File name:

Memory-Setup.exe

Full analysis: https://app.any.run/tasks/b4d02e18-148d-419c-a0ee-972cbe504e9a
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 16, 2024, 17:19:50
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
loader
rust
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

8653DB7C8388844B9AEE44B9761DA495

SHA1:

A691B4DD152CE2C5DF20215B399D5AA2784E79F2

SHA256:

024AAF76FB6496CE73AD5AEF990FD9A69E6B35253DC48920394B0B25E0DDA3F2

SSDEEP:

196608:dbQUg5XojdyxUJnb+dZE5hVTu6G3fPSG79U:Zga5+8b+rCQb79U

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • MicrosoftEdgeUpdate.exe (PID: 6964)

    • The DLL Hijacking

      • msedgewebview2.exe (PID: 3152)

    • Scans artifacts that could help determine the target

      • msedgewebview2.exe (PID: 4824)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Memory-Setup.exe (PID: 6340)

    • Executable content was dropped or overwritten

      • Memory-Setup.exe (PID: 6340)
      • MicrosoftEdgeWebview2Setup.exe (PID: 6924)
      • MicrosoftEdgeUpdate.exe (PID: 6964)
      • MicrosoftEdge_X64_131.0.2903.99.exe (PID: 6704)
      • setup.exe (PID: 6420)
      • Memory Data Importer.exe (PID: 3992)
      • msedgewebview2.exe (PID: 5540)

    • Searches for installed software

      • Memory-Setup.exe (PID: 6340)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeWebview2Setup.exe (PID: 6924)
      • MicrosoftEdgeUpdate.exe (PID: 6964)

    • Potential Corporate Privacy Violation

      • Memory-Setup.exe (PID: 6340)
      • svchost.exe (PID: 5256)

    • Process drops legitimate windows executable

      • MicrosoftEdgeWebview2Setup.exe (PID: 6924)
      • Memory-Setup.exe (PID: 6340)
      • MicrosoftEdgeUpdate.exe (PID: 6964)
      • MicrosoftEdge_X64_131.0.2903.99.exe (PID: 6704)
      • setup.exe (PID: 6420)
      • msedgewebview2.exe (PID: 5540)

    • Process requests binary or script from the Internet

      • Memory-Setup.exe (PID: 6340)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 6964)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7152)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6180)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6172)
      • MicrosoftEdgeUpdate.exe (PID: 7080)

    • Reads security settings of Internet Explorer

      • MicrosoftEdgeUpdate.exe (PID: 6964)
      • MicrosoftEdgeUpdate.exe (PID: 5080)
      • msedgewebview2.exe (PID: 4824)

    • Application launched itself

      • setup.exe (PID: 6420)
      • Memory.exe (PID: 7152)
      • MicrosoftEdgeUpdate.exe (PID: 5080)
      • msedgewebview2.exe (PID: 4824)

    • Checks Windows Trust Settings

      • MicrosoftEdgeUpdate.exe (PID: 5080)

    • Creates a software uninstall entry

      • Memory-Setup.exe (PID: 6340)

  • INFO

    • The sample compiled with english language support

      • Memory-Setup.exe (PID: 6340)
      • MicrosoftEdgeWebview2Setup.exe (PID: 6924)
      • MicrosoftEdgeUpdate.exe (PID: 6964)
      • svchost.exe (PID: 5256)
      • MicrosoftEdge_X64_131.0.2903.99.exe (PID: 6704)
      • setup.exe (PID: 6420)
      • Memory Data Importer.exe (PID: 3992)

    • Checks supported languages

      • Memory-Setup.exe (PID: 6340)
      • MicrosoftEdgeWebview2Setup.exe (PID: 6924)
      • MicrosoftEdgeUpdate.exe (PID: 6964)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6180)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7152)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6172)
      • MicrosoftEdgeUpdate.exe (PID: 7080)
      • MicrosoftEdgeUpdate.exe (PID: 5308)
      • MicrosoftEdgeUpdate.exe (PID: 5080)
      • MicrosoftEdgeUpdate.exe (PID: 5000)
      • setup.exe (PID: 1140)
      • setup.exe (PID: 6420)
      • Memory.exe (PID: 7152)
      • Memory.exe (PID: 1380)
      • Memory Integration Service.exe (PID: 5892)
      • Memory Data Importer.exe (PID: 3992)
      • msedgewebview2.exe (PID: 4824)
      • msedgewebview2.exe (PID: 3152)
      • Memory Integration Service.exe (PID: 7056)
      • msedgewebview2.exe (PID: 4052)
      • msedgewebview2.exe (PID: 6456)
      • msedgewebview2.exe (PID: 3544)
      • msedgewebview2.exe (PID: 1140)
      • msedgewebview2.exe (PID: 5488)
      • msedgewebview2.exe (PID: 5540)
      • msedgewebview2.exe (PID: 7160)
      • msedgewebview2.exe (PID: 3124)
      • msedgewebview2.exe (PID: 6780)

