URL:

https://chrome.browser.com.se/

Full analysis: https://app.any.run/tasks/1aa88ae6-89cc-4ee1-b7d6-b1234d2331cf
Verdict: Malicious activity
Threats:

The Arechclient2 malware is a sophisticated .NET-based Remote Access Trojan (RAT) that collects sensitive information, such as browser credentials, from infected computers. It employs various stealth techniques, including Base64 encoding to obscure its code and the ability to pause activities to evade automated security tools. The malware also can adjust Windows Defender settings and uses code injection to manipulate legitimate processes.

Malware Trends Tracker     >>>
Analysis date: April 17, 2025, 14:10:24
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
stealer
rat
arechclient2
backdoor
qrcode
Indicators:
MD5:

69E69EB236F7C5338A70C42CB84E5C3F

SHA1:

3F1DEEBE48343C7F0824AE2E0209358512636205

SHA256:

0386F0C592E9AD8A054482918FEAAA7CD7EDCC65C5C3D7C7F62ECDDA7E3C9FB1

SSDEEP:

3:N8Qa9JyKxvn:2Qa98Kdn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Copies file to a new location (SCRIPT)

      • wscript.exe (PID: 5740)

    • Accesses environment variables (SCRIPT)

      • wscript.exe (PID: 5740)
      • wscript.exe (PID: 7208)

    • Opens a text file (SCRIPT)

      • wscript.exe (PID: 5740)
      • wscript.exe (PID: 7208)

    • Gets %appdata% folder path (SCRIPT)

      • wscript.exe (PID: 5740)
      • wscript.exe (PID: 7208)

    • Gets a file object corresponding to the file in a specified path (SCRIPT)

      • wscript.exe (PID: 5740)
      • wscript.exe (PID: 7208)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6940)
      • powershell.exe (PID: 6640)
      • powershell.exe (PID: 1748)

    • Gets path to any of the special folders (SCRIPT)

      • wscript.exe (PID: 5740)
      • wscript.exe (PID: 7208)

    • Deletes a file (SCRIPT)

      • wscript.exe (PID: 7208)

    • Changes Windows Defender settings

      • wscript.exe (PID: 7208)

    • Adds path to the Windows Defender exclusion list

      • wscript.exe (PID: 7208)

    • Creates internet connection object (SCRIPT)

      • wscript.exe (PID: 7208)

    • Opens an HTTP connection (SCRIPT)

      • wscript.exe (PID: 7208)

    • Uses Task Scheduler to autorun other applications

      • cmd.exe (PID: 7312)

    • Sends HTTP request (SCRIPT)

      • wscript.exe (PID: 7208)

    • Creates a new folder (SCRIPT)

      • wscript.exe (PID: 7208)

    • Executing a file with an untrusted certificate

      • app1.exe (PID: 1532)
      • stickies.exe (PID: 728)
      • app1.exe (PID: 6960)

    • Checks whether a specified folder exists (SCRIPT)

      • wscript.exe (PID: 7208)

    • Create files in the Startup directory

      • app1.tmp (PID: 5232)

    • Changes the autorun value in the registry

      • setup.exe (PID: 5988)

    • Actions looks like stealing of personal data

      • InstallUtil.exe (PID: 2236)

    • ARECHCLIENT2 has been detected (SURICATA)

      • InstallUtil.exe (PID: 2236)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Chrоmе-x64.exe (PID: 8136)
      • 6cd80185217f4eeea64ce70cf9a1c659.exe (PID: 7156)
      • updater.exe (PID: 6080)
      • app1.tmp (PID: 1600)

    • The process executes VB scripts

      • Chrоmе-x64.exe (PID: 8136)
      • cmd.exe (PID: 5256)

    • Executable content was dropped or overwritten

      • Chrоmе-x64.exe (PID: 8136)
      • updater.exe (PID: 1760)
      • updater.exe (PID: 6080)
      • wscript.exe (PID: 7208)
      • app1.exe (PID: 1532)
      • app1.exe (PID: 6960)
      • app1.tmp (PID: 1600)
      • app1.tmp (PID: 5232)
      • 135.0.7049.95_chrome_installer.exe (PID: 6876)
      • setup.exe (PID: 5988)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 5740)
      • wscript.exe (PID: 7208)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 5740)
      • wscript.exe (PID: 7208)

    • Application launched itself

      • 6cd80185217f4eeea64ce70cf9a1c659.exe (PID: 7156)
      • updater.exe (PID: 1760)
      • updater.exe (PID: 6080)
      • updater.exe (PID: 1812)
      • setup.exe (PID: 5988)
      • setup.exe (PID: 2596)
      • updater.exe (PID: 8792)

