URL:

https://chrome.browser.com.se/

Full analysis: https://app.any.run/tasks/1aa88ae6-89cc-4ee1-b7d6-b1234d2331cf
Verdict: Malicious activity
Threats:

The Arechclient2 malware is a sophisticated .NET-based Remote Access Trojan (RAT) that collects sensitive information, such as browser credentials, from infected computers. It employs various stealth techniques, including Base64 encoding to obscure its code and the ability to pause activities to evade automated security tools. The malware also can adjust Windows Defender settings and uses code injection to manipulate legitimate processes.

Malware Trends Tracker     >>>
Analysis date: April 17, 2025, 14:10:24
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
stealer
rat
arechclient2
backdoor
qrcode
Indicators:
MD5:

69E69EB236F7C5338A70C42CB84E5C3F

SHA1:

3F1DEEBE48343C7F0824AE2E0209358512636205

SHA256:

0386F0C592E9AD8A054482918FEAAA7CD7EDCC65C5C3D7C7F62ECDDA7E3C9FB1

SSDEEP:

3:N8Qa9JyKxvn:2Qa98Kdn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Copies file to a new location (SCRIPT)

      • wscript.exe (PID: 5740)

    • Gets path to any of the special folders (SCRIPT)

      • wscript.exe (PID: 5740)
      • wscript.exe (PID: 7208)

    • Opens a text file (SCRIPT)

      • wscript.exe (PID: 5740)
      • wscript.exe (PID: 7208)

    • Gets %appdata% folder path (SCRIPT)

      • wscript.exe (PID: 5740)
      • wscript.exe (PID: 7208)

    • Accesses environment variables (SCRIPT)

      • wscript.exe (PID: 5740)
      • wscript.exe (PID: 7208)

    • Gets a file object corresponding to the file in a specified path (SCRIPT)

      • wscript.exe (PID: 5740)
      • wscript.exe (PID: 7208)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6940)
      • powershell.exe (PID: 1748)
      • powershell.exe (PID: 6640)

    • Deletes a file (SCRIPT)

      • wscript.exe (PID: 7208)

    • Uses Task Scheduler to autorun other applications

      • cmd.exe (PID: 7312)

    • Changes Windows Defender settings

      • wscript.exe (PID: 7208)

    • Adds path to the Windows Defender exclusion list

      • wscript.exe (PID: 7208)

    • Creates internet connection object (SCRIPT)

      • wscript.exe (PID: 7208)

    • Opens an HTTP connection (SCRIPT)

      • wscript.exe (PID: 7208)

    • Sends HTTP request (SCRIPT)

      • wscript.exe (PID: 7208)

    • Creates a new folder (SCRIPT)

      • wscript.exe (PID: 7208)

    • Checks whether a specified folder exists (SCRIPT)

      • wscript.exe (PID: 7208)

    • Executing a file with an untrusted certificate

      • app1.exe (PID: 6960)
      • app1.exe (PID: 1532)
      • stickies.exe (PID: 728)

    • Create files in the Startup directory

      • app1.tmp (PID: 5232)

    • Changes the autorun value in the registry

      • setup.exe (PID: 5988)

    • Actions looks like stealing of personal data

      • InstallUtil.exe (PID: 2236)

    • ARECHCLIENT2 has been detected (SURICATA)

      • InstallUtil.exe (PID: 2236)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Chrоmе-x64.exe (PID: 8136)
      • updater.exe (PID: 1760)
      • updater.exe (PID: 6080)
      • app1.tmp (PID: 1600)
      • app1.exe (PID: 6960)
      • wscript.exe (PID: 7208)
      • app1.exe (PID: 1532)
      • app1.tmp (PID: 5232)
      • 135.0.7049.95_chrome_installer.exe (PID: 6876)
      • setup.exe (PID: 5988)

    • Reads security settings of Internet Explorer

      • 6cd80185217f4eeea64ce70cf9a1c659.exe (PID: 7156)
      • Chrоmе-x64.exe (PID: 8136)
      • updater.exe (PID: 6080)
      • app1.tmp (PID: 1600)

    • The process executes VB scripts

      • Chrоmе-x64.exe (PID: 8136)
      • cmd.exe (PID: 5256)

    • Gets full path of the running script (SCRIPT)

      • wscript.exe (PID: 5740)
      • wscript.exe (PID: 7208)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 5740)
      • wscript.exe (PID: 7208)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 5740)
      • wscript.exe (PID: 7208)

    • Starts process via Powershell

      • powershell.exe (PID: 6940)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 5740)
      • wscript.exe (PID: 7208)