    • Checks proxy server information

      • Memory-Setup.exe (PID: 6340)
      • MicrosoftEdgeUpdate.exe (PID: 5000)
      • MicrosoftEdgeUpdate.exe (PID: 5080)
      • MicrosoftEdgeUpdate.exe (PID: 6776)
      • Memory.exe (PID: 7152)
      • Memory.exe (PID: 1380)
      • msedgewebview2.exe (PID: 4824)

    • Reads the computer name

      • Memory-Setup.exe (PID: 6340)
      • MicrosoftEdgeUpdate.exe (PID: 6964)
      • MicrosoftEdgeUpdate.exe (PID: 7080)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7152)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6180)
      • MicrosoftEdgeUpdate.exe (PID: 5308)
      • MicrosoftEdgeUpdate.exe (PID: 5080)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6172)
      • MicrosoftEdgeUpdate.exe (PID: 5000)
      • setup.exe (PID: 6420)
      • Memory.exe (PID: 7152)
      • Memory Integration Service.exe (PID: 5892)
      • Memory.exe (PID: 1380)
      • Memory Integration Service.exe (PID: 7056)
      • msedgewebview2.exe (PID: 4824)
      • msedgewebview2.exe (PID: 6456)

    • Create files in a temporary directory

      • MicrosoftEdgeWebview2Setup.exe (PID: 6924)
      • Memory-Setup.exe (PID: 6340)
      • svchost.exe (PID: 5256)
      • msedgewebview2.exe (PID: 4824)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 5000)
      • msedgewebview2.exe (PID: 4824)
      • Memory.exe (PID: 1380)

    • Process checks computer location settings

      • MicrosoftEdgeUpdate.exe (PID: 6964)
      • setup.exe (PID: 6420)
      • msedgewebview2.exe (PID: 4824)
      • msedgewebview2.exe (PID: 3544)

    • Reads the software policy settings

      • MicrosoftEdgeUpdate.exe (PID: 5080)
      • MicrosoftEdgeUpdate.exe (PID: 5000)

    • Reads the machine GUID from the registry

      • MicrosoftEdgeUpdate.exe (PID: 5080)
      • Memory Data Importer.exe (PID: 3992)
      • msedgewebview2.exe (PID: 4824)

    • Creates files or folders in the user directory

      • MicrosoftEdge_X64_131.0.2903.99.exe (PID: 6704)
      • setup.exe (PID: 6420)
      • setup.exe (PID: 1140)
      • MicrosoftEdgeUpdate.exe (PID: 5080)
      • Memory-Setup.exe (PID: 6340)
      • Memory.exe (PID: 1380)
      • msedgewebview2.exe (PID: 4824)
      • msedgewebview2.exe (PID: 6456)

    • Manual execution by a user

      • Memory.exe (PID: 7152)

    • Creates files in the program directory

      • Memory Integration Service.exe (PID: 5892)

    • Sends debugging messages

      • msedgewebview2.exe (PID: 4824)
      • Memory.exe (PID: 1380)

    • Application based on Rust

      • Memory.exe (PID: 7152)
      • Memory.exe (PID: 1380)