    • Starts process via Powershell

      • powershell.exe (PID: 6940)

    • Gets full path of the running script (SCRIPT)

      • wscript.exe (PID: 5740)
      • wscript.exe (PID: 7208)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 5740)
      • wscript.exe (PID: 7208)

    • Executes as Windows Service

      • updater.exe (PID: 1760)
      • updater.exe (PID: 1812)
      • updater.exe (PID: 8792)

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 6940)
      • wscript.exe (PID: 7208)

    • Script adds exclusion path to Windows Defender

      • wscript.exe (PID: 7208)

    • Hides command output

      • cmd.exe (PID: 1512)
      • cmd.exe (PID: 7312)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 924)

    • Creates a Stream, which may work with files, input/output devices, pipes, or TCP/IP sockets (SCRIPT)

      • wscript.exe (PID: 7208)

    • Writes binary data to a Stream object (SCRIPT)

      • wscript.exe (PID: 7208)

    • Saves data to a binary file (SCRIPT)

      • wscript.exe (PID: 7208)

    • Creates a Folder object (SCRIPT)

      • wscript.exe (PID: 7208)

    • Reads the Windows owner or organization settings

      • app1.tmp (PID: 1600)
      • app1.tmp (PID: 5232)

    • Process drops legitimate windows executable

      • app1.tmp (PID: 5232)

    • Creates a software uninstall entry

      • setup.exe (PID: 5988)
      • chrome.exe (PID: 6708)

    • Searches for installed software

      • setup.exe (PID: 5988)

    • Connects to unusual port

      • InstallUtil.exe (PID: 2236)

  • INFO

    • Application launched itself

      • msedge.exe (PID: 7352)
      • chrome.exe (PID: 6708)

    • Checks supported languages

      • Chrоmе-x64.exe (PID: 8136)
      • identity_helper.exe (PID: 8188)
      • 6cd80185217f4eeea64ce70cf9a1c659.exe (PID: 7156)
      • 6cd80185217f4eeea64ce70cf9a1c659.exe (PID: 7440)
      • updater.exe (PID: 6080)
      • updater.exe (PID: 1760)
      • updater.exe (PID: 6652)
      • updater.exe (PID: 2240)
      • updater.exe (PID: 2088)
      • updater.exe (PID: 1812)
      • app1.exe (PID: 6960)
      • app1.exe (PID: 1532)
      • app1.tmp (PID: 1600)
      • app1.tmp (PID: 5232)
      • 135.0.7049.95_chrome_installer.exe (PID: 6876)
      • setup.exe (PID: 5988)
      • setup.exe (PID: 7312)
      • stickies.exe (PID: 728)
      • setup.exe (PID: 2596)
      • setup.exe (PID: 5600)
      • InstallUtil.exe (PID: 2236)
      • elevation_service.exe (PID: 3768)
      • updater.exe (PID: 8792)
      • updater.exe (PID: 6044)

    • Reads Environment values

      • identity_helper.exe (PID: 8188)

    • Reads the software policy settings

      • Chrоmе-x64.exe (PID: 8136)
      • updater.exe (PID: 6080)
      • updater.exe (PID: 1812)
      • slui.exe (PID: 2284)
      • slui.exe (PID: 2288)
      • updater.exe (PID: 8792)

    • Creates files in the program directory

      • Chrоmе-x64.exe (PID: 8136)
      • 6cd80185217f4eeea64ce70cf9a1c659.exe (PID: 7440)
      • updater.exe (PID: 6080)
      • updater.exe (PID: 1760)
      • updater.exe (PID: 2240)
      • updater.exe (PID: 1812)
      • setup.exe (PID: 5988)
      • setup.exe (PID: 2596)
      • updater.exe (PID: 8792)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 7352)
      • msedge.exe (PID: 6876)

    • Reads the computer name

      • Chrоmе-x64.exe (PID: 8136)
      • identity_helper.exe (PID: 8188)
      • 6cd80185217f4eeea64ce70cf9a1c659.exe (PID: 7156)
      • updater.exe (PID: 6080)
      • 6cd80185217f4eeea64ce70cf9a1c659.exe (PID: 7440)
      • updater.exe (PID: 1760)
      • updater.exe (PID: 1812)
      • app1.tmp (PID: 1600)
      • app1.tmp (PID: 5232)
      • 135.0.7049.95_chrome_installer.exe (PID: 6876)
      • setup.exe (PID: 5988)
      • setup.exe (PID: 2596)
      • stickies.exe (PID: 728)
      • InstallUtil.exe (PID: 2236)
      • elevation_service.exe (PID: 3768)
      • updater.exe (PID: 8792)

