File name:

DCSB_4.0.0.9.exe

Full analysis: https://app.any.run/tasks/71572480-646d-426b-8b2b-c5235b48022b
Verdict: Malicious activity
Analysis date: January 11, 2025, 00:06:15
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
obfuscated-js
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

08249B3F3D1623717D28E072094CCAD9

SHA1:

58E0E645E96B2D7D7F2B5F78DFE51DAF035510CC

SHA256:

D39DB773D0D16D73E170E4F7A0C5FE2EBE4C93AB605A36F52FF3FB2D0F4B7104

SSDEEP:

24576:YyuyCQHKa7Qo2OY470pg04SlZz+Uic8/g3WwpqpCdCTGuZhK2OLDdg:1jCWKa7Qo2OY470pg04SlZz+Uic8/g3g

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • reg.exe (PID: 7876)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • DCSB_4.0.0.9.exe (PID: 6428)

    • Executable content was dropped or overwritten

      • DCSB_4.0.0.9.exe (PID: 6428)

    • The process creates files with name similar to system file names

      • DCSB_4.0.0.9.exe (PID: 6428)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • DCSB_4.0.0.9.exe (PID: 6428)

    • Reads security settings of Internet Explorer

      • DCSB.exe (PID: 6984)
      • Skype.exe (PID: 7648)

    • Creates a software uninstall entry

      • DCSB_4.0.0.9.exe (PID: 6428)

    • Uses REG/REGEDIT.EXE to modify registry

      • Skype.exe (PID: 7648)

    • Application launched itself

      • Skype.exe (PID: 7648)

    • Detected use of alternative data streams (AltDS)

      • Skype.exe (PID: 7648)

  • INFO

    • Checks supported languages

      • DCSB_4.0.0.9.exe (PID: 6428)
      • DCSB.exe (PID: 6984)
      • Skype.exe (PID: 7648)
      • Skype.exe (PID: 7988)
      • Skype.exe (PID: 7548)

    • Creates files in the program directory

      • DCSB_4.0.0.9.exe (PID: 6428)
      • DCSB.exe (PID: 6984)

    • Create files in a temporary directory

      • DCSB_4.0.0.9.exe (PID: 6428)

    • Reads the computer name

      • DCSB_4.0.0.9.exe (PID: 6428)
      • DCSB.exe (PID: 6984)
      • Skype.exe (PID: 7648)

    • Reads the machine GUID from the registry

      • DCSB.exe (PID: 6984)
      • Skype.exe (PID: 7648)

    • Disables trace logs

      • DCSB.exe (PID: 6984)

    • Checks proxy server information

      • DCSB.exe (PID: 6984)
      • Skype.exe (PID: 7648)

    • Manual execution by a user

      • firefox.exe (PID: 6452)

    • Reads the software policy settings

      • DCSB.exe (PID: 6984)
      • Skype.exe (PID: 7648)

    • Application launched itself

      • firefox.exe (PID: 6452)
      • firefox.exe (PID: 1224)

    • Reads CPU info

      • Skype.exe (PID: 7648)

    • Process checks computer location settings

      • Skype.exe (PID: 7648)
      • Skype.exe (PID: 7988)
      • Skype.exe (PID: 7548)