    • Application launched itself

      • 6cd80185217f4eeea64ce70cf9a1c659.exe (PID: 7156)
      • updater.exe (PID: 6080)
      • updater.exe (PID: 1760)
      • updater.exe (PID: 1812)
      • setup.exe (PID: 5988)
      • setup.exe (PID: 2596)
      • updater.exe (PID: 8792)

    • Executes as Windows Service

      • updater.exe (PID: 1760)
      • updater.exe (PID: 1812)
      • updater.exe (PID: 8792)

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 6940)
      • wscript.exe (PID: 7208)

    • Hides command output

      • cmd.exe (PID: 1512)
      • cmd.exe (PID: 7312)

    • Script adds exclusion path to Windows Defender

      • wscript.exe (PID: 7208)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 924)

    • Creates a Stream, which may work with files, input/output devices, pipes, or TCP/IP sockets (SCRIPT)

      • wscript.exe (PID: 7208)

    • Writes binary data to a Stream object (SCRIPT)

      • wscript.exe (PID: 7208)

    • Saves data to a binary file (SCRIPT)

      • wscript.exe (PID: 7208)

    • Reads the Windows owner or organization settings

      • app1.tmp (PID: 1600)
      • app1.tmp (PID: 5232)

    • Creates a Folder object (SCRIPT)

      • wscript.exe (PID: 7208)

    • Process drops legitimate windows executable

      • app1.tmp (PID: 5232)

    • Searches for installed software

      • setup.exe (PID: 5988)

    • Creates a software uninstall entry

      • setup.exe (PID: 5988)
      • chrome.exe (PID: 6708)

    • Connects to unusual port

      • InstallUtil.exe (PID: 2236)

  • INFO

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 7352)
      • msedge.exe (PID: 6876)

    • Reads Environment values

      • identity_helper.exe (PID: 8188)

    • Checks supported languages

      • Chrоmе-x64.exe (PID: 8136)
      • 6cd80185217f4eeea64ce70cf9a1c659.exe (PID: 7156)
      • 6cd80185217f4eeea64ce70cf9a1c659.exe (PID: 7440)
      • updater.exe (PID: 2240)
      • updater.exe (PID: 1760)
      • updater.exe (PID: 6080)
      • updater.exe (PID: 6652)
      • updater.exe (PID: 1812)
      • updater.exe (PID: 2088)
      • identity_helper.exe (PID: 8188)
      • app1.exe (PID: 6960)
      • app1.exe (PID: 1532)
      • app1.tmp (PID: 1600)
      • app1.tmp (PID: 5232)
      • 135.0.7049.95_chrome_installer.exe (PID: 6876)
      • setup.exe (PID: 5988)
      • setup.exe (PID: 7312)
      • stickies.exe (PID: 728)
      • setup.exe (PID: 2596)
      • setup.exe (PID: 5600)
      • InstallUtil.exe (PID: 2236)
      • elevation_service.exe (PID: 3768)
      • updater.exe (PID: 8792)
      • updater.exe (PID: 6044)

    • The sample compiled with english language support

      • Chrоmе-x64.exe (PID: 8136)
      • updater.exe (PID: 6080)
      • updater.exe (PID: 1760)
      • app1.tmp (PID: 5232)
      • 135.0.7049.95_chrome_installer.exe (PID: 6876)
      • setup.exe (PID: 5988)
      • msedge.exe (PID: 6876)

    • Process checks computer location settings

      • Chrоmе-x64.exe (PID: 8136)
      • 6cd80185217f4eeea64ce70cf9a1c659.exe (PID: 7156)
      • app1.tmp (PID: 1600)

    • Reads the computer name

      • identity_helper.exe (PID: 8188)
      • Chrоmе-x64.exe (PID: 8136)
      • 6cd80185217f4eeea64ce70cf9a1c659.exe (PID: 7156)
      • updater.exe (PID: 6080)
      • 6cd80185217f4eeea64ce70cf9a1c659.exe (PID: 7440)
      • updater.exe (PID: 1760)
      • updater.exe (PID: 1812)
      • app1.tmp (PID: 1600)
      • app1.tmp (PID: 5232)
      • 135.0.7049.95_chrome_installer.exe (PID: 6876)
      • setup.exe (PID: 5988)
      • setup.exe (PID: 2596)
      • InstallUtil.exe (PID: 2236)
      • stickies.exe (PID: 728)
      • elevation_service.exe (PID: 3768)
      • updater.exe (PID: 8792)