    • Checks proxy server information

      • Chrоmе-x64.exe (PID: 8136)
      • updater.exe (PID: 6080)
      • wscript.exe (PID: 7208)
      • slui.exe (PID: 2288)
      • InstallUtil.exe (PID: 2236)

    • The sample compiled with english language support

      • Chrоmе-x64.exe (PID: 8136)
      • updater.exe (PID: 6080)
      • updater.exe (PID: 1760)
      • app1.tmp (PID: 5232)
      • 135.0.7049.95_chrome_installer.exe (PID: 6876)
      • setup.exe (PID: 5988)
      • msedge.exe (PID: 6876)

    • Create files in a temporary directory

      • Chrоmе-x64.exe (PID: 8136)
      • app1.tmp (PID: 1600)
      • app1.exe (PID: 6960)
      • app1.exe (PID: 1532)
      • app1.tmp (PID: 5232)
      • updater.exe (PID: 6080)

    • Process checks computer location settings

      • Chrоmе-x64.exe (PID: 8136)
      • 6cd80185217f4eeea64ce70cf9a1c659.exe (PID: 7156)
      • app1.tmp (PID: 1600)

    • Process checks whether UAC notifications are on

      • updater.exe (PID: 6080)
      • updater.exe (PID: 1760)
      • updater.exe (PID: 1812)
      • updater.exe (PID: 8792)

    • Reads the machine GUID from the registry

      • updater.exe (PID: 6080)
      • stickies.exe (PID: 728)
      • InstallUtil.exe (PID: 2236)

    • Creates files or folders in the user directory

      • updater.exe (PID: 6080)
      • app1.tmp (PID: 5232)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 1748)
      • powershell.exe (PID: 6640)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6640)
      • powershell.exe (PID: 1748)

    • Manual execution by a user

      • chrome.exe (PID: 6708)

    • Disables trace logs

      • InstallUtil.exe (PID: 2236)

    • Executes as Windows Service

      • elevation_service.exe (PID: 3768)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
273
Monitored processes
132
Malicious processes
16
Suspicious processes
3

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs sppextcomobj.exe no specs msedge.exe no specs slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs chrоmе-x64.exe 6cd80185217f4eeea64ce70cf9a1c659.exe no specs wscript.exe no specs powershell.exe no specs conhost.exe no specs 6cd80185217f4eeea64ce70cf9a1c659.exe updater.exe updater.exe no specs updater.exe updater.exe no specs updater.exe updater.exe no specs cmd.exe conhost.exe no specs wscript.exe powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe conhost.exe no specs schtasks.exe no specs app1.exe app1.tmp app1.exe app1.tmp msedge.exe no specs msedge.exe no specs slui.exe msedge.exe no specs stickies.exe no specs 135.0.7049.95_chrome_installer.exe setup.exe setup.exe no specs msedge.exe no specs msedge.exe no specs setup.exe no specs setup.exe no specs chrome.exe chrome.exe no specs #ARECHCLIENT2 installutil.exe chrome.exe no specs chrome.exe elevation_service.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs updater.exe updater.exe no specs msedge.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe

Process information

PID
CMD
Path
Indicators
Parent process
632"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=135.0.7049.95 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffc895f0ca8,0x7ffc895f0cb4,0x7ffc895f0cc0C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
135.0.7049.95
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
728"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7532 --field-trial-handle=2304,i,7453300841980651450,8044059553740615310,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
728"C:\Users\admin\AppData\Roaming\{FFD73791-AE24-408C-88A7-C794B2982BFF}\stickies.exe" C:\Users\admin\AppData\Roaming\{FFD73791-AE24-408C-88A7-C794B2982BFF}\stickies.exe—app1.tmp
User:
admin
Company:
Zhorn Software
Integrity Level:
HIGH
Description:
Stickies 10.2a
Exit code:
4294967295
Version:
10.2a
Modules
Images
c:\users\admin\appdata\roaming\{ffd73791-ae24-408c-88a7-c794b2982bff}\stickies.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
920"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5628 --field-trial-handle=2304,i,7453300841980651450,8044059553740615310,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
924schtasks /delete /tn "WinSvcUpd" /f C:\Windows\SysWOW64\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
1020"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=1364 --field-trial-handle=2304,i,7453300841980651450,8044059553740615310,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1052"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6668 --field-trial-handle=2304,i,7453300841980651450,8044059553740615310,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
3221226029
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\identity_helper.exe
c:\windows\system32\ntdll.dll
1180"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1924,i,12130139572608589776,1095602225646388212,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
135.0.7049.95
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\135.0.7049.95\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1324"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7288 --field-trial-handle=2304,i,7453300841980651450,8044059553740615310,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1512"C:\Windows\System32\cmd.exe" /c schtasks /delete /tn "WinSvcUpd" /f >nul 2>&1C:\Windows\SysWOW64\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
42 986
Read events
42 672
Write events
278
Delete events
36

