database contains the logic and data required to install OpenVPN 2.6.8-I001 x86., Template: Intel;1033, Revision Number: {AFE9A119-5A84-46C6-A7FB-26F66CBD7321}, Create Time/Date: Fri Nov 17 11:46:58 2023, Last Saved Time/Date: Fri Nov 17 11:46:58 2023, Number of Pages: 500, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.14.0.4118), Security: 4
MD5:

7D72CB500E8A3C6BAABD8DDC12F606E6

SHA1:

CB84FC538D88FDC054C4999073A43709E478E7FD

SHA256:

AE7E0028A7B2E3790A49683AACB0D6BB52D2D86385381ED35706679D065C3CDA

SSDEEP:

98304:4pzyp5KOPMh75GNZJ9JqOj7E7BKyBjeZSfukNqlzsdlhxI5AmCS3zpbwGjO0kOc6:c43I

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 984)
      • drvinst.exe (PID: 3156)
      • drvinst.exe (PID: 3096)
      • drvinst.exe (PID: 3524)
      • drvinst.exe (PID: 3816)

    • Creates a writable file in the system directory

      • drvinst.exe (PID: 3156)
      • drvinst.exe (PID: 3096)
      • drvinst.exe (PID: 3524)
      • drvinst.exe (PID: 3816)

  • SUSPICIOUS

    • Creates files in the driver directory

      • drvinst.exe (PID: 3156)
      • drvinst.exe (PID: 3096)
      • drvinst.exe (PID: 3524)
      • drvinst.exe (PID: 3816)

    • Drops a system driver (possible attempt to evade defenses)

      • drvinst.exe (PID: 3156)
      • drvinst.exe (PID: 3096)
      • drvinst.exe (PID: 3524)
      • drvinst.exe (PID: 3816)

    • Executable content was dropped or overwritten

      • drvinst.exe (PID: 3156)
      • drvinst.exe (PID: 3096)
      • drvinst.exe (PID: 3816)
      • drvinst.exe (PID: 3524)

    • Checks Windows Trust Settings

      • drvinst.exe (PID: 3156)
      • drvinst.exe (PID: 3524)
      • drvinst.exe (PID: 3816)
      • drvinst.exe (PID: 3096)

    • Executes as Windows Service

      • openvpnserv.exe (PID: 3448)
      • openvpnserv2.exe (PID: 3996)

  • INFO

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 984)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 984)

    • Reads the computer name

      • drvinst.exe (PID: 3156)
      • drvinst.exe (PID: 3096)
      • drvinst.exe (PID: 3524)
      • drvinst.exe (PID: 3816)
      • openvpnserv.exe (PID: 3448)
      • openvpnserv2.exe (PID: 3996)
      • openvpn.exe (PID: 780)
      • wmpnscfg.exe (PID: 2564)
      • wmpnscfg.exe (PID: 2380)

    • Checks supported languages

      • drvinst.exe (PID: 3156)
      • drvinst.exe (PID: 3096)
      • drvinst.exe (PID: 3524)
      • drvinst.exe (PID: 3816)
      • openvpnserv.exe (PID: 3448)
      • openvpnserv2.exe (PID: 3996)
      • openvpn.exe (PID: 3472)
      • openvpn-gui.exe (PID: 784)
      • wmpnscfg.exe (PID: 2564)
      • wmpnscfg.exe (PID: 2380)
      • openvpn.exe (PID: 780)

    • Reads the machine GUID from the registry

      • drvinst.exe (PID: 3156)
      • drvinst.exe (PID: 3096)
      • drvinst.exe (PID: 3524)
      • drvinst.exe (PID: 3816)

    • Reads Environment values

      • drvinst.exe (PID: 3524)
      • drvinst.exe (PID: 3816)

    • Manual execution by a user

      • openvpn-gui.exe (PID: 784)
      • firefox.exe (PID: 1056)
      • wmpnscfg.exe (PID: 2564)
      • wmpnscfg.exe (PID: 2380)

    • Application launched itself

      • firefox.exe (PID: 1056)
      • firefox.exe (PID: 924)

