File name:

setup-stub.exe

Full analysis: https://app.any.run/tasks/4412b67c-5779-4435-80d9-b4fff5b3c18c
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: August 17, 2024, 02:34:25
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
upx
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

32B1AED8CDA8677B31C3CEC33B982462

SHA1:

5966299D342E5C0A123551C49F97324494CD48EA

SHA256:

D7840EEA40A5A88AF824F24473E95D0227E69C4439D6EA791D50CB94BF0CFB2A

SSDEEP:

12288:dZFBd4EPX1RLRk9Rn3wM3oTnyUUUUUUUtUUUUUUUAkYEt51:dfz4EPfLRk9Rn3w/yUUUUUUUtUUUUUUg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • setup-stub.exe (PID: 6420)

    • Registers / Runs the DLL via REGSVR32.EXE

      • setup.exe (PID: 2212)

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • setup-stub.exe (PID: 6336)
      • setup-stub.exe (PID: 6420)
      • download.exe (PID: 6548)
      • setup.exe (PID: 2212)
      • maintenanceservice_installer.exe (PID: 7080)
      • maintenanceservice_tmp.exe (PID: 6536)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • setup-stub.exe (PID: 6336)
      • setup-stub.exe (PID: 6420)
      • setup.exe (PID: 2212)
      • maintenanceservice_installer.exe (PID: 7080)

    • Executable content was dropped or overwritten

      • setup-stub.exe (PID: 6336)
      • setup-stub.exe (PID: 6420)
      • download.exe (PID: 6548)
      • setup.exe (PID: 2212)
      • maintenanceservice_tmp.exe (PID: 6536)
      • maintenanceservice_installer.exe (PID: 7080)

    • Reads security settings of Internet Explorer

      • setup-stub.exe (PID: 6336)
      • setup-stub.exe (PID: 6420)
      • setup.exe (PID: 2212)
      • maintenanceservice_installer.exe (PID: 7080)

    • The process creates files with name similar to system file names

      • setup-stub.exe (PID: 6336)
      • setup-stub.exe (PID: 6420)
      • setup.exe (PID: 2212)
      • maintenanceservice_installer.exe (PID: 7080)

    • Application launched itself

      • setup-stub.exe (PID: 6336)

    • Reads the date of Windows installation

      • setup-stub.exe (PID: 6336)

    • Checks Windows Trust Settings

      • setup-stub.exe (PID: 6420)

    • Reads Microsoft Outlook installation path

      • setup-stub.exe (PID: 6420)

    • Reads Internet Explorer settings

      • setup-stub.exe (PID: 6420)

    • The process drops C-runtime libraries

      • download.exe (PID: 6548)
      • setup.exe (PID: 2212)

    • The process drops Mozilla's DLL files

      • download.exe (PID: 6548)
      • setup.exe (PID: 2212)

    • Process drops legitimate windows executable

      • setup.exe (PID: 2212)
      • download.exe (PID: 6548)

    • Searches for installed software

      • setup.exe (PID: 2212)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 1048)

    • Loads DLL from Mozilla Firefox

      • regsvr32.exe (PID: 1048)
      • default-browser-agent.exe (PID: 5976)

    • Creates a software uninstall entry

      • setup.exe (PID: 2212)
      • maintenanceservice_installer.exe (PID: 7080)

  • INFO

    • Reads the computer name

      • setup-stub.exe (PID: 6336)
      • setup-stub.exe (PID: 6420)
      • setup.exe (PID: 2212)
      • maintenanceservice_installer.exe (PID: 7080)
      • maintenanceservice_tmp.exe (PID: 6536)

    • Process checks whether UAC notifications are on

      • setup-stub.exe (PID: 6336)

    • Checks supported languages

      • setup-stub.exe (PID: 6336)
      • setup-stub.exe (PID: 6420)
      • download.exe (PID: 6548)
      • maintenanceservice_installer.exe (PID: 7080)
      • setup.exe (PID: 2212)
      • maintenanceservice_tmp.exe (PID: 6536)
      • default-browser-agent.exe (PID: 5976)

    • Create files in a temporary directory

      • setup-stub.exe (PID: 6336)
      • setup-stub.exe (PID: 6420)
      • download.exe (PID: 6548)
      • setup.exe (PID: 2212)
      • maintenanceservice_installer.exe (PID: 7080)

    • Process checks computer location settings

      • setup-stub.exe (PID: 6336)

    • Creates files in the program directory

      • setup-stub.exe (PID: 6420)
      • setup.exe (PID: 2212)
      • maintenanceservice_installer.exe (PID: 7080)

    • Checks proxy server information

      • setup-stub.exe (PID: 6420)

    • Reads the software policy settings

      • setup-stub.exe (PID: 6420)

    • Process checks Internet Explorer phishing filters

      • setup-stub.exe (PID: 6420)

    • Creates files or folders in the user directory

      • setup-stub.exe (PID: 6420)

    • Reads the machine GUID from the registry

      • setup-stub.exe (PID: 6420)
      • setup.exe (PID: 2212)

