File name:

DCSB_4.0.0.9.exe

Full analysis: https://app.any.run/tasks/71572480-646d-426b-8b2b-c5235b48022b
Verdict: Malicious activity
Analysis date: January 11, 2025, 00:06:15
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
obfuscated-js
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

08249B3F3D1623717D28E072094CCAD9

SHA1:

58E0E645E96B2D7D7F2B5F78DFE51DAF035510CC

SHA256:

D39DB773D0D16D73E170E4F7A0C5FE2EBE4C93AB605A36F52FF3FB2D0F4B7104

SSDEEP:

24576:YyuyCQHKa7Qo2OY470pg04SlZz+Uic8/g3WwpqpCdCTGuZhK2OLDdg:1jCWKa7Qo2OY470pg04SlZz+Uic8/g3g

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • reg.exe (PID: 7876)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • DCSB_4.0.0.9.exe (PID: 6428)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • DCSB_4.0.0.9.exe (PID: 6428)

    • Process drops legitimate windows executable

      • DCSB_4.0.0.9.exe (PID: 6428)

    • The process creates files with name similar to system file names

      • DCSB_4.0.0.9.exe (PID: 6428)

    • Creates a software uninstall entry

      • DCSB_4.0.0.9.exe (PID: 6428)

    • Reads security settings of Internet Explorer

      • DCSB.exe (PID: 6984)
      • Skype.exe (PID: 7648)

    • Application launched itself

      • Skype.exe (PID: 7648)

    • Uses REG/REGEDIT.EXE to modify registry

      • Skype.exe (PID: 7648)

    • Detected use of alternative data streams (AltDS)

      • Skype.exe (PID: 7648)

  • INFO

    • Checks supported languages

      • DCSB_4.0.0.9.exe (PID: 6428)
      • DCSB.exe (PID: 6984)
      • Skype.exe (PID: 7988)
      • Skype.exe (PID: 7548)
      • Skype.exe (PID: 7648)

    • Creates files in the program directory

      • DCSB_4.0.0.9.exe (PID: 6428)
      • DCSB.exe (PID: 6984)

    • Reads the computer name

      • DCSB_4.0.0.9.exe (PID: 6428)
      • DCSB.exe (PID: 6984)
      • Skype.exe (PID: 7648)

    • Create files in a temporary directory

      • DCSB_4.0.0.9.exe (PID: 6428)

    • Reads the machine GUID from the registry

      • DCSB.exe (PID: 6984)
      • Skype.exe (PID: 7648)

    • Disables trace logs

      • DCSB.exe (PID: 6984)

    • Checks proxy server information

      • DCSB.exe (PID: 6984)
      • Skype.exe (PID: 7648)

    • Reads the software policy settings

      • DCSB.exe (PID: 6984)
      • Skype.exe (PID: 7648)

    • Application launched itself

      • firefox.exe (PID: 6452)
      • firefox.exe (PID: 1224)

    • Manual execution by a user

      • firefox.exe (PID: 6452)

    • Creates files or folders in the user directory

      • Skype.exe (PID: 7648)
      • Skype.exe (PID: 7988)
      • Skype.exe (PID: 7868)

    • Reads CPU info

      • Skype.exe (PID: 7648)