    • Creates files in the program directory

      • Chrоmе-x64.exe (PID: 8136)
      • 6cd80185217f4eeea64ce70cf9a1c659.exe (PID: 7440)
      • updater.exe (PID: 2240)
      • updater.exe (PID: 6080)
      • updater.exe (PID: 1760)
      • updater.exe (PID: 1812)
      • setup.exe (PID: 5988)
      • setup.exe (PID: 2596)
      • updater.exe (PID: 8792)

    • Checks proxy server information

      • Chrоmе-x64.exe (PID: 8136)
      • updater.exe (PID: 6080)
      • wscript.exe (PID: 7208)
      • InstallUtil.exe (PID: 2236)
      • slui.exe (PID: 2288)

    • Create files in a temporary directory

      • Chrоmе-x64.exe (PID: 8136)
      • updater.exe (PID: 6080)
      • app1.exe (PID: 6960)
      • app1.exe (PID: 1532)
      • app1.tmp (PID: 1600)
      • app1.tmp (PID: 5232)

    • Reads the software policy settings

      • Chrоmе-x64.exe (PID: 8136)
      • updater.exe (PID: 6080)
      • updater.exe (PID: 1812)
      • slui.exe (PID: 2284)
      • updater.exe (PID: 8792)
      • slui.exe (PID: 2288)

    • Process checks whether UAC notifications are on

      • updater.exe (PID: 6080)
      • updater.exe (PID: 1760)
      • updater.exe (PID: 1812)
      • updater.exe (PID: 8792)

    • Creates files or folders in the user directory

      • updater.exe (PID: 6080)
      • app1.tmp (PID: 5232)

    • Reads the machine GUID from the registry

      • updater.exe (PID: 6080)
      • stickies.exe (PID: 728)
      • InstallUtil.exe (PID: 2236)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 1748)
      • powershell.exe (PID: 6640)

    • Application launched itself

      • msedge.exe (PID: 7352)
      • chrome.exe (PID: 6708)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 1748)
      • powershell.exe (PID: 6640)

    • Manual execution by a user

      • chrome.exe (PID: 6708)

    • Executes as Windows Service

      • elevation_service.exe (PID: 3768)

    • Disables trace logs

      • InstallUtil.exe (PID: 2236)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
273
Monitored processes
132
Malicious processes
16
Suspicious processes
3

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
632"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=135.0.7049.95 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ffc895f0ca8,0x7ffc895f0cb4,0x7ffc895f0cc0C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
135.0.7049.95
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
728"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7532 --field-trial-handle=2304,i,7453300841980651450,8044059553740615310,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
728"C:\Users\admin\AppData\Roaming\{FFD73791-AE24-408C-88A7-C794B2982BFF}\stickies.exe" C:\Users\admin\AppData\Roaming\{FFD73791-AE24-408C-88A7-C794B2982BFF}\stickies.exe—app1.tmp
User:
admin
Company:
Zhorn Software
Integrity Level:
HIGH
Description:
Stickies 10.2a
Exit code:
4294967295
Version:
10.2a
Modules
Images
c:\users\admin\appdata\roaming\{ffd73791-ae24-408c-88a7-c794b2982bff}\stickies.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
920"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5628 --field-trial-handle=2304,i,7453300841980651450,8044059553740615310,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
924schtasks /delete /tn "WinSvcUpd" /f C:\Windows\SysWOW64\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
1020"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=1364 --field-trial-handle=2304,i,7453300841980651450,8044059553740615310,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1052"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6668 --field-trial-handle=2304,i,7453300841980651450,8044059553740615310,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
3221226029
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\identity_helper.exe
c:\windows\system32\ntdll.dll
1180"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1924,i,12130139572608589776,1095602225646388212,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
135.0.7049.95
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\135.0.7049.95\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1324"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7288 --field-trial-handle=2304,i,7453300841980651450,8044059553740615310,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1512"C:\Windows\System32\cmd.exe" /c schtasks /delete /tn "WinSvcUpd" /f >nul 2>&1C:\Windows\SysWOW64\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
42 986
Read events
42 672
Write events
278
Delete events
36

Modification events

(PID) Process:(7352) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(7352) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(7352) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(7352) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(7352) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
CBFE5C3F90912F00
(PID) Process:(7352) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
3B1F673F90912F00
(PID) Process:(7352) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\197384
Operation:writeName:WindowTabManagerFileMappingId
Value:
{DD573E15-451D-4BDC-B720-FB631FE60C16}
(PID) Process:(7352) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\197384
Operation:writeName:WindowTabManagerFileMappingId
Value:
{3779BF2B-73A9-4247-B97B-9B4F5BD0031A}
(PID) Process:(7352) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\197384
Operation:writeName:WindowTabManagerFileMappingId
Value:
{34A323E3-2FD2-4AF3-BF9D-7993807521A8}
(PID) Process:(7352) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\197384
Operation:writeName:WindowTabManagerFileMappingId
Value:
{5A720DCB-24BA-4B4A-B3E2-36BDF8E3E76D}
Executable files
63
Suspicious files
469
Text files
160
Unknown types
0

