download: | Tumeg.exe |
Full analysis: | https://app.any.run/tasks/560e8abf-6d73-4b83-b0f7-2f2a62722cdd |
Verdict: | Malicious activity |
Analysis date: | July 28, 2023, 15:47:34 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | E5655066C86F74F6B444F66F3222CE07 |
SHA1: | C9F8053202994EE734ECD76D09B56F57F539102E |
SHA256: | 062DE0A9FA284C56323CCAA5CF9B4A70801234B129744E1DEF53B29A7A86B8CD |
SSDEEP: | 3072:5eFRQGCIIm1xn5GWp1icKAArDZz4N9GhbkrNEk4fH7YEqZuk8Ox:CQGCIImNp0yN90QE7fUv |
.exe | | | Win32 MS Cabinet Self-Extractor (WExtract stub) (86.7) |
---|---|---|
.exe | | | Win32 Executable MS Visual C++ (generic) (8.9) |
.dll | | | Win32 Dynamic Link Library (generic) (1.8) |
.exe | | | Win32 Executable (generic) (1.2) |
.exe | | | Generic Win/DOS Executable (0.5) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2013:10:14 05:50:27+00:00 |
ImageFileCharacteristics: | Executable, 32-bit |
PEType: | PE32 |
LinkerVersion: | 11 |
CodeSize: | 26112 |
InitializedDataSize: | 138752 |
UninitializedDataSize: | - |
EntryPoint: | 0x67cc |
OSVersion: | 6.3 |
ImageVersion: | 6.3 |
SubsystemVersion: | 5.1 |
Subsystem: | Windows GUI |
FileVersionNumber: | 11.0.9600.16428 |
ProductVersionNumber: | 11.0.9600.16428 |
FileFlagsMask: | 0x003f |
FileFlags: | (none) |
FileOS: | Windows NT 32-bit |
ObjectFileType: | Executable application |
FileSubtype: | - |
LanguageCode: | English (U.S.) |
CharacterSet: | Unicode |
CompanyName: | Microsoft Corporation |
FileDescription: | Win32 Cabinet Self-Extractor |
FileVersion: | 11.00.9600.16428 (winblue_gdr.131013-1700) |
InternalName: | Wextract |
LegalCopyright: | © Microsoft Corporation. All rights reserved. |
OriginalFileName: | WEXTRACT.EXE .MUI |
ProductName: | Internet Explorer |
ProductVersion: | 11.00.9600.16428 |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 14-Oct-2013 05:50:27 |
Detected languages: |
|
Debug artifacts: |
|
CompanyName: | Microsoft Corporation |
FileDescription: | Win32 Kabin Ayıklayıcısı |
FileVersion: | 11.00.9600.16428 (winblue_gdr.131013-1700) |
InternalName: | Wextract |
LegalCopyright: | © Microsoft Corporation. Tüm hakları saklıdır. |
OriginalFilename: | WEXTRACT.EXE .MUI |
ProductName: | Internet Explorer |
ProductVersion: | 11.00.9600.16428 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x000000E8 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 5 |
Time date stamp: | 14-Oct-2013 05:50:27 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x000065CC | 0x00006600 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.3849 |
.data | 0x00008000 | 0x00001A8C | 0x00000400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.17593 |
.idata | 0x0000A000 | 0x00001078 | 0x00001200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.04858 |
.rsrc | 0x0000C000 | 0x00020000 | 0x0001F400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 6.87528 |
.reloc | 0x0002C000 | 0x000013AE | 0x00001400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 3.72277 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.05393 | 1511 | Latin 1 / Western European | English - United States | RT_MANIFEST |
2 | 3.15864 | 744 | Latin 1 / Western European | English - United States | RT_ICON |
3 | 3.07737 | 488 | Latin 1 / Western European | English - United States | RT_ICON |
4 | 3.50949 | 296 | Latin 1 / Western European | English - United States | RT_ICON |
5 | 5.56662 | 3752 | Latin 1 / Western European | English - United States | RT_ICON |
6 | 5.94251 | 2216 | Latin 1 / Western European | English - United States | RT_ICON |
7 | 5.99361 | 1736 | Latin 1 / Western European | English - United States | RT_ICON |
8 | 3.37828 | 1384 | Latin 1 / Western European | English - United States | RT_ICON |
9 | 7.98515 | 55762 | Latin 1 / Western European | English - United States | RT_ICON |
10 | 5.33023 | 9640 | Latin 1 / Western European | English - United States | RT_ICON |
ADVAPI32.dll |
COMCTL32.dll |
Cabinet.dll |
GDI32.dll |
KERNEL32.dll |
USER32.dll |
VERSION.dll |
msvcrt.dll |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1004 | "C:\Users\admin\Downloads\Tumeg.exe" | C:\Users\admin\Downloads\Tumeg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Win32 Cabinet Self-Extractor Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