Modification events

(PID) Process:(7352) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(7352) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(7352) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(7352) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(7352) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
CBFE5C3F90912F00
(PID) Process:(7352) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
3B1F673F90912F00
(PID) Process:(7352) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\197384
Operation:writeName:WindowTabManagerFileMappingId
Value:
{DD573E15-451D-4BDC-B720-FB631FE60C16}
(PID) Process:(7352) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\197384
Operation:writeName:WindowTabManagerFileMappingId
Value:
{3779BF2B-73A9-4247-B97B-9B4F5BD0031A}
(PID) Process:(7352) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\197384
Operation:writeName:WindowTabManagerFileMappingId
Value:
{34A323E3-2FD2-4AF3-BF9D-7993807521A8}
(PID) Process:(7352) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\197384
Operation:writeName:WindowTabManagerFileMappingId
Value:
{5A720DCB-24BA-4B4A-B3E2-36BDF8E3E76D}
Executable files
63
Suspicious files
469
Text files
160
Unknown types
0

Dropped files

PID
Process
Filename
Type
7352msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF10b79a.TMP —
MD5:—
SHA256:—
7352msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
7352msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF10b79a.TMP —
MD5:—
SHA256:—
7352msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF10b79a.TMP —
MD5:—
SHA256:—
7352msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF10b7c9.TMP —
MD5:—
SHA256:—
7352msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
7352msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
7352msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
7352msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF10b7f7.TMP —
MD5:—
SHA256:—
7352msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
79
TCP/UDP connections
96
DNS requests
117
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2692
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.25:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2692
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6080
updater.exe
GET
200
142.250.185.67:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
1812
updater.exe
GET
—
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome/i6b46ucx6fkdzfmqjjky7bde7e_135.0.7049.95/-8a69d345-d564-463c-aff1-a69d9e530f96-_135.0.7049.95_all_arth6wi2lfg6mi6gy5vzz4k7ge.crx3
unknown
—
—
whitelisted
6080
updater.exe
GET
200
142.250.185.67:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
6080
updater.exe
GET
200
142.250.185.227:80
http://o.pki.goog/we2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEQDQZgpWpezrXAmFnbj86J49
unknown
—
—
whitelisted
7208
wscript.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
6828
svchost.exe
HEAD
200
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9b9f8fb4-8a65-41e4-bda3-5416858f0aeb?P1=1745355037&P2=404&P3=2&P4=ETE61jjdEfqGmzxr6KbmqImZ51Aa89YAsmA%2bpQdA1sowvrU0CiSZ%2bSdI4Fhij8YuTtX0J6OJFre8DdxGHfUKCw%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.25:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7352
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
7628
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7628
msedge.exe
150.171.28.11:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7628
msedge.exe
13.107.246.45:443
edge-mobile-static.azureedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7628
msedge.exe
13.107.6.158:443
business.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7628
msedge.exe
69.62.123.117:443
chrome.browser.com.se
REGION16-ESC
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.216.77.25
  • 23.216.77.31
  • 23.216.77.37
  • 23.216.77.13
  • 23.216.77.29
  • 23.216.77.35
  • 23.216.77.28
  • 23.216.77.18
  • 23.216.77.42
whitelisted
google.com
  • 142.250.185.142
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 150.171.28.11
  • 150.171.27.11
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.45
whitelisted
chrome.browser.com.se
  • 69.62.123.117
unknown
business.bing.com
  • 13.107.6.158
whitelisted
bzib.nelreports.net
  • 2.16.168.113
  • 2.16.168.107
  • 23.50.131.78
  • 23.50.131.74
whitelisted
www.bing.com
  • 92.123.104.57
  • 92.123.104.45
  • 92.123.104.58
  • 92.123.104.54
  • 92.123.104.53
  • 92.123.104.46
  • 92.123.104.43
  • 92.123.104.47
  • 92.123.104.50
  • 92.123.104.19
  • 92.123.104.26
  • 92.123.104.18
  • 92.123.104.29
  • 92.123.104.33
  • 92.123.104.25
  • 92.123.104.22
  • 92.123.104.23
  • 92.123.104.28
whitelisted

Threats

PID
Process
Class
Message
2236
InstallUtil.exe
A Network Trojan was detected
ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M3 (GET)
2236
InstallUtil.exe
A Network Trojan was detected
ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://chrome.browser.com.se/