File name:

goodbyedpi-0.2.3rc1-2.zip

Full analysis: https://app.any.run/tasks/2e1bef9f-7a31-4394-b303-c4d11914c8b8
Verdict: Malicious activity
Analysis date: August 06, 2024, 16:15:48
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

41938D1256F900CDACA626A152BA5E95

SHA1:

DBAFC9A75213D46B19E8FD7A330B87BFD8C0B562

SHA256:

E3FF0DE76A44978EBD02B890F66BE6F3F4320C99F8B443DE1877D4E16A4A5443

SSDEEP:

49152:0AJn6dfL7XeDJmJS57XeLoMd1ZeGdZtQdrK/DFam2pkAUZq+KrqhOe+6wADOE7LU:VN6dfL7uDJp57u0UZN8BKbUTKNts6wA6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 6812)

    • Downloads files via BITSADMIN.EXE

      • cmd.exe (PID: 6192)

  • SUSPICIOUS

    • Drops a system driver (possible attempt to evade defenses)

      • WinRAR.exe (PID: 6812)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 2768)
      • cmd.exe (PID: 8188)
      • cmd.exe (PID: 6360)
      • cmd.exe (PID: 6676)
      • cmd.exe (PID: 7296)

    • Executes as Windows Service

      • goodbyedpi.exe (PID: 6196)
      • goodbyedpi.exe (PID: 6788)
      • goodbyedpi.exe (PID: 7212)

  • INFO

    • Reads the computer name

      • TextInputHost.exe (PID: 300)
      • goodbyedpi.exe (PID: 6408)
      • goodbyedpi.exe (PID: 1132)
      • goodbyedpi.exe (PID: 6172)
      • goodbyedpi.exe (PID: 6196)
      • goodbyedpi.exe (PID: 7212)
      • goodbyedpi.exe (PID: 6788)

    • Manual execution by a user

      • cmd.exe (PID: 6192)
      • cmd.exe (PID: 4168)
      • goodbyedpi.exe (PID: 6172)
      • cmd.exe (PID: 3720)
      • firefox.exe (PID: 7156)
      • firefox.exe (PID: 240)
      • cmd.exe (PID: 7296)
      • cmd.exe (PID: 2768)
      • cmd.exe (PID: 8188)
      • goodbyedpi.exe (PID: 4996)
      • cmd.exe (PID: 6360)
      • firefox.exe (PID: 2044)
      • cmd.exe (PID: 6676)

    • Reads the machine GUID from the registry

      • goodbyedpi.exe (PID: 1132)
      • goodbyedpi.exe (PID: 6408)
      • goodbyedpi.exe (PID: 6172)
      • goodbyedpi.exe (PID: 6196)
      • goodbyedpi.exe (PID: 6788)
      • goodbyedpi.exe (PID: 7212)

    • Checks supported languages

      • TextInputHost.exe (PID: 300)
      • goodbyedpi.exe (PID: 1132)
      • goodbyedpi.exe (PID: 6408)
      • goodbyedpi.exe (PID: 6172)
      • goodbyedpi.exe (PID: 6196)
      • goodbyedpi.exe (PID: 6788)
      • goodbyedpi.exe (PID: 7212)

    • Application launched itself

      • firefox.exe (PID: 1104)
      • firefox.exe (PID: 7156)
      • firefox.exe (PID: 2872)
      • firefox.exe (PID: 240)
      • firefox.exe (PID: 7072)
      • firefox.exe (PID: 2044)