    • Application launched itself

      • firefox.exe (PID: 2396)
      • firefox.exe (PID: 3272)
      • firefox.exe (PID: 5624)
      • firefox.exe (PID: 1432)

    • UPX packer has been detected

      • download.exe (PID: 6548)

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 1432)

    • Reads Microsoft Office registry keys

      • firefox.exe (PID: 1432)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:12:11 21:50:55+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26112
InitializedDataSize: 186368
UninitializedDataSize: 2048
EntryPoint: 0x3334
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Mozilla Corporation
FileDescription: Firefox Installer
FileVersion: 93
LegalCopyright: Mozilla Corporation
LegalTrademarks: Firefox is a Trademark of The Mozilla Foundation.
OriginalFileName: setup-stub.exe
ProductName: Firefox
ProductVersion: 93
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
160
Monitored processes
24
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start setup-stub.exe setup-stub.exe THREAT download.exe setup.exe regsvr32.exe no specs maintenanceservice_installer.exe maintenanceservice_tmp.exe default-browser-agent.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1048"C:\WINDOWS\system32\regsvr32.exe" /s "C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll"C:\Windows\System32\regsvr32.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1432"C:\Program Files\Mozilla Firefox\firefox.exe" -reset-profile -migration -first-startupC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
127.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
1488"C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask defaultagent register-task 308046B0AF4A39CBC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
127.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
1716"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4508 -childID 4 -isForBrowser -prefsHandle 4396 -prefMapHandle 3800 -prefsLen 24068 -prefMapSize 249122 -jsInitHandle 1340 -jsInitLen 234488 -parentBuildID 20240606181944 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5240ee27-5afe-491c-a2de-926ed930142d} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
127.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
2212.\setup.exe /LaunchedFromStub /INI=C:\Users\admin\AppData\Local\Temp\nsv565A.tmp\config.iniC:\Users\admin\AppData\Local\Temp\7zS49956B7F\setup.exe
download.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
HIGH
Description:
Firefox Installer
Exit code:
0
Version:
127.0
Modules
Images
c:\users\admin\appdata\local\temp\7zs49956b7f\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
2396"C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask defaultagent register-task 308046B0AF4A39CBC:\Program Files\Mozilla Firefox\firefox.exe—default-browser-agent.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
HIGH
Description:
Firefox
Exit code:
0
Version:
127.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\program files\mozilla firefox\vcruntime140.dll
c:\program files\mozilla firefox\vcruntime140_1.dll
c:\program files\mozilla firefox\msvcp140.dll
3104"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4144 -parentBuildID 20240606181944 -prefsHandle 4140 -prefMapHandle 4136 -prefsLen 24521 -prefMapSize 249122 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6e05b4c-ba88-456b-aa1f-56470ce47c72} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" rddC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
127.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
3272"C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask installC:\Program Files\Mozilla Firefox\firefox.exe—setup.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
HIGH
Description:
Firefox
Exit code:
0
Version:
127.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140_1.dll
c:\program files\mozilla firefox\vcruntime140.dll
3360"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4336 -parentBuildID 20240606181944 -sandboxingKind 0 -prefsHandle 5404 -prefMapHandle 5168 -prefsLen 32441 -prefMapSize 249122 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {17434233-cc03-4e7a-950c-127819405c5a} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" utilityC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
127.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
5144"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2192 -parentBuildID 20240606181944 -prefsHandle 2184 -prefMapHandle 2152 -prefsLen 20688 -prefMapSize 249122 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9608bb1-e599-4ae5-8cf6-508c4bee44bd} 1432 "\\.\pipe\gecko-crash-server-pipe.1432" socketC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
127.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
Total events
36 483
Read events
36 308
Write events
137
Delete events
38

Modification events

(PID) Process:(6420) setup-stub.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla
Operation:writeName:FirefoxInstallerTest
Value:
Write Test
(PID) Process:(6420) setup-stub.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\TaskBarIDs
Operation:writeName:C:\Program Files\Mozilla Firefox
Value:
308046B0AF4A39CB
(PID) Process:(6420) setup-stub.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6420) setup-stub.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6420) setup-stub.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6420) setup-stub.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6420) setup-stub.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6420) setup-stub.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6420) setup-stub.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6420) setup-stub.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\LowRegistry
Operation:delete valueName:AddToFavoritesInitialSelection
Value:
Executable files
95
Suspicious files
311
Text files
155
Unknown types
10