2908 | cmd /c "Tumeg.bat" | C:\Windows\System32\cmd.exe | — | Tumeg.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
3004 | net session | C:\Windows\System32\net.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Net Command Exit code: 2 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3120 | C:\Windows\system32\net1 session | C:\Windows\System32\net1.exe | — | net.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Net Command Exit code: 2 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
3160 | timeout /t 3 | C:\Windows\System32\timeout.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: timeout - pauses command processing Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3292 | "C:\Windows\explorer.exe" | C:\Windows\explorer.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2880 | "C:\Users\admin\Downloads\Tumeg.exe" | C:\Users\admin\Downloads\Tumeg.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Win32 Cabinet Self-Extractor Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
3080 | cmd /c "Tumeg.bat" | C:\Windows\System32\cmd.exe | — | Tumeg.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 255 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
2948 | net session | C:\Windows\System32\net.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Net Command Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3376 | C:\Windows\system32\net1 session | C:\Windows\System32\net1.exe | — | net.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Net Command Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
|
(PID) Process: | (1452) reg.exe | Key: | HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics |
Operation: | write | Name: | IconSpacing |
Value: -1125 | |||
(PID) Process: | (2408) reg.exe | Key: | HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics |
Operation: | write | Name: | IconVerticalSpacing |
Value: -1125 | |||
(PID) Process: | (1764) reg.exe | Key: | HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics |
Operation: | write | Name: | IconFont |
Value: F5FFFFFF0000000000000000000000009001000000000001000000005400610068006F006D00610000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
(PID) Process: | (3264) explorer.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (3264) explorer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer |
Operation: | write | Name: | CleanShutdown |
Value: 0 | |||
(PID) Process: | (3264) explorer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{e1a82db3-a9f0-11e7-b142-806e6f6e6963} |
Operation: | write | Name: | Data |
Value: 000000000DF0ADBA01000000080000000000008000000000000000300000000000000000FF00E703FF0000001600000084BAB9BC0400000000000000000000000000000000000000000000000000000000005C005C003F005C00530054004F005200410047004500230056006F006C0075006D00650023007B00330039006300390063006500660032002D0036003600380036002D0031003100650064002D0039006300320034002D003800300036006500360066003600650036003900360033007D002300300030003000300030003000300030003000300031003000300030003000300023007B00350033006600350036003300300064002D0062003600620066002D0031003100640030002D0039003400660032002D003000300061003000630039003100650066006200380062007D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005C005C003F005C0056006F006C0075006D0065007B00650031006100380032006400620033002D0061003900660030002D0031003100650037002D0062003100340032002D003800300036006500360066003600650036003900360033007D005C000000530079007300740065006D002000520065007300650072007600650064000000000000000000000000000000000000000000000000000000000000000000000000004E005400460053000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000 | |||
(PID) Process: | (3264) explorer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{e1a82db3-a9f0-11e7-b142-806e6f6e6963} |
Operation: | write | Name: | Generation |
Value: 1 | |||
(PID) Process: | (3264) explorer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{e1a82db4-a9f0-11e7-b142-806e6f6e6963} |
Operation: | write | Name: | Data |