    • The process uses the downloaded file

      • firefox.exe (PID: 924)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (98.5)
.msi | Microsoft Installer (100)

EXIF

FlashPix

CodePage: Windows Latin 1 (Western European)
Title: Installation Database
Subject: OpenVPN 2.6.8-I001 x86
Author: OpenVPN, Inc.
Keywords: Installer
Comments: This installer database contains the logic and data required to install OpenVPN 2.6.8-I001 x86.
Template: Intel;1033
RevisionNumber: {AFE9A119-5A84-46C6-A7FB-26F66CBD7321}
CreateDate: 2023:11:17 11:46:58
ModifyDate: 2023:11:17 11:46:58
Pages: 500
Words: 2
Software: Windows Installer XML Toolset (3.14.0.4118)
Security: Read-only enforced
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
88
Monitored processes
32
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe drvinst.exe rundll32.exe no specs drvinst.exe rundll32.exe no specs drvinst.exe drvinst.exe openvpnserv.exe no specs openvpnserv2.exe no specs openvpn.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs openvpn-gui.exe no specs openvpn.exe wmpnscfg.exe no specs wmpnscfg.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
476"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="924.15.1951852752\669043798" -childID 14 -isForBrowser -prefsHandle 8416 -prefMapHandle 4132 -prefsLen 31364 -prefMapSize 244195 -jsInitHandle 916 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9cb5a0e1-89b1-475e-ba97-9ccc1ba2e85b} 924 "\\.\pipe\gecko-crash-server-pipe.924" 3740 15f68840 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
780openvpn --log "C:\Users\admin\OpenVPN\log\Russia_87.255.31.50_udp.log" --config "Russia_87.255.31.50_udp.ovpn" --setenv IV_GUI_VER "OpenVPN GUI 11.46.0.0" --setenv IV_SSO openurl,webauth,crtext --service da000000c04 0 --auth-retry interact --management 127.0.0.1 25340 stdin --management-query-passwords --management-hold --pull-filter ignore route-method --msg-channel 376C:\Program Files\OpenVPN\bin\openvpn.exe
openvpnserv.exe
User:
admin
Company:
The OpenVPN Project
Integrity Level:
MEDIUM
Description:
OpenVPN Daemon
Exit code:
0
Version:
2.6.8.0
Modules
Images
c:\program files\openvpn\bin\openvpn.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\openvpn\bin\libssl-3.dll
c:\program files\openvpn\bin\libcrypto-3.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
784"C:\Program Files\OpenVPN\bin\openvpn-gui.exe" --command import "C:\Users\admin\Downloads\Russia_87.255.31.50_udp.ovpn"C:\Program Files\OpenVPN\bin\openvpn-gui.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\program files\openvpn\bin\openvpn-gui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\rpcrt4.dll
884"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="924.9.505859509\70463774" -childID 8 -isForBrowser -prefsHandle 7748 -prefMapHandle 7760 -prefsLen 31364 -prefMapSize 244195 -jsInitHandle 916 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a77476e-ad56-4c45-a435-f24ad9b6ecff} 924 "\\.\pipe\gecko-crash-server-pipe.924" 7736 17431110 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
924"C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
984"C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\Desktop\OpenVPN-2.6.8-I001-x86.msi"C:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1056"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
1376rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{5f0c185e-4862-1902-0df2-fd22807bfc1b} Global\{7da0bb1f-a8db-7d32-9169-b6015cf21248} C:\Windows\System32\DriverStore\Temp\{19024862-3f96-7489-5cf2-1248bbfe0d5c}\OemVista.inf C:\Windows\System32\DriverStore\Temp\{19024862-3f96-7489-5cf2-1248bbfe0d5c}\tap0901.catC:\Windows\System32\rundll32.exe—drvinst.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1408rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{04b9b4b8-4ad3-2af1-6f43-360b8e13a535} Global\{2ba70393-2088-4915-11e9-e65b11e9e65b} C:\Windows\System32\DriverStore\Temp\{41a116a1-1869-1784-32ee-2144fb5ac850}\wintun.inf C:\Windows\System32\DriverStore\Temp\{41a116a1-1869-1784-32ee-2144fb5ac850}\wintun.catC:\Windows\System32\rundll32.exe—drvinst.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1556"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="924.13.1586094626\14827926" -childID 12 -isForBrowser -prefsHandle 8144 -prefMapHandle 8132 -prefsLen 31364 -prefMapSize 244195 -jsInitHandle 916 -jsInitLen 240908 -parentBuildID 20230710165010 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4118af87-5df7-4abe-a394-435c0739137d} 924 "\\.\pipe\gecko-crash-server-pipe.924" 8148 17b12110 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
115.0.2
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
Total events
68 610
Read events
68 084
Write events
427
Delete events
99