Dropped files

PID
Process
Filename
Type
6420setup-stub.exeC:\Users\admin\AppData\Local\Temp\nsv565A.tmp\stub_common.jstext
MD5:58B8AC894C64370CFA137F5848AEB88D
SHA256:0E28AA770B0AFADE30BE85C6DC1E50344DB8F8CDD3FA01989D81A9E20A4990BD
6336setup-stub.exeC:\Users\admin\AppData\Local\Temp\nsu539B.tmp\UAC.dllexecutable
MD5:113C5F02686D865BC9E8332350274FD1
SHA256:0D21041A1B5CD9F9968FC1D457C78A802C9C5A23F375327E833501B65BCD095D
6336setup-stub.exeC:\Users\admin\AppData\Local\Temp\nsu539B.tmp\System.dllexecutable
MD5:17ED1C86BD67E78ADE4712BE48A7D2BD
SHA256:BD046E6497B304E4EA4AB102CAB2B1F94CE09BDE0EEBBA4C59942A732679E4EB
6420setup-stub.exeC:\Users\admin\AppData\Local\Temp\nsv565A.tmp\UserInfo.dllexecutable
MD5:1B446B36F5B4022D50FFDC0CF567B24A
SHA256:2862C7BC7F11715CEBDEA003564A0D70BF42B73451E2B672110E1392EC392922
6420setup-stub.exeC:\Users\admin\AppData\Local\Temp\nsv565A.tmp\UAC.dllexecutable
MD5:113C5F02686D865BC9E8332350274FD1
SHA256:0D21041A1B5CD9F9968FC1D457C78A802C9C5A23F375327E833501B65BCD095D
6420setup-stub.exeC:\Users\admin\AppData\Local\Temp\nsv565A.tmp\System.dllexecutable
MD5:17ED1C86BD67E78ADE4712BE48A7D2BD
SHA256:BD046E6497B304E4EA4AB102CAB2B1F94CE09BDE0EEBBA4C59942A732679E4EB
6420setup-stub.exeC:\Users\admin\AppData\Local\Temp\nsv565A.tmp\bgstub.jpgimage
MD5:C55F15CEEDC724D6C6E15D1DAF96B698
SHA256:4B7E441D51B790EE1C0BAFF19E4E968392A937877DFA8B84E74464F5BA7A4CF4
6420setup-stub.exeC:\Users\admin\AppData\Local\Temp\nsv565A.tmp\CityHash.dllexecutable
MD5:737379945745BB94F8A0DADCC18CAD8D
SHA256:D3D7B3D7A7941D66C7F75257BE90B12AC76F787AF42CD58F019CE0280972598A
6420setup-stub.exeC:\Users\admin\AppData\Local\Temp\nsv565A.tmp\firefox_versions.jsonbinary
MD5:40FF03630FB3867E7A50B9D66AA3D0DA
SHA256:32ECAEC833630594F294C13088DC310BD1345680FC78F66AB177C1063F248E77
6420setup-stub.exeC:\Users\admin\AppData\Local\Temp\nsv565A.tmp\stub_common.csstext
MD5:544B51F11AD19DF720669478D28F129D
SHA256:4D9495B6F0E18331659993B79440E414A6E607FCDAEACBC7477E0683CC0FA98B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
42
TCP/UDP connections
114
DNS requests
135
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6420
setup-stub.exe
GET
200
18.66.190.71:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D
unknown
—
—
unknown
6420
setup-stub.exe
GET
200
18.245.65.219:80
http://ocsp.r2m02.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRmbQtwnInkvkvr7BNFR%2BS2lTYPjAQUwDFSzVpQw4J8dHHOy%2Bmc%2BXrrguICEAXVFUBq6U8CpUqkq09CsLI%3D
unknown
—
—
whitelisted
6420
setup-stub.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAo1CNVcKSsBffitZcAP9%2BQ%3D
unknown
—
—
whitelisted
6420
setup-stub.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAMS6Jl19zCc5X6GAIL92CA%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6420
setup-stub.exe
GET
200
23.53.40.122:80
http://r10.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgSxtvjzHeEX3sZcIa3T%2Bok6Ew%3D%3D
unknown
—
—
whitelisted
5924
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5924
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7004
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
7048
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4088
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2400
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6420
setup-stub.exe
18.66.192.67:443
product-details.mozilla.org
AMAZON-02
US
unknown
6420
setup-stub.exe
18.66.190.71:80
ocsp.rootca1.amazontrust.com
AMAZON-02
US
unknown
6420
setup-stub.exe
18.245.65.219:80
ocsp.r2m02.amazontrust.com
—
US
unknown
4088
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6420
setup-stub.exe
54.172.104.88:443
download.mozilla.org
AMAZON-AES
US
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.78
whitelisted
product-details.mozilla.org
  • 18.66.192.67
  • 18.66.192.55
  • 18.66.192.13
  • 18.66.192.121
shared
ocsp.rootca1.amazontrust.com
  • 18.66.190.71
shared
ocsp.r2m02.amazontrust.com
  • 18.245.65.219
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
  • 4.231.128.59
whitelisted
download.mozilla.org
  • 54.172.104.88
  • 54.221.209.190
  • 35.168.202.216
whitelisted
www.bing.com
  • 2.16.110.121
  • 2.23.209.182
  • 2.23.209.130
  • 2.23.209.187
  • 2.23.209.133
  • 2.23.209.149
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.160.20
  • 20.190.160.22
  • 20.190.160.14
  • 40.126.32.74
  • 40.126.32.136
  • 40.126.32.68
  • 40.126.32.134
  • 40.126.32.133
whitelisted
download-installer.cdn.mozilla.net
  • 34.117.35.28
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
setup-stub.exe