    • Reads product name

      • Memory.exe (PID: 1380)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:09:25 21:56:47+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x3640
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 24.10.129.0
ProductVersionNumber: 24.10.129.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: Memory
FileVersion: 24.10.129
LegalCopyright: -
ProductName: Memory
ProductVersion: 24.10.129
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
170
Monitored processes
38
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start memory-setup.exe microsoftedgewebview2setup.exe microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe svchost.exe microsoftedge_x64_131.0.2903.99.exe setup.exe setup.exe no specs microsoftedgeupdate.exe memory.exe no specs memory.exe memory integration service.exe no specs conhost.exe no specs memory data importer.exe conhost.exe no specs memory integration service.exe no specs conhost.exe no specs msedgewebview2.exe msedgewebview2.exe no specs msedgewebview2.exe no specs msedgewebview2.exe msedgewebview2.exe no specs msedgewebview2.exe no specs msedgewebview2.exe no specs msedgewebview2.exe no specs msedgewebview2.exe no specs msedgewebview2.exe no specs msedgewebview2.exe no specs msedgewebview2.exe no specs msedgewebview2.exe msedgewebview2.exe no specs msedgewebview2.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1140C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{0182F781-1398-4E3B-9AFB-8E28F7EDB7AB}\EDGEMITMP_4ABFE.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.140 --annotation=exe=C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{0182F781-1398-4E3B-9AFB-8E28F7EDB7AB}\EDGEMITMP_4ABFE.tmp\setup.exe --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.99 --initial-client-data=0x25c,0x260,0x264,0x238,0x268,0x7ff7151e2918,0x7ff7151e2924,0x7ff7151e2930C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{0182F781-1398-4E3B-9AFB-8E28F7EDB7AB}\EDGEMITMP_4ABFE.tmp\setup.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Installer
Exit code:
0
Version:
131.0.2903.99
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\install\{0182f781-1398-4e3b-9afb-8e28f7edb7ab}\edgemitmp_4abfe.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
1140"C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\131.0.2903.99\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\com.timelyapp.App\EBWebView" --webview-exe-name=Memory.exe --webview-exe-version=24.10.129 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=4708,i,8875129308057523274,14558659224828013768,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:8C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\131.0.2903.99\msedgewebview2.exe—msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge WebView2
Exit code:
0
Version:
131.0.2903.99
Modules
Images
c:\users\admin\appdata\local\microsoft\edgewebview\application\131.0.2903.99\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\microsoft\edgewebview\application\131.0.2903.99\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1356\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Memory Integration Service.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1380"C:\Users\admin\AppData\Local\Memory\Memory.exe" --monitoredC:\Users\admin\AppData\Local\Memory\Memory.exe
Memory.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Memory
Version:
24.10.129
Modules
Images
c:\users\admin\appdata\local\memory\memory.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
2280C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\131.0.2903.99\msedgewebview2.exe --type=crashpad-handler --user-data-dir=C:\Users\admin\AppData\Local\com.timelyapp.App\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\admin\AppData\Local\com.timelyapp.App\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.140 --annotation=exe=C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\131.0.2903.99\msedgewebview2.exe --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=131.0.2903.99 --initial-client-data=0x1a0,0x1a4,0x1a8,0x17c,0x1b0,0x7ff81e996070,0x7ff81e99607c,0x7ff81e996088C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\131.0.2903.99\msedgewebview2.exe—msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge WebView2
Version:
131.0.2903.99
Modules
Images
c:\users\admin\appdata\local\microsoft\edgewebview\application\131.0.2903.99\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\microsoft\edgewebview\application\131.0.2903.99\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2796"C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\131.0.2903.99\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\com.timelyapp.App\EBWebView" --webview-exe-name=Memory.exe --webview-exe-version=24.10.129 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2296,i,8875129308057523274,14558659224828013768,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\131.0.2903.99\msedgewebview2.exe—msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge WebView2
Exit code:
0
Version:
131.0.2903.99
Modules
Images
c:\users\admin\appdata\local\microsoft\edgewebview\application\131.0.2903.99\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\microsoft\edgewebview\application\131.0.2903.99\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3124"C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\131.0.2903.99\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\com.timelyapp.App\EBWebView" --webview-exe-name=Memory.exe --webview-exe-version=24.10.129 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=5104,i,8875129308057523274,14558659224828013768,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:8C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\131.0.2903.99\msedgewebview2.exe—msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge WebView2
Exit code:
0
Version:
131.0.2903.99
Modules
Images
c:\users\admin\appdata\local\microsoft\edgewebview\application\131.0.2903.99\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\microsoft\edgewebview\application\131.0.2903.99\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3152"C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\131.0.2903.99\msedgewebview2.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\com.timelyapp.App\EBWebView" --webview-exe-name=Memory.exe --webview-exe-version=24.10.129 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1940,i,8875129308057523274,14558659224828013768,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:2C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\131.0.2903.99\msedgewebview2.exe—msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge WebView2
Version:
131.0.2903.99
Modules
Images
c:\users\admin\appdata\local\microsoft\edgewebview\application\131.0.2903.99\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\microsoft\edgewebview\application\131.0.2903.99\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3544"C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\131.0.2903.99\msedgewebview2.exe" --type=renderer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\com.timelyapp.App\EBWebView" --webview-exe-name=Memory.exe --webview-exe-version=24.10.129 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3552,i,8875129308057523274,14558659224828013768,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\131.0.2903.99\msedgewebview2.exe—msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge WebView2
Version:
131.0.2903.99
Modules
Images
c:\users\admin\appdata\local\microsoft\edgewebview\application\131.0.2903.99\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\microsoft\edgewebview\application\131.0.2903.99\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3992"\\?\C:\Users\admin\AppData\Local\Memory\Memory Data Importer.exe" importC:\Users\admin\AppData\Local\Memory\Memory Data Importer.exe
Memory.exe
User:
admin
Company:
Memory Data Importer
Integrity Level:
MEDIUM
Description:
Memory Data Importer
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\memory\memory data importer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
15 160
Read events
12 740
Write events
2 352
Delete events
68