Value: 000000000DF0ADBA41000000080000000000008000000000000000300000000000000000FF00E703FF000000160000004736BAC40440000001000000000000000000000000000000000000000000000000005C005C003F005C00530054004F005200410047004500230056006F006C0075006D00650023007B00330039006300390063006500660032002D0036003600380036002D0031003100650064002D0039006300320034002D003800300036006500360066003600650036003900360033007D002300300030003000300030003000300030003000360035003000300030003000300023007B00350033006600350036003300300064002D0062003600620066002D0031003100640030002D0039003400660032002D003000300061003000630039003100650066006200380062007D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005C005C003F005C0056006F006C0075006D0065007B00650031006100380032006400620034002D0061003900660030002D0031003100650037002D0062003100340032002D003800300036006500360066003600650036003900360033007D005C0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004E005400460053000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000 | |||
(PID) Process: | (3264) explorer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{e1a82db4-a9f0-11e7-b142-806e6f6e6963} |
Operation: | write | Name: | Generation |
Value: 1 | |||
(PID) Process: | (2064) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
Operation: | write | Name: | failed_count |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1004 | Tumeg.exe | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\Tumeg.bat | text | |
MD5:6FD336E404C820CEA27C1AB6F627189C | SHA256:2E5731639E0F5EED877B8A6EFC4F765E0AFCF1065F5046F963ABCC9DF818A163 | |||
2964 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old | text | |
MD5:926717F34832DBC5C58A310AF5E026E4 | SHA256:9C3C29EC97ECC5659F81DE0F332B8D6AF6C01758F47183760BD988027362D0AA | |||
3080 | cmd.exe | C:\type.vbs | text | |
MD5:B778C0DC1BE72A073AF8D2B071B7FFE6 | SHA256:3947ACBF485BFDA0B12BE11262A8795D4EB27687B1D698C124861D72A1A7795B | |||
2964 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old~RF17d8bc.TMP | text | |
MD5:BD5CD22E636467F28E2C24A92D290B66 | SHA256:DB1F820AD04E45C418BA5CC43454625D31578416EAEB6CF0F653EBF491238876 | |||
3080 | cmd.exe | C:\Windows\System32\config\startup.bat | text | |
MD5:EEB086A7854DAE6CDCE64F49EB87D64C | SHA256:5822C2222C4A4121A1667C7D483FF8B91E489A4C5E881C75A4354712BFE6F435 | |||
3080 | cmd.exe | C:\Windows\System32\config\startup3.bat | text | |
MD5:EEB086A7854DAE6CDCE64F49EB87D64C | SHA256:5822C2222C4A4121A1667C7D483FF8B91E489A4C5E881C75A4354712BFE6F435 | |||
3080 | cmd.exe | C:\Users\admin\AppData\Local\Temp\links.vbs | text | |
MD5:DC9C3AC308A3CFBD8988083C62575B3C | SHA256:E2432D38BABDBFDAE24B33C83AF99082019FD559B28D9EB67A984A1308D8F63C | |||
2880 | Tumeg.exe | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\Tumeg.bat | text | |
MD5:6FD336E404C820CEA27C1AB6F627189C | SHA256:2E5731639E0F5EED877B8A6EFC4F765E0AFCF1065F5046F963ABCC9DF818A163 | |||
3080 | cmd.exe | C:\Windows\System32\config\regs.reg | text | |
MD5:BC949EA893A9384070C31F083CCEFD26 | SHA256:6BDF66B5BF2A44E658BEA2EE86695AB150A06E600BF67CD5CCE245AD54962C61 | |||
2964 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\optimization_guide_hint_cache_store\LOG.old~RF17db5c.TMP | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2452 | msedge.exe | GET | 204 | 13.107.6.158:80 | http://edge-http.microsoft.com/captiveportal/generate_204 | US | — | — | whitelisted |
2452 | msedge.exe | GET | 204 | 13.107.6.158:80 | http://edge-http.microsoft.com/captiveportal/generate_204 | US | — | — | whitelisted |
860 | svchost.exe | HEAD | 200 | 152.199.19.161:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/c05cb1de-4095-47e9-9aeb-6f81b6e7204b?P1=1691151079&P2=404&P3=2&P4=Jh4fjCvqyqSN3Gh7OR5ipU1hNZlakzbdeqdRZI5OpzNuyqNrsoXNgToLCgRJv1reDht3rhsUIGXdfSNb5wP1Hg%3d%3d | US | — | — | whitelisted |
860 | svchost.exe | GET | 206 | 152.199.19.161:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/c05cb1de-4095-47e9-9aeb-6f81b6e7204b?P1=1691151079&P2=404&P3=2&P4=Jh4fjCvqyqSN3Gh7OR5ipU1hNZlakzbdeqdRZI5OpzNuyqNrsoXNgToLCgRJv1reDht3rhsUIGXdfSNb5wP1Hg%3d%3d | US | binary | 3.11 Kb | whitelisted |
860 | svchost.exe | GET | 206 | 152.199.19.161:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/c05cb1de-4095-47e9-9aeb-6f81b6e7204b?P1=1691151079&P2=404&P3=2&P4=Jh4fjCvqyqSN3Gh7OR5ipU1hNZlakzbdeqdRZI5OpzNuyqNrsoXNgToLCgRJv1reDht3rhsUIGXdfSNb5wP1Hg%3d%3d | US | binary | 12.3 Kb | whitelisted |