    • Creates files or folders in the user directory

      • Skype.exe (PID: 7648)
      • Skype.exe (PID: 7988)
      • Skype.exe (PID: 7868)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:12:16 00:50:56+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 25600
InitializedDataSize: 162816
UninitializedDataSize: 1024
EntryPoint: 0x326b
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
168
Monitored processes
39
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start dcsb_4.0.0.9.exe dcsb.exe firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs openwith.exe no specs skype.exe skype.exe no specs skype.exe no specs skype.exe reg.exe conhost.exe no specs skype.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs skype.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs dcsb_4.0.0.9.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
520"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1900 -parentBuildID 20240213221259 -prefsHandle 1840 -prefMapHandle 1836 -prefsLen 31031 -prefMapSize 244583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {507ece9b-9e4b-43b6-8d63-36cb21f3e3b5} 1224 "\\.\pipe\gecko-crash-server-pipe.1224" 22a516eab10 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\vcruntime140_1.dll
540C:\WINDOWS\system32\reg.exe QUERY HKCU\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice /v ProgIdC:\Windows\SysWOW64\reg.exe—Skype.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1224"C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
1580"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5712 -childID 7 -isForBrowser -prefsHandle 5804 -prefMapHandle 5796 -prefsLen 31285 -prefMapSize 244583 -jsInitHandle 1540 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b4be22f-2af6-421f-9546-0dd2f54ff5ce} 1224 "\\.\pipe\gecko-crash-server-pipe.1224" 22a5ce244d0 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
1732"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4128 -parentBuildID 20240213221259 -sandboxingKind 1 -prefsHandle 4320 -prefMapHandle 5484 -prefsLen 38980 -prefMapSize 244583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8fca275e-4832-4428-aa96-1abd84d24115} 1224 "\\.\pipe\gecko-crash-server-pipe.1224" 22a5c2d1310 utilityC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
3144"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2060 -parentBuildID 20240213221259 -prefsHandle 2152 -prefMapHandle 2148 -prefsLen 31031 -prefMapSize 244583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {514ea78b-5fc5-4e3f-b4e9-97672c3b3391} 1224 "\\.\pipe\gecko-crash-server-pipe.1224" 22a44680710 socketC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
3812"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6124 -childID 8 -isForBrowser -prefsHandle 5072 -prefMapHandle 5932 -prefsLen 32150 -prefMapSize 244583 -jsInitHandle 1540 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {639c0d49-c780-4488-94f6-59cd678bbba2} 1224 "\\.\pipe\gecko-crash-server-pipe.1224" 22a54d79d90 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
4388"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2784 -childID 1 -isForBrowser -prefsHandle 2720 -prefMapHandle 2800 -prefsLen 31447 -prefMapSize 244583 -jsInitHandle 1540 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {50ad8594-476f-4e27-9283-b0851ce9cdaf} 1224 "\\.\pipe\gecko-crash-server-pipe.1224" 22a5623af50 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
4592"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2276 -parentBuildID 20240213221259 -prefsHandle 3972 -prefMapHandle 5328 -prefsLen 38980 -prefMapSize 244583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {11a94cdf-135e-4463-9785-56e3bd26247b} 1224 "\\.\pipe\gecko-crash-server-pipe.1224" 22a5aac3c10 rddC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
4628\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—reg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
23 341
Read events
23 291
Write events
32
Delete events
18

Modification events

(PID) Process:(6428) DCSB_4.0.0.9.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DCSB
Operation:writeName:DisplayName
Value:
Deathcounter and Soundboard
(PID) Process:(6428) DCSB_4.0.0.9.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DCSB
Operation:writeName:UninstallString
Value:
"C:\Program Files (x86)\Deathcounter and Soundboard\uninstall.exe"
(PID) Process:(6428) DCSB_4.0.0.9.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DCSB
Operation:writeName:QuietUninstallString
Value:
"C:\Program Files (x86)\Deathcounter and Soundboard\uninstall.exe" /S
(PID) Process:(6428) DCSB_4.0.0.9.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DCSB
Operation:writeName:Publisher
Value:
Kalejin
(PID) Process:(6428) DCSB_4.0.0.9.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DCSB
Operation:writeName:DisplayVersion
Value:
4.0.0.9
(PID) Process:(6428) DCSB_4.0.0.9.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DCSB
Operation:writeName:DisplayIcon
Value:
C:\Program Files (x86)\Deathcounter and Soundboard\DCSB.exe
(PID) Process:(6428) DCSB_4.0.0.9.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DCSB
Operation:writeName:EstimatedSize
Value:
1697
(PID) Process:(6428) DCSB_4.0.0.9.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\DCSB
Operation:writeName:InstallLocation
Value:
"C:\Program Files (x86)\Deathcounter and Soundboard"
(PID) Process:(6984) DCSB.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DCSB_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6984) DCSB.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DCSB_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
24
Suspicious files
193
Text files
40
Unknown types
0