Modification events

(PID) Process:(6964) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:delete valueName:eulaaccepted
Value:
(PID) Process:(6964) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:edgeupdate_task_name_c
Value:
MicrosoftEdgeUpdateTaskUserS-1-5-21-1693682860-607145093-2874071422-1001Core{8C68D96F-2163-4DB8-9F6F-03037732D0F6}
(PID) Process:(6964) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:edgeupdate_task_name_ua
Value:
MicrosoftEdgeUpdateTaskUserS-1-5-21-1693682860-607145093-2874071422-1001UA{1FC1723C-4BBD-4DDA-8855-DBD3C04C2C77}
(PID) Process:(6964) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:path
Value:
C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
(PID) Process:(6964) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:UninstallCmdLine
Value:
"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /uninstall
(PID) Process:(6964) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:pv
Value:
1.3.195.39
(PID) Process:(6964) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:name
Value:
Microsoft Edge Update
(PID) Process:(6964) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:pv
Value:
1.3.195.39
(PID) Process:(6964) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Microsoft Edge Update
Value:
"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateCore.exe"
(PID) Process:(7152) MicrosoftEdgeUpdateComRegisterShell64.exeKey:HKEY_CLASSES_ROOT\CLSID\{81093D63-7825-417B-BFC8-ADC63FA4E53D}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Both
Executable files
218
Suspicious files
239
Text files
47
Unknown types
6