860 | svchost.exe | HEAD | 200 | 152.199.19.161:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/c6e779a0-da6d-4ac5-a811-faca5f1d5ab6?P1=1691151080&P2=404&P3=2&P4=dIuV0dsf%2fsZe%2fRt83j13hg1JqkxzISxa43VLlxWOH8sK%2bAiQYW3QTP6g7TDX0KILI%2b%2fNWxPDTJbpj3yEd9E6pw%3d%3d | US | binary | 13.5 Kb | whitelisted |
860 | svchost.exe | GET | 206 | 152.199.19.161:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ebe922cc-14e3-411b-9f77-f95f981eedae?P1=1691151082&P2=404&P3=2&P4=OHvGc0Xp%2b%2fxAdR9xk0oLwU6drXopA%2f0T2YjoEQUBlCMDCNmnm2%2f%2baC8HdsMTeha04GiCQ5qheDCtdtavtDUHug%3d%3d | US | binary | 9.14 Kb | whitelisted |
860 | svchost.exe | GET | 206 | 152.199.19.161:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/a5d28923-29ce-4abc-9c53-b0badc436559?P1=1691151080&P2=404&P3=2&P4=J4GvqwqI%2bJErIiKqG24AxN6s08%2f38OHJW85p5ZIgNDoLjd2ie0kIw5o3%2bebVCRY2cfziEHCFgRwijk8eN4pkzw%3d%3d | US | binary | 1.18 Mb | whitelisted |
860 | svchost.exe | HEAD | 200 | 152.199.19.161:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ebe922cc-14e3-411b-9f77-f95f981eedae?P1=1691151082&P2=404&P3=2&P4=OHvGc0Xp%2b%2fxAdR9xk0oLwU6drXopA%2f0T2YjoEQUBlCMDCNmnm2%2f%2baC8HdsMTeha04GiCQ5qheDCtdtavtDUHug%3d%3d | US | binary | 3.11 Kb | whitelisted |
860 | svchost.exe | GET | 206 | 152.199.19.161:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/a5d28923-29ce-4abc-9c53-b0badc436559?P1=1691151080&P2=404&P3=2&P4=J4GvqwqI%2bJErIiKqG24AxN6s08%2f38OHJW85p5ZIgNDoLjd2ie0kIw5o3%2bebVCRY2cfziEHCFgRwijk8eN4pkzw%3d%3d | US | binary | 280 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2452 | msedge.exe | 142.250.186.174:443 | youtu.be | GOOGLE | US | whitelisted |
2452 | msedge.exe | 204.79.197.239:443 | edge.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
2452 | msedge.exe | 13.107.42.16:443 | config.edge.skype.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
1088 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
2964 | msedge.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
2640 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
2452 | msedge.exe | 2.23.209.149:443 | www.bing.com | Akamai International B.V. | GB | suspicious |
2452 | msedge.exe | 40.114.177.156:443 | duckduckgo.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | suspicious |
Domain | IP | Reputation |
---|---|---|
config.edge.skype.com |
| whitelisted |
youtu.be |
| shared |
edge.microsoft.com |
| whitelisted |
duckduckgo.com |
| whitelisted |
resolver1.opendns.com |
| shared |
222.222.67.208.in-addr.arpa |
| unknown |
www.bing.com |
| whitelisted |
links.duckduckgo.com |
| whitelisted |
myip.opendns.com |
| shared |
external-content.duckduckgo.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
3060 | nslookup.exe | Device Retrieving External IP Address Detected | ET POLICY External IP Lookup Domain (myip .opendns .com in DNS lookup) |
3060 | nslookup.exe | Device Retrieving External IP Address Detected | ET POLICY External IP Lookup Domain (myip .opendns .com in DNS lookup) |
Process | Message |
---|---|
msedge.exe | [0728/164814.339:ERROR:exception_handler_server.cc(527)] ConnectNamedPipe: The pipe is being closed. (0xE8)
|
msedge.exe | [0728/164823.305:ERROR:exception_handler_server.cc(527)] ConnectNamedPipe: The pipe is being closed. (0xE8)
|
msedge.exe | [0728/164831.342:ERROR:exception_handler_server.cc(527)] ConnectNamedPipe: The pipe is being closed. (0xE8)
|
msedge.exe | [0728/164840.385:ERROR:exception_handler_server.cc(527)] ConnectNamedPipe: The pipe is being closed. (0xE8)
|
msedge.exe | [0728/164848.413:ERROR:exception_handler_server.cc(527)] ConnectNamedPipe: The pipe is being closed. (0xE8)
|
msedge.exe | [0728/164856.418:ERROR:exception_handler_server.cc(527)] ConnectNamedPipe: The pipe is being closed. (0xE8)
|
msedge.exe | [0728/164903.404:ERROR:exception_handler_server.cc(527)] ConnectNamedPipe: The pipe is being closed. (0xE8)
|
msedge.exe | [0728/164912.399:ERROR:exception_handler_server.cc(527)] ConnectNamedPipe: The pipe is being closed. (0xE8)
|
msedge.exe | [0728/164921.402:ERROR:exception_handler_server.cc(527)] ConnectNamedPipe: The pipe is being closed. (0xE8)
|
msedge.exe | [0728/164930.425:ERROR:exception_handler_server.cc(527)] ConnectNamedPipe: The pipe is being closed. (0xE8)
|