Modification events

(PID) Process:(984) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3156) drvinst.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1408) rundll32.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3156) drvinst.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
Operation:writeName:FirstRun
Value:
0
(PID) Process:(3156) drvinst.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
Operation:writeName:LastIndex
Value:
75
(PID) Process:(3156) drvinst.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\Volatile
Operation:writeName:NestingLevel
Value:
1
(PID) Process:(3156) drvinst.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\Volatile
Operation:writeName:StartNesting
Value:
02444446324EDA01
(PID) Process:(3156) drvinst.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore\Volatile
Operation:writeName:NestingLevel
Value:
2
(PID) Process:(3096) drvinst.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1376) rundll32.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
11
Suspicious files
218
Text files
32
Unknown types
2

Dropped files

PID
Process
Filename
Type
3156drvinst.exeC:\Windows\System32\DriverStore\Temp\{41a116a1-1869-1784-32ee-2144fb5ac850}\wintun.infbinary
MD5:0DBD4C3F0F61BD4958D64DD585951A59
SHA256:04721B09FDCF6D67BD65655497E9F0E137C707A8BB72A909CB5D02381FBA18A8
3156drvinst.exeC:\Windows\System32\DriverStore\Temp\{41a116a1-1869-1784-32ee-2144fb5ac850}\SET261F.tmpbinary
MD5:D1B767129A5CC2E0B7BBFCA3EB30BBCA
SHA256:3F9CB2FC241AF78F356DF76FC109F0887D81579BFAED9CF87434C3448A199427
3156drvinst.exeC:\Windows\System32\DriverStore\Temp\{41a116a1-1869-1784-32ee-2144fb5ac850}\wintun.sysexecutable
MD5:1046FFA8427BA4E1F1B9ED72063D3CA2
SHA256:229303092402124B521C22D2FB9149A7AFAA4FABAB121FA6DE34AC27430E8E43
3156drvinst.exeC:\Windows\System32\DriverStore\Temp\{41a116a1-1869-1784-32ee-2144fb5ac850}\SET2620.tmpbinary
MD5:0DBD4C3F0F61BD4958D64DD585951A59
SHA256:04721B09FDCF6D67BD65655497E9F0E137C707A8BB72A909CB5D02381FBA18A8
984msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI51B.tmpexecutable
MD5:8F08AFF03FF2E546A696FF12FCF6AC9B
SHA256:DF285FC8553866D2A3379CD831EF8C6A5638F9C081CB73BB2180E702FE3D1B1E
3156drvinst.exeC:\Windows\System32\DriverStore\INFCACHE.1binary
MD5:31816F0C8B98FD4E2B10485D1ACED4EA
SHA256:34A296A423AC4CBC3CB1C84AB794330F5612D30F58D8A6F8DAB7CC89A6547044
3156drvinst.exeC:\Windows\System32\DriverStore\INFCACHE.2binary
MD5:ABB638661D737D9457D78D28C4145066
SHA256:7602F549ABBAC7DE5CD8125329869D02A0C82AA8C9AAF78011162175AA319261
3096drvinst.exeC:\Windows\System32\DriverStore\Temp\{19024862-3f96-7489-5cf2-1248bbfe0d5c}\SET3794.tmpbinary
MD5:A00612A10E7AA4AFD6B2A15B1E4C5028
SHA256:9D5C0548DE3C0F785A88FB1BDB220665F463DC9714D35B6285DCD79D6D72A9BE
3156drvinst.exeC:\Windows\System32\DriverStore\OLDCACHE.000binary
MD5:ABB638661D737D9457D78D28C4145066
SHA256:7602F549ABBAC7DE5CD8125329869D02A0C82AA8C9AAF78011162175AA319261
