File name:

lcb spoofer_updated_quack.zip

Full analysis: https://app.any.run/tasks/e4266eec-9173-4be2-ba51-f29be3ee3f89
Verdict: Malicious activity
Analysis date: October 27, 2024, 12:26:02
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
arch-doc
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

F43A112608B3F0973436B37D87B0A52B

SHA1:

560E06B4B1158691DB16AFC64100CD9BC6D4B616

SHA256:

F578D77E5264494FD9CF4B740953B12B348745C43CC256CC5339C6A91413F909

SSDEEP:

196608:NsbpXnsQ7d8kYFwvapdAi3h3HXIkWFwvapdAi3Y:KbpXsQmkYFwyXAiRH4kWFwyXAiY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 5852)

  • SUSPICIOUS

    • Uses WMIC.EXE to obtain physical disk drive information

      • cmd.exe (PID: 4224)

    • Uses WMIC.EXE to obtain data on the base board management (motherboard or system board)

      • cmd.exe (PID: 4224)

    • Uses WMIC.EXE to obtain Windows Installer data

      • cmd.exe (PID: 4224)

    • Accesses product unique identifier via WMI (SCRIPT)

      • WMIC.exe (PID: 5948)
      • WMIC.exe (PID: 1196)

    • Uses WMIC.EXE to obtain a list of video controllers

      • cmd.exe (PID: 4224)

    • Accesses computer name via WMI (SCRIPT)

      • WMIC.exe (PID: 7164)

    • Accesses video controller name via WMI (SCRIPT)

      • WMIC.exe (PID: 7164)

    • Uses WMIC.EXE to obtain memory chip information

      • cmd.exe (PID: 4224)

    • Uses WMIC.EXE to obtain CPU information

      • cmd.exe (PID: 4224)

    • Uses WMIC.EXE to obtain network information

      • cmd.exe (PID: 4224)

    • Starts CMD.EXE for commands execution

      • Toruney_Cleaner.exe (PID: 6288)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2980)
      • cmd.exe (PID: 3772)
      • cmd.exe (PID: 6428)
      • cmd.exe (PID: 4340)
      • cmd.exe (PID: 1280)
      • cmd.exe (PID: 5600)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 4128)
      • cmd.exe (PID: 6676)
      • cmd.exe (PID: 7080)
      • cmd.exe (PID: 5652)
      • cmd.exe (PID: 4464)
      • cmd.exe (PID: 2184)
      • cmd.exe (PID: 944)
      • cmd.exe (PID: 5892)
      • cmd.exe (PID: 692)
      • cmd.exe (PID: 5444)
      • cmd.exe (PID: 6756)
      • cmd.exe (PID: 2888)
      • cmd.exe (PID: 4340)
      • cmd.exe (PID: 7036)
      • cmd.exe (PID: 4584)
      • cmd.exe (PID: 6988)
      • cmd.exe (PID: 1184)
      • cmd.exe (PID: 6200)
      • cmd.exe (PID: 4996)
      • cmd.exe (PID: 5332)
      • cmd.exe (PID: 6200)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 5600)

  • INFO

    • Manual execution by a user

      • Loader.exe (PID: 6808)
      • Loader.exe (PID: 6176)
      • cmd.exe (PID: 4224)
      • lcb_spoof_crack.exe (PID: 5236)
      • lcb_spoof_crack.exe (PID: 1952)
      • cleaner.exe (PID: 6176)
      • cleaner.exe (PID: 7156)
      • Toruney_Cleaner.exe (PID: 6288)
      • cmd.exe (PID: 5600)
      • notepad.exe (PID: 6952)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 5852)

    • Starts MODE.COM to configure console settings

      • mode.com (PID: 6820)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5852)

    • Checks supported languages

      • mode.com (PID: 6820)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 6740)
      • WMIC.exe (PID: 7048)
      • WMIC.exe (PID: 5948)
      • WMIC.exe (PID: 7164)
      • WMIC.exe (PID: 1952)
      • WMIC.exe (PID: 1196)
      • WMIC.exe (PID: 3608)
      • WMIC.exe (PID: 2428)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 12347
UncompressedSize: 65024
OperatingSystem: Win32
ArchivedFileName: lcb spoofer_updated_quack/cleaners/cleaner.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
226
Monitored processes
100
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs loader.exe no specs loader.exe lcb_spoof_crack.exe no specs lcb_spoof_crack.exe cmd.exe no specs conhost.exe no specs mode.com no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs wmic.exe no specs cleaner.exe no specs cleaner.exe conhost.exe no specs toruney_cleaner.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs taskkill.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs sc.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
632reg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control" /v SystemStartOptions /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
692C:\WINDOWS\system32\cmd.exe /c REG ADD HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName /v ComputerName /t REG_SZ /d Norc%random% /fC:\Windows\System32\cmd.exe—Toruney_Cleaner.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
944C:\WINDOWS\system32\cmd.exe /c reg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control" /v SystemStartOptions /fC:\Windows\System32\cmd.exe—Toruney_Cleaner.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1184C:\WINDOWS\system32\cmd.exe /c reg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSReleaseDate /fC:\Windows\System32\cmd.exe—Toruney_Cleaner.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1196wmic csproduct get uuidC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
1280C:\WINDOWS\system32\cmd.exe /c taskkill /f /im EpicGamesLauncher.exeC:\Windows\System32\cmd.exe—Toruney_Cleaner.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1584taskkill /f /im EasyAntiCheat.exe C:\Windows\System32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1764reg delete "HKEY_CURRENT_USER\Software\Epic Games" /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1784taskkill /f /im FortniteClient-Win64-Shipping_BE.exeC:\Windows\System32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1788taskkill /f /im smartscreen.exeC:\Windows\System32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
6 167
Read events
6 151
Write events
16
Delete events
0