    • Process checks computer location settings

      • Skype.exe (PID: 7648)
      • Skype.exe (PID: 7988)
      • Skype.exe (PID: 7548)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:12:16 00:50:56+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 25600
InitializedDataSize: 162816
UninitializedDataSize: 1024
EntryPoint: 0x326b
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
168
Monitored processes
39
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start dcsb_4.0.0.9.exe dcsb.exe firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs openwith.exe no specs skype.exe skype.exe no specs skype.exe no specs skype.exe reg.exe conhost.exe no specs skype.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs skype.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs dcsb_4.0.0.9.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
520"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1900 -parentBuildID 20240213221259 -prefsHandle 1840 -prefMapHandle 1836 -prefsLen 31031 -prefMapSize 244583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {507ece9b-9e4b-43b6-8d63-36cb21f3e3b5} 1224 "\\.\pipe\gecko-crash-server-pipe.1224" 22a516eab10 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\vcruntime140_1.dll
540C:\WINDOWS\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice /v ProgIdC:\Windows\SysWOW64\reg.exe—Skype.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1224"C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
1580"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5712 -childID 7 -isForBrowser -prefsHandle 5804 -prefMapHandle 5796 -prefsLen 31285 -prefMapSize 244583 -jsInitHandle 1540 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b4be22f-2af6-421f-9546-0dd2f54ff5ce} 1224 "\\.\pipe\gecko-crash-server-pipe.1224" 22a5ce244d0 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
1732"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4128 -parentBuildID 20240213221259 -sandboxingKind 1 -prefsHandle 4320 -prefMapHandle 5484 -prefsLen 38980 -prefMapSize 244583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8fca275e-4832-4428-aa96-1abd84d24115} 1224 "\\.\pipe\gecko-crash-server-pipe.1224" 22a5c2d1310 utilityC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
3144"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2060 -parentBuildID 20240213221259 -prefsHandle 2152 -prefMapHandle 2148 -prefsLen 31031 -prefMapSize 244583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {514ea78b-5fc5-4e3f-b4e9-97672c3b3391} 1224 "\\.\pipe\gecko-crash-server-pipe.1224" 22a44680710 socketC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
3812"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6124 -childID 8 -isForBrowser -prefsHandle 5072 -prefMapHandle 5932 -prefsLen 32150 -prefMapSize 244583 -jsInitHandle 1540 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {639c0d49-c780-4488-94f6-59cd678bbba2} 1224 "\\.\pipe\gecko-crash-server-pipe.1224" 22a54d79d90 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
4388"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2784 -childID 1 -isForBrowser -prefsHandle 2720 -prefMapHandle 2800 -prefsLen 31447 -prefMapSize 244583 -jsInitHandle 1540 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {50ad8594-476f-4e27-9283-b0851ce9cdaf} 1224 "\\.\pipe\gecko-crash-server-pipe.1224" 22a5623af50 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
4592"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2276 -parentBuildID 20240213221259 -prefsHandle 3972 -prefMapHandle 5328 -prefsLen 38980 -prefMapSize 244583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {11a94cdf-135e-4463-9785-56e3bd26247b} 1224 "\\.\pipe\gecko-crash-server-pipe.1224" 22a5aac3c10 rddC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
4628\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—reg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
23 341
Read events
23 291
Write events
32
Delete events
18

Modification events

(PID) Process:(6428) DCSB_4.0.0.9.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DCSB
Operation:writeName:DisplayName
Value:
Deathcounter and Soundboard
(PID) Process:(6428) DCSB_4.0.0.9.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DCSB
Operation:writeName:UninstallString
Value:
"C:\Program Files (x86)\Deathcounter and Soundboard\uninstall.exe"
(PID) Process:(6428) DCSB_4.0.0.9.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DCSB
Operation:writeName:QuietUninstallString
Value:
"C:\Program Files (x86)\Deathcounter and Soundboard\uninstall.exe" /S
(PID) Process:(6428) DCSB_4.0.0.9.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DCSB
Operation:writeName:Publisher
Value:
Kalejin
(PID) Process:(6428) DCSB_4.0.0.9.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DCSB
Operation:writeName:DisplayVersion
Value:
4.0.0.9
(PID) Process:(6428) DCSB_4.0.0.9.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DCSB
Operation:writeName:DisplayIcon
Value:
C:\Program Files (x86)\Deathcounter and Soundboard\DCSB.exe
(PID) Process:(6428) DCSB_4.0.0.9.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DCSB
Operation:writeName:EstimatedSize
Value:
1697
(PID) Process:(6428) DCSB_4.0.0.9.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\DCSB
Operation:writeName:InstallLocation
Value:
"C:\Program Files (x86)\Deathcounter and Soundboard"
(PID) Process:(6984) DCSB.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DCSB_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6984) DCSB.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DCSB_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
24
Suspicious files
193
Text files
40
Unknown types
0