3096drvinst.exeC:\Windows\System32\DriverStore\Temp\{19024862-3f96-7489-5cf2-1248bbfe0d5c}\SET37A5.tmpbinary
MD5:A25E93E90B79430155D97EE38D54979E
SHA256:2BDBA7B2ED13D9DFE10FDE74B5F2012D1B50C7173FFB21F487054E978162AE6C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
34
TCP/UDP connections
125
DNS requests
191
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
924
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
text
90 b
unknown
924
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
text
8 b
unknown
924
firefox.exe
POST
200
142.250.186.35:80
http://ocsp.pki.goog/gts1c3
unknown
binary
472 b
unknown
924
firefox.exe
POST
200
184.24.77.58:80
http://r3.o.lencr.org/
unknown
binary
503 b
unknown
924
firefox.exe
POST
200
184.24.77.58:80
http://r3.o.lencr.org/
unknown
binary
503 b
unknown
924
firefox.exe
POST
200
142.250.186.35:80
http://ocsp.pki.goog/gts1c3
unknown
binary
472 b
unknown
924
firefox.exe
POST
200
18.245.65.219:80
http://ocsp.r2m02.amazontrust.com/
unknown
binary
471 b
unknown
924
firefox.exe
POST
200
184.24.77.58:80
http://r3.o.lencr.org/
unknown
binary
503 b
unknown
924
firefox.exe
POST
200
184.24.77.58:80
http://r3.o.lencr.org/
unknown
binary
503 b
unknown
924
firefox.exe
POST
200
184.24.77.58:80
http://r3.o.lencr.org/
unknown
binary
503 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
924
firefox.exe
142.250.185.74:443
safebrowsing.googleapis.com
—
—
whitelisted
924
firefox.exe
34.107.221.82:80
detectportal.firefox.com
GOOGLE
US
whitelisted
924
firefox.exe
34.117.237.239:443
contile.services.mozilla.com
GOOGLE-CLOUD-PLATFORM
US
unknown
924
firefox.exe
34.107.243.93:443
push.services.mozilla.com
GOOGLE
US
unknown
924
firefox.exe
44.213.46.170:443
spocs.getpocket.com
AMAZON-AES
US
unknown
924
firefox.exe
142.250.186.35:80
ocsp.pki.goog
GOOGLE
US
whitelisted
924
firefox.exe
184.24.77.54:80
r3.o.lencr.org
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
detectportal.firefox.com
  • 34.107.221.82
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
example.org
  • 93.184.216.34
whitelisted
ipv4only.arpa
  • 192.0.0.170
  • 192.0.0.171
whitelisted
contile.services.mozilla.com
  • 34.117.237.239
whitelisted
spocs.getpocket.com
  • 44.213.46.170
  • 23.22.93.200
  • 3.215.146.197
  • 44.219.163.204
  • 3.212.217.125
  • 52.6.81.16
  • 3.216.15.175
  • 52.72.126.31
shared
proxyserverecs-1736642167.us-east-1.elb.amazonaws.com
  • 44.213.46.170
  • 23.22.93.200
  • 3.215.146.197
  • 44.219.163.204
  • 3.212.217.125
  • 52.6.81.16
  • 3.216.15.175
  • 52.72.126.31
shared
firefox.settings.services.mozilla.com
  • 34.149.100.209
whitelisted
prod.remote-settings.prod.webservices.mozgcp.net
  • 34.149.100.209
whitelisted
r3.o.lencr.org
  • 184.24.77.58
  • 184.24.77.52
  • 184.24.77.71
  • 184.24.77.76
  • 184.24.77.79
  • 184.24.77.51
  • 184.24.77.54
  • 184.24.77.77
  • 184.24.77.83
  • 184.24.77.81
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/community/releases/OpenVPN-2.6.8-I001-x86.msi