Modification events

(PID) Process:(5852) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(5852) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\lcb spoofer_updated_quack.zip.rar
(PID) Process:(5852) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5852) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5852) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5852) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5852) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
(PID) Process:(5852) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
(PID) Process:(5852) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5852) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:psize
Value:
80
Executable files
8
Suspicious files
0
Text files
9
Unknown types
0

Dropped files

PID
Process
Filename
Type
5852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5852.28844\lcb spoofer_updated_quack\cleaners\cleaner.exeexecutable
MD5:CE27988CC633ED4E1EA1ED4BFD94E6AF
SHA256:CE283342401E7FE747FE0BA57BEFB47465BDFE0F96DDFBEB869496684D6DC967
5852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5852.28844\lcb spoofer_updated_quack\cleaners\leakedshit\eac install\EAC.battext
MD5:8E25B700F094C22CF9545B24DF4B3B98
SHA256:5A98534F6DE39AF620B6520D25AC388D1EE46F10D10C7A05F34F6593098C99D7
5852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5852.28844\lcb spoofer_updated_quack\cleaners\leakedshit\clean1.battext
MD5:4BF8DD140901A615B1A5FA5136728521
SHA256:E2B6CE87A5FA871709665B0306E15D45CD7B5550A4DE6701A8CE31E811A646ED
5852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5852.28844\lcb spoofer_updated_quack\cleaners\leakedshit\clean2.battext
MD5:049FCE145ABFED6AFA90599762B08C6B
SHA256:97377C7AE3FF41E72DAC718A4DD82CDD079FF50E026CE159D3435E6EDB8BC543
5852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5852.28844\lcb spoofer_updated_quack\cleaners\leakedshit\clean3.battext
MD5:FBD3EBE26A823F86AE2DEED72DF613B9
SHA256:8E43A6E232E9842777D3FCE8C552BF942359757E6AF092595C98AE101EE0E94D
5852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5852.28844\lcb spoofer_updated_quack\cleaners\FortniteCleaner.battext
MD5:2429DB21A224C48FA6B17E55A6762328
SHA256:365685C1E71944BC955C6BE46CC33A44099BCB0F8C625228E89445F18866B778
5852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5852.28844\lcb spoofer_updated_quack\cleaners\leakedshit\eac install\EasyAntiCheat_EOS_Setup.exeexecutable
MD5:B2CF34920A4010EF3799921D8E0D18D7
SHA256:6108A4F378AE293A5EA2BA74058BEAE388D85FC199EDDE903BA81375D8744396
5852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5852.28844\lcb spoofer_updated_quack\cleaners\Toruney_Cleaner.exeexecutable
MD5:03C9069653A814DD3A0D69D1431145EB
SHA256:D5B857F4972FEA91C9D476905D4FB6F80DE89DF311DA0DCE83ADFBEF4D32D1B3
5852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5852.28844\lcb spoofer_updated_quack\cleaners\leakedshit\applecleaner.exeexecutable
MD5:BA268B881BCCD2784FE98289EEC8AD72
SHA256:C83921C8DDA800EF24EBE873EC175617110DC9DEB2629D1107F219CA30CAECE3
5852WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5852.28844\lcb spoofer_updated_quack\cleaners\Midnight.battext
MD5:98C35392BDDB76264B1004A0DBF67236
SHA256:5A21145B429B84651B8B30506382C7643E631BC917DE152D70CF6AA8FDFB15B8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
44
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5488
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5232
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2312
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2312
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6572
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6944
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1752
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5488
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5488
MoUsoCoreWorker.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4360
SearchApp.exe
2.16.110.193:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4020
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 23.52.120.96
whitelisted
google.com
  • 172.217.16.142
whitelisted
www.bing.com
  • 2.16.110.193
  • 2.16.110.123
  • 2.16.110.121
  • 2.16.110.171
  • 2.16.110.170
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.71
  • 20.190.159.73
  • 20.190.159.4
  • 20.190.159.68
  • 20.190.159.0
  • 40.126.31.71
  • 40.126.31.67
  • 40.126.31.69
whitelisted
th.bing.com
  • 2.16.110.170
  • 2.16.110.195
  • 2.16.110.123
  • 2.16.110.171
  • 2.16.110.168
  • 2.16.110.121
  • 2.16.110.193
  • 2.16.110.136
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
lcb spoofer_updated_quack.zip