Dropped files

PID
Process
Filename
Type
7352msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF10b79a.TMP —
MD5:—
SHA256:—
7352msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
7352msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF10b79a.TMP —
MD5:—
SHA256:—
7352msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF10b79a.TMP —
MD5:—
SHA256:—
7352msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF10b7c9.TMP —
MD5:—
SHA256:—
7352msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
7352msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
7352msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
7352msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF10b7f7.TMP —
MD5:—
SHA256:—
7352msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
79
TCP/UDP connections
96
DNS requests
117
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.25:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
825 b
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
DE
binary
471 b
whitelisted
2692
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
QA
binary
419 b
whitelisted
6080
updater.exe
GET
200
142.250.185.67:80
http://c.pki.goog/r/gsr1.crl
US
binary
1.70 Kb
whitelisted
6080
updater.exe
GET
200
142.250.185.67:80
http://c.pki.goog/r/r4.crl
US
binary
530 b
whitelisted
2692
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
QA
binary
407 b
whitelisted
1812
updater.exe
GET
—
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome/i6b46ucx6fkdzfmqjjky7bde7e_135.0.7049.95/-8a69d345-d564-463c-aff1-a69d9e530f96-_135.0.7049.95_all_arth6wi2lfg6mi6gy5vzz4k7ge.crx3
US
—
—
whitelisted
6828
svchost.exe
HEAD
200
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9b9f8fb4-8a65-41e4-bda3-5416858f0aeb?P1=1745355037&P2=404&P3=2&P4=ETE61jjdEfqGmzxr6KbmqImZ51Aa89YAsmA%2bpQdA1sowvrU0CiSZ%2bSdI4Fhij8YuTtX0J6OJFre8DdxGHfUKCw%3d%3d
US
—
—
whitelisted
6828
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9b9f8fb4-8a65-41e4-bda3-5416858f0aeb?P1=1745355037&P2=404&P3=2&P4=ETE61jjdEfqGmzxr6KbmqImZ51Aa89YAsmA%2bpQdA1sowvrU0CiSZ%2bSdI4Fhij8YuTtX0J6OJFre8DdxGHfUKCw%3d%3d
US
binary
1.10 Kb
whitelisted
6080
updater.exe
GET
200
142.250.185.227:80
http://o.pki.goog/we2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEQDQZgpWpezrXAmFnbj86J49
US
binary
279 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.25:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7352
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
7628
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7628
msedge.exe
150.171.28.11:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7628
msedge.exe
13.107.246.45:443
edge-mobile-static.azureedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7628
msedge.exe
13.107.6.158:443
business.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7628
msedge.exe
69.62.123.117:443
chrome.browser.com.se
REGION16-ESC
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.216.77.25
  • 23.216.77.31
  • 23.216.77.37
  • 23.216.77.13
  • 23.216.77.29
  • 23.216.77.35
  • 23.216.77.28
  • 23.216.77.18
  • 23.216.77.42
whitelisted
google.com
  • 142.250.185.142
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 150.171.28.11
  • 150.171.27.11
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.45
whitelisted
chrome.browser.com.se
  • 69.62.123.117
unknown
business.bing.com
  • 13.107.6.158
whitelisted
bzib.nelreports.net
  • 2.16.168.113
  • 2.16.168.107
  • 23.50.131.78
  • 23.50.131.74
whitelisted
www.bing.com
  • 92.123.104.57
  • 92.123.104.45
  • 92.123.104.58
  • 92.123.104.54
  • 92.123.104.53
  • 92.123.104.46
  • 92.123.104.43
  • 92.123.104.47
  • 92.123.104.50
  • 92.123.104.19
  • 92.123.104.26
  • 92.123.104.18
  • 92.123.104.29
  • 92.123.104.33
  • 92.123.104.25
  • 92.123.104.22
  • 92.123.104.23
  • 92.123.104.28
whitelisted

Threats

PID
Process
Class
Message
2236
InstallUtil.exe
A Network Trojan was detected
ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M3 (GET)
2236
InstallUtil.exe
A Network Trojan was detected
ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://chrome.browser.com.se/