    • Reads Microsoft Office registry keys

      • firefox.exe (PID: 1104)
      • firefox.exe (PID: 2872)
      • firefox.exe (PID: 7072)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6812)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2024:08:01 09:33:12
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: goodbyedpi-0.2.3rc1/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
241
Monitored processes
106
Malicious processes
4
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe textinputhost.exe no specs rundll32.exe no specs cmd.exe no specs conhost.exe no specs bitsadmin.exe no specs cmd.exe no specs conhost.exe no specs goodbyedpi.exe no specs goodbyedpi.exe no specs goodbyedpi.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs goodbyedpi.exe no specs goodbyedpi.exe no specs goodbyedpi.exe conhost.exe no specs goodbyedpi.exe no specs goodbyedpi.exe conhost.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs cmd.exe conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs goodbyedpi.exe no specs cmd.exe conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs goodbyedpi.exe no specs cmd.exe conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs goodbyedpi.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs cmd.exe conhost.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
240"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\windows\system32\crypt32.dll
c:\program files\mozilla firefox\vcruntime140.dll
c:\windows\system32\bcrypt.dll
300"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Version:
123.26505.0.0
Modules
Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
376"C:\Users\admin\Desktop\goodbyedpi-0.2.3rc1\x86_64\goodbyedpi.exe" -9 --blacklist ..\russia-blacklist.txt --blacklist ..\russia-youtube.txtC:\Users\admin\Desktop\goodbyedpi-0.2.3rc1\x86_64\goodbyedpi.exe—cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\goodbyedpi-0.2.3rc1\x86_64\goodbyedpi.exe
c:\windows\system32\ntdll.dll
532"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6948 -parentBuildID 20240213221259 -prefsHandle 7056 -prefMapHandle 7052 -prefsLen 34713 -prefMapSize 244343 -appDir "C:\Program Files\Mozilla Firefox\browser" - {08616494-f804-4ee8-bf91-599a73dc3be1} 1104 "\\.\pipe\gecko-crash-server-pipe.1104" 2241ea8db10 rddC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
1
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
788sc description "GoodbyeDPI" "Passive Deep Packet Inspection blocker and Active DPI circumvention utility"C:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1104"C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
1132"C:\Users\admin\Desktop\goodbyedpi-0.2.3rc1\x86_64\goodbyedpi.exe" -9 --blacklist ..\russia-blacklist.txt --blacklist ..\russia-youtube.txtC:\Users\admin\Desktop\goodbyedpi-0.2.3rc1\x86_64\goodbyedpi.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225786
Modules
Images
c:\users\admin\desktop\goodbyedpi-0.2.3rc1\x86_64\goodbyedpi.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\users\admin\desktop\goodbyedpi-0.2.3rc1\x86_64\windivert.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1536sc create "GoodbyeDPI" binPath= "\"C:\Users\admin\Desktop\goodbyedpi-0.2.3rc1\x86_64\goodbyedpi.exe\" -9 --dns-addr 77.88.8.8 --dns-port 1253 --dnsv6-addr 2a02:6b8::feed:0ff --dnsv6-port 1253 --blacklist \"C:\Users\admin\Desktop\goodbyedpi-0.2.3rc1\russia-blacklist.txt\" --blacklist \"C:\Users\admin\Desktop\goodbyedpi-0.2.3rc1\russia-youtube.txt\"" start= "auto"C:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1636"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1904 -parentBuildID 20240213221259 -prefsHandle 1852 -prefMapHandle 1844 -prefsLen 30537 -prefMapSize 244343 -appDir "C:\Program Files\Mozilla Firefox\browser" - {23be7485-43c0-4480-a730-eb1b9fc7c0cc} 1104 "\\.\pipe\gecko-crash-server-pipe.1104" 22417be4510 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
1
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
1860\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
64 485
Read events
64 361
Write events
121
Delete events
3

Modification events

(PID) Process:(6812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(6812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(6812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(6812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\goodbyedpi-0.2.3rc1-2.zip
(PID) Process:(6812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:writeName:0
Value:
C:\Users\admin\Desktop
(PID) Process:(6812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0001000044000000C00400002D020000
Executable files
7
Suspicious files
402
Text files
66
Unknown types
270