Dropped files

PID
Process
Filename
Type
6340Memory-Setup.exeC:\Users\admin\AppData\Local\Temp\nsy5F4C.tmp\System.dllexecutable
MD5:CFF85C549D536F651D4FB8387F1976F2
SHA256:8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
6340Memory-Setup.exeC:\Users\admin\AppData\Local\Temp\nsy5F4C.tmp\modern-header.bmpimage
MD5:CEFCF55949458FC9962D8B425129A5CB
SHA256:EF8CCEA6192C3B218F3FE87BC123C28A2D0968CF885D15A613ED6EAE1C648D23
6340Memory-Setup.exeC:\Users\admin\AppData\Local\Temp\nsy5F4C.tmp\nsDialogs.dllexecutable
MD5:6C3F8C94D0727894D706940A8A980543
SHA256:56B96ADD1978B1ABBA286F7F8982B0EFBE007D4A48B3DED6A4D408E01D753FE2
6340Memory-Setup.exeC:\Users\admin\AppData\Local\Temp\nsy5F4C.tmp\StartMenu.dllexecutable
MD5:D070F3275DF715BF3708BEFF2C6C307D
SHA256:42DD4DDA3249A94E32E20F76EAFFAE784A5475ED00C60EF0197C8A2C1CCD2FB7
6340Memory-Setup.exeC:\Users\admin\AppData\Local\Temp\nsy5F4C.tmp\NSISdl.dllexecutable
MD5:EE68463FED225C5C98D800BDBD205598
SHA256:419485A096BC7D95F872ED1B9B7B5C537231183D710363BEEE4D235BB79DBE04
6924MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUB7DA.tmp\MicrosoftEdgeUpdateBroker.exeexecutable
MD5:6513BF6501B147F7A6BB78F543C4A104
SHA256:829FE05CCF8C87A8B428BAE43CAFCA9434551EE5C80718C737D22548C9E7F342
6924MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUB7DA.tmp\msedgeupdate.dllexecutable
MD5:3F84AC83FA44FB5E069640648E1660E7
SHA256:17C62E9ED5BEBDCCE2AC0CB41A255C5F63F6544FB5AB148B6810617B854F6319
6340Memory-Setup.exeC:\Users\admin\AppData\Local\Temp\nsy5F4C.tmp\modern-wizard.bmpimage
MD5:0EBE6A5F3161793FBBBF5E8D4BECE97D
SHA256:0A2B2AD2B126D906C0387FD5F70697E4F1096E096E29C3C8DEFF2B5C28ADD807
6340Memory-Setup.exeC:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exeexecutable
MD5:EC5B2A3126F46E01E1FCBB215D4F9EC8
SHA256:09C2A441A22186CBCC90E0A79556C4C696446740955C9031F8B52E84C7CD4EC1
6924MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUB7DA.tmp\MicrosoftEdgeUpdate.exeexecutable
MD5:9DA54F5A8726349124DBDCA094448A11
SHA256:F04EFEE822F9B2BAF2F9B4EA576B9908804B6990497B82C549A34BA54B1B4807
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
36
TCP/UDP connections
47
DNS requests
39
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6340
Memory-Setup.exe
GET
301
23.213.166.81:80
http://go.microsoft.com/fwlink/p/?LinkId=2124703
unknown
—
—
whitelisted
6340
Memory-Setup.exe
GET
200
23.32.238.138:80
http://msedge.sf.dl.delivery.mp.microsoft.com/filestreamingservice/files/3aa91245-82ae-4367-bbc2-c8d7a8fc1730/MicrosoftEdgeWebview2Setup.exe
unknown
—
—
whitelisted
3952
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6992
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5256
svchost.exe
HEAD
200
23.32.238.128:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0f6a6dd3-0b22-4e78-b04f-60494eb4c4e8?P1=1734974426&P2=404&P3=2&P4=GE9VJASUEOJLgTW3b%2bsVx9CTqfwVdsDyRkaepf4Sljl3g83LnfRKiXDgtgilaoGc%2fRmE2dr1abYpHJ9DvL9CSA%3d%3d
unknown
—
—
whitelisted
5256
svchost.exe
GET
200
23.32.238.128:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0f6a6dd3-0b22-4e78-b04f-60494eb4c4e8?P1=1734974426&P2=404&P3=2&P4=GE9VJASUEOJLgTW3b%2bsVx9CTqfwVdsDyRkaepf4Sljl3g83LnfRKiXDgtgilaoGc%2fRmE2dr1abYpHJ9DvL9CSA%3d%3d
unknown
—
—
whitelisted
5256
svchost.exe
HEAD
200
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/c08f1970-45bc-4dbe-8166-4ecef7a1f617?P1=1734855547&P2=404&P3=2&P4=ZUdabRp%2faO62ueLzNX0CY7z7GK5vT3h79t%2b93ZjVct0D%2b8AouL1spfSq0pj2Imi1LKNd2ZtA1s3L5XSpoEf%2brg%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1488
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
2088
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
104.126.37.131:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
  • 20.73.194.208
whitelisted
www.bing.com
  • 104.126.37.131
  • 104.126.37.129
  • 104.126.37.153
  • 104.126.37.123
  • 104.126.37.139
  • 104.126.37.136
  • 104.126.37.144
  • 104.126.37.137
  • 104.126.37.130
whitelisted
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
google.com
  • 142.250.186.142
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
login.live.com
  • 20.190.159.0
  • 20.190.159.73
  • 20.190.159.2
  • 20.190.159.4
  • 40.126.31.73
  • 20.190.159.23
  • 20.190.159.75
  • 20.190.159.64
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
msedge.sf.dl.delivery.mp.microsoft.com
  • 23.32.238.138
  • 23.32.238.163
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted

Threats

PID
Process
Class
Message
6340
Memory-Setup.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
5256
svchost.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
6456
msedgewebview2.exe
Not Suspicious Traffic
INFO [ANY.RUN] An application monitoring request to sentry .io
6456
msedgewebview2.exe
Not Suspicious Traffic
INFO [ANY.RUN] An application monitoring request to sentry .io
4 ETPRO signatures available at the full report
Process
Message
msedgewebview2.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\com.timelyapp.App directory exists )
Memory.exe
Warning: AddWebResourceRequestedFilter without SourceKind parameter is deprecated! It does not behave as expected for iframes.Please use AddWebResourceRequestedFilterWithRequestSourceKinds instead. For more information, please see https://go.microsoft.com/fwlink/?linkid=2286319
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Memory-Setup.exe