Dropped files

PID
Process
Filename
Type
6428DCSB_4.0.0.9.exeC:\Users\admin\AppData\Local\Temp\nsf56FE.tmp\InstallOptions.dllexecutable
MD5:5D425526856CBDB7B14C75DF417B6EF3
SHA256:AAACC7EF5CB2BAF2338AC8E8479227E0A6336A6509119543680EFA1DCDBAE6A6
6428DCSB_4.0.0.9.exeC:\Users\admin\AppData\Local\Temp\nsf56FE.tmp\ioSpecial.initext
MD5:E2D5070BC28DB1AC745613689FF86067
SHA256:D95AED234F932A1C48A2B1B0D98C60CA31F962310C03158E2884AB4DDD3EA1E0
6428DCSB_4.0.0.9.exeC:\Program Files (x86)\Deathcounter and Soundboard\GalaSoft.MvvmLight.Platform.dllexecutable
MD5:5B958B4229538AC23099CE9ED6F37DE4
SHA256:2A1114C99533AAE7442B298336247350B55CAA193C06454EA606D6A394656573
6428DCSB_4.0.0.9.exeC:\Program Files (x86)\Deathcounter and Soundboard\DCSB.exeexecutable
MD5:2C3FE3D9FC757E2BEF7A9A6867EB0431
SHA256:ED036B3773EBA9BFDA7C9C7CE55F5495FDC3CAF57F8CE72A56820EDC98FF39EA
6428DCSB_4.0.0.9.exeC:\Program Files (x86)\Deathcounter and Soundboard\DCSB.Business.dllexecutable
MD5:E2B07011A7086D487A8839BB324422F2
SHA256:E823A85AE706240167A75BDAE6D025B388FAD7E1F835CFDB330F01CDDAB058CE
6428DCSB_4.0.0.9.exeC:\Users\admin\AppData\Local\Temp\nsf56FE.tmp\modern-wizard.bmpimage
MD5:CBE40FD2B1EC96DAEDC65DA172D90022
SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
6428DCSB_4.0.0.9.exeC:\Program Files (x86)\Deathcounter and Soundboard\GalaSoft.MvvmLight.Extras.dllexecutable
MD5:810E42E2BBFB536BDC01ABF882A24938
SHA256:CB4D844434A8FFBD33531470E094524BE27B88CA42B2C2197492BBE8246EA1BB
6428DCSB_4.0.0.9.exeC:\Program Files (x86)\Deathcounter and Soundboard\uninstall.exeexecutable
MD5:90900A4C8850CB765C00D1A8B0BA4CE2
SHA256:BB65474C574300F34E8B505CA8EAFC7C1A3EA92CC2C6175686EE7A3F637ED45C
6428DCSB_4.0.0.9.exeC:\Program Files (x86)\Deathcounter and Soundboard\DCSB.Icons.dllexecutable
MD5:6310704D43D121C3ACBD5281F4716BE0
SHA256:445337C0768DF9D2EB5408EEDEC739C66E67CFFA261775F4478CFFABEA832D35
6428DCSB_4.0.0.9.exeC:\Program Files (x86)\Deathcounter and Soundboard\DCSB.SoundPlayer.dllexecutable
MD5:5C624D955270CF4C6BF8A7E376065271
SHA256:E2F8766931F4C81B59B79990720ED11C52B42AFBB19DB9DD4A957AD33D84DFCC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
62
TCP/UDP connections
161
DNS requests
188
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1224
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
1224
firefox.exe
POST
200
184.24.77.48:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
1224
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
1224
firefox.exe
POST
200
142.250.185.67:80
http://o.pki.goog/s/wr3/jLM
unknown
—
—
whitelisted
1224
firefox.exe
POST
200
184.24.77.48:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
1224
firefox.exe
POST
200
184.24.77.48:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
92.123.104.31:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1176
svchost.exe
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1076
svchost.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 2.23.246.101
whitelisted
google.com
  • 142.250.185.206
whitelisted
www.bing.com
  • 92.123.104.31
  • 92.123.104.38
  • 92.123.104.34
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.160.20
  • 40.126.32.133
  • 40.126.32.72
  • 20.190.160.17
  • 40.126.32.136
  • 40.126.32.138
  • 40.126.32.134
  • 40.126.32.76
  • 40.126.31.73
  • 40.126.31.71
  • 40.126.31.69
  • 20.190.159.71
  • 20.190.159.4
  • 20.190.159.68
  • 20.190.159.73
  • 20.190.159.75
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
api.github.com
  • 140.82.121.6
whitelisted
detectportal.firefox.com
  • 34.107.221.82
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DCSB_4.0.0.9.exe