Dropped files

PID
Process
Filename
Type
6428DCSB_4.0.0.9.exeC:\Users\admin\AppData\Local\Temp\nsf56FE.tmp\ioSpecial.initext
MD5:E2D5070BC28DB1AC745613689FF86067
SHA256:D95AED234F932A1C48A2B1B0D98C60CA31F962310C03158E2884AB4DDD3EA1E0
6428DCSB_4.0.0.9.exeC:\Users\admin\AppData\Local\Temp\nsf56FE.tmp\InstallOptions.dllexecutable
MD5:5D425526856CBDB7B14C75DF417B6EF3
SHA256:AAACC7EF5CB2BAF2338AC8E8479227E0A6336A6509119543680EFA1DCDBAE6A6
6428DCSB_4.0.0.9.exeC:\Program Files (x86)\Deathcounter and Soundboard\DCSB.exeexecutable
MD5:2C3FE3D9FC757E2BEF7A9A6867EB0431
SHA256:ED036B3773EBA9BFDA7C9C7CE55F5495FDC3CAF57F8CE72A56820EDC98FF39EA
6428DCSB_4.0.0.9.exeC:\Program Files (x86)\Deathcounter and Soundboard\DCSB.Interactivity.dllexecutable
MD5:B04E8E7CE5D3B67AFA187F8640091671
SHA256:FACBFA255050A66A2C7CF595CF5D2291CD2B3BF0F4BDA7F4610F269ADECE5219
6428DCSB_4.0.0.9.exeC:\Program Files (x86)\Deathcounter and Soundboard\DCSB.Input.dllexecutable
MD5:FD056420A06D194EEF19BBFC5E611F6C
SHA256:76F66B5ADCCFBBA9C810234331B3FBC08460CBF38FC2B4B357C1E1B342410ADA
6428DCSB_4.0.0.9.exeC:\Program Files (x86)\Deathcounter and Soundboard\DCSB.Controls.dllexecutable
MD5:AB7A0F7402D2158D2346AE67DE463165
SHA256:845438603F97F53A5B70486BA5EB1C26BEDD644F18FD663FB6FF072A8EABB7F5
6428DCSB_4.0.0.9.exeC:\Program Files (x86)\Deathcounter and Soundboard\DCSB.Business.dllexecutable
MD5:E2B07011A7086D487A8839BB324422F2
SHA256:E823A85AE706240167A75BDAE6D025B388FAD7E1F835CFDB330F01CDDAB058CE
6428DCSB_4.0.0.9.exeC:\Program Files (x86)\Deathcounter and Soundboard\DCSB.Converters.dllexecutable
MD5:2D293FF6036F5D766598AA9E9C8527A5
SHA256:251B07D2FE46F625352F2298DF57642E859468AC635B420CA42F68C509D50745
6428DCSB_4.0.0.9.exeC:\Program Files (x86)\Deathcounter and Soundboard\DCSB.Icons.dllexecutable
MD5:6310704D43D121C3ACBD5281F4716BE0
SHA256:445337C0768DF9D2EB5408EEDEC739C66E67CFFA261775F4478CFFABEA832D35
6428DCSB_4.0.0.9.exeC:\Program Files (x86)\Deathcounter and Soundboard\DCSB.Models.dllexecutable
MD5:4789A95AE263346E177D290CABECDFED
SHA256:2F932429A33881C4BCF201E5708871434E8378B8405F870683A079E53390342D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
62
TCP/UDP connections
161
DNS requests
188
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1224
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
1224
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
1224
firefox.exe
POST
200
142.250.185.67:80
http://o.pki.goog/s/wr3/jLM
unknown
—
—
whitelisted
1224
firefox.exe
POST
200
184.24.77.48:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
1224
firefox.exe
POST
200
184.24.77.48:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
1224
firefox.exe
POST
200
184.24.77.48:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
92.123.104.31:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1176
svchost.exe
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1076
svchost.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 2.23.246.101
whitelisted
google.com
  • 142.250.185.206
whitelisted
www.bing.com
  • 92.123.104.31
  • 92.123.104.38
  • 92.123.104.34
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.160.20
  • 40.126.32.133
  • 40.126.32.72
  • 20.190.160.17
  • 40.126.32.136
  • 40.126.32.138
  • 40.126.32.134
  • 40.126.32.76
  • 40.126.31.73
  • 40.126.31.71
  • 40.126.31.69
  • 20.190.159.71
  • 20.190.159.4
  • 20.190.159.68
  • 20.190.159.73
  • 20.190.159.75
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
api.github.com
  • 140.82.121.6
whitelisted
detectportal.firefox.com
  • 34.107.221.82
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
DCSB_4.0.0.9.exe