Dropped files

PID
Process
Filename
Type
6812WinRAR.exeC:\Users\admin\Desktop\goodbyedpi-0.2.3rc1\2_any_country.cmdtext
MD5:72103C58F2ED536EBC07E19FD00FA2F0
SHA256:17A3D7B8B1E1340F67D3687CE9162199C0A25025941D23954880808403487D07
6812WinRAR.exeC:\Users\admin\Desktop\goodbyedpi-0.2.3rc1\licenses\LICENSE-uthash.txttext
MD5:5CC1F1E4C71F19F580458586756C02B4
SHA256:D3C6556E48104C31E3E0C62238C749C2A09CA79EE87DA50B9CD29C6C9027D57D
6812WinRAR.exeC:\Users\admin\Desktop\goodbyedpi-0.2.3rc1\x86\goodbyedpi.exeexecutable
MD5:92A6C37A997FBA11F9E26995925CBEE6
SHA256:DA0884D6B282FF934C0D7392A50EFCA03C65943B6E2B6254E14E81420F0EBB5F
6812WinRAR.exeC:\Users\admin\Desktop\goodbyedpi-0.2.3rc1\2_any_country_dnsredir.cmdtext
MD5:77048213EB9358FF71F99667DD08034B
SHA256:E599ADB50F219CFBD620A21167B6CFC68E326DA50836B5985826E45E88D247FE
6812WinRAR.exeC:\Users\admin\Desktop\goodbyedpi-0.2.3rc1\licenses\LICENSE-windivert.txttext
MD5:B864FBB188A7C3A11CEF80F3EE902D77
SHA256:E5453B2E71E4C4DCDB89A2539655ADD3A63202521CF3012B768E8BFEDA199312
6812WinRAR.exeC:\Users\admin\Desktop\goodbyedpi-0.2.3rc1\x86\WinDivert64.sysexecutable
MD5:6A33620DE63BCCAF5E5314EE49CD58FB
SHA256:E69B5BA3F0CD6CFB2983E442636E7F0B342B61B15264B0328317D4559C82CF50
6812WinRAR.exeC:\Users\admin\Desktop\goodbyedpi-0.2.3rc1\licenses\LICENSE-getline.txttext
MD5:3A7EDEBC3612BCEA2306F73B92342A44
SHA256:EC5F8E03FCCB3842CC62AD79EA5F6F6058988E2721A3E6566E8FB72786D485C4
6812WinRAR.exeC:\Users\admin\Desktop\goodbyedpi-0.2.3rc1\service_install_russia_blacklist.cmdtext
MD5:AF6DAC6686B77DC51203800737F41B75
SHA256:4D2068F04436998BDF003C430F7BC28F0D0FC7D48031B8A37983F84BAD6374BB
6812WinRAR.exeC:\Users\admin\Desktop\goodbyedpi-0.2.3rc1\service_install_russia_blacklist_dnsredir.cmdtext
MD5:77B1D63472E67C4368961C463CC1D92C
SHA256:450F2B003FB579F897EDED1131C9E893AFDE7B2EBF07B86110449E57ED9A0DA8
6812WinRAR.exeC:\Users\admin\Desktop\goodbyedpi-0.2.3rc1\service_remove.cmdtext
MD5:295C774295B7FAB9F7E3100BF3A482DA
SHA256:D6F19938699E88198ACE9206E417E1289F211E187CFED163D31172F97CB91D55
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
93
TCP/UDP connections
237
DNS requests
337
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6660
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6636
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
1928
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1104
firefox.exe
GET
200
184.24.77.46:80
http://www.w3.org/
unknown
—
—
whitelisted
1104
firefox.exe
GET
200
184.24.77.79:80
http://www.w3.org/
unknown
—
—
whitelisted
1104
firefox.exe
GET
200
184.24.77.46:80
http://www.w3.org/
unknown
—
—
whitelisted
1104
firefox.exe
GET
200
184.24.77.46:80
http://www.w3.org/
unknown
—
—
whitelisted
1104
firefox.exe
GET
200
184.24.77.79:80
http://www.w3.org/
unknown
—
—
whitelisted
4
System
GET
200
142.250.185.67:80
http://www.w3.org/
unknown
—
—
whitelisted
4
System
GET
200
142.250.185.67:80
http://www.w3.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
876
RUXIMICS.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4160
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5336
SearchApp.exe
104.126.37.139:443
www.bing.com
Akamai International B.V.
DE
unknown
3260
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1928
svchost.exe
40.126.32.72:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.206
whitelisted
www.bing.com
  • 104.126.37.139
  • 104.126.37.130
  • 104.126.37.145
  • 104.126.37.155
  • 104.126.37.146
  • 104.126.37.170
  • 104.126.37.144
  • 104.126.37.162
  • 104.126.37.160
whitelisted
client.wns.windows.com
  • 40.113.103.199
  • 40.115.3.253
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.72
  • 40.126.32.136
  • 40.126.32.134
  • 20.190.160.17
  • 40.126.32.138
  • 20.190.160.14
  • 40.126.32.74
  • 20.190.160.22
whitelisted
fd.api.iris.microsoft.com
  • 20.103.156.88
  • 20.223.36.55
whitelisted
arc.msn.com
  • 20.74.47.205
whitelisted
slscr.update.microsoft.com
  • 20.114.59.183
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
p.thenewone.lol
  • 195.123.208.131
unknown

Threats

PID
Process
Class
Message
7072
firefox.exe
Generic Protocol Command Decode
SURICATA TLS invalid record version
7072
firefox.exe
Generic Protocol Command Decode
SURICATA TLS invalid record version
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
goodbyedpi-0.2.3rc1-2.zip