URL:

https://www.cheatengine.org/downloads.php

Full analysis: https://app.any.run/tasks/21697943-d100-4228-ade0-6dcee507d347
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: December 29, 2024, 15:40:00
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
stealer
arch-html
Indicators:
MD5:

5FBBF01C2EB9C3BA9FCBF4E53CD9CCC8

SHA1:

849ADDD6D9786E9F31A17B50960165D8DD853D5E

SHA256:

0E2C7E997B747C964A288B75BD35A684F63870CAB73D03640DC9A77AA22020A1

SSDEEP:

3:N8DSLHMLV:2OLH2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • CheatEngine75.tmp (PID: 7656)
      • net.exe (PID: 8160)
      • net.exe (PID: 7900)

    • Steals credentials from Web Browsers

      • avg_secure_browser_setup.exe (PID: 7540)

    • Actions looks like stealing of personal data

      • avg_secure_browser_setup.exe (PID: 7540)
      • servicehost.exe (PID: 4628)
      • uihost.exe (PID: 7360)

    • Changes the autorun value in the registry

      • setup.exe (PID: 7404)
      • AVGBrowser.exe (PID: 2804)
      • AVGBrowser.exe (PID: 4640)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • CheatEngine75.exe (PID: 7308)
      • CheatEngine75.exe (PID: 2736)
      • CheatEngine75.tmp (PID: 5432)
      • WZSetup.exe (PID: 7536)
      • CheatEngine75.exe (PID: 7592)
      • avg_secure_browser_setup.exe (PID: 7540)
      • saBSI.exe (PID: 7500)
      • CheatEngine75.tmp (PID: 7656)
      • AVGBrowserUpdateSetup.exe (PID: 4556)
      • installer.exe (PID: 7808)
      • AVGBrowserUpdate.exe (PID: 6004)
      • installer.exe (PID: 7080)
      • AVGBrowserInstaller.exe (PID: 2212)
      • setup.exe (PID: 7404)

    • Reads security settings of Internet Explorer

      • CheatEngine75.tmp (PID: 7328)
      • CheatEngine75.tmp (PID: 5432)
      • saBSI.exe (PID: 7500)
      • WZSetup.exe (PID: 7536)
      • avg_secure_browser_setup.exe (PID: 7540)
      • installer.exe (PID: 7080)
      • AVGBrowserUpdate.exe (PID: 6004)
      • Cheat Engine.exe (PID: 6480)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7952)
      • uihost.exe (PID: 7360)
      • AVGBrowserProtect.exe (PID: 9084)
      • AVGBrowser.exe (PID: 8568)

    • Reads the Windows owner or organization settings

      • CheatEngine75.tmp (PID: 5432)
      • CheatEngine75.tmp (PID: 7656)

    • Checks Windows Trust Settings

      • saBSI.exe (PID: 7500)
      • WZSetup.exe (PID: 7536)
      • avg_secure_browser_setup.exe (PID: 7540)
      • installer.exe (PID: 7080)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7952)
      • uihost.exe (PID: 7360)
      • servicehost.exe (PID: 4628)
      • updater.exe (PID: 8008)

    • The process verifies whether the antivirus software is installed

      • saBSI.exe (PID: 7500)
      • avg_secure_browser_setup.exe (PID: 7540)
      • installer.exe (PID: 7808)
      • AVGBrowserUpdate.exe (PID: 6004)
      • AVGBrowserUpdate.exe (PID: 6976)
      • AVGBrowserUpdate.exe (PID: 7760)
      • AVGBrowserUpdateComRegisterShell64.exe (PID: 6996)
      • AVGBrowserUpdateComRegisterShell64.exe (PID: 7948)
      • AVGBrowserUpdateComRegisterShell64.exe (PID: 6800)
      • AVGBrowserUpdate.exe (PID: 7236)
      • installer.exe (PID: 7080)
      • AVGBrowserUpdate.exe (PID: 3052)
      • AVGBrowserUpdate.exe (PID: 7252)
      • AVGBrowserInstaller.exe (PID: 2212)
      • setup.exe (PID: 8024)
      • uihost.exe (PID: 7360)
      • cmd.exe (PID: 5892)
      • cmd.exe (PID: 7620)
      • updater.exe (PID: 8008)
      • setup.exe (PID: 7404)
      • cmd.exe (PID: 7784)
      • AVGBrowserCrashHandler64.exe (PID: 3840)
      • AVGBrowserCrashHandler.exe (PID: 7904)
      • AVGBrowser.exe (PID: 1356)
      • AVGBrowser.exe (PID: 2804)
      • servicehost.exe (PID: 4628)
      • AVGBrowser.exe (PID: 5040)
      • elevation_service.exe (PID: 2084)
      • AVGBrowser.exe (PID: 4968)
      • AVGBrowser.exe (PID: 7252)
      • AVGBrowser.exe (PID: 8032)
      • AVGBrowser.exe (PID: 7604)
      • AVGBrowser.exe (PID: 7552)
      • AVGBrowser.exe (PID: 8056)
      • AVGBrowser.exe (PID: 8088)
      • elevation_service.exe (PID: 4640)
      • AVGBrowser.exe (PID: 3640)
      • AVGBrowser.exe (PID: 7612)
      • AVGBrowser.exe (PID: 4536)
      • AVGBrowser.exe (PID: 5040)
      • elevation_service.exe (PID: 7548)
      • AVGBrowser.exe (PID: 7928)
      • AVGBrowser.exe (PID: 7184)
      • AVGBrowser.exe (PID: 8220)
      • AVGBrowser.exe (PID: 7356)
      • AVGBrowser.exe (PID: 2676)
      • AVGBrowser.exe (PID: 2484)
      • AVGBrowser.exe (PID: 8264)
      • AVGBrowser.exe (PID: 7044)
      • AVGBrowser.exe (PID: 3812)
      • AVGBrowser.exe (PID: 2484)
      • AVGBrowser.exe (PID: 8472)
      • AVGBrowser.exe (PID: 8484)
      • AVGBrowser.exe (PID: 4640)
      • AVGBrowser.exe (PID: 8572)
      • AVGBrowser.exe (PID: 8588)
      • AVGBrowser.exe (PID: 8656)
      • AVGBrowser.exe (PID: 8324)
      • AVGBrowser.exe (PID: 8828)
      • AVGBrowser.exe (PID: 8880)
      • AVGBrowser.exe (PID: 8972)
      • AVGBrowser.exe (PID: 8964)
      • AVGBrowser.exe (PID: 9076)
      • AVGBrowser.exe (PID: 8760)
      • AVGBrowser.exe (PID: 8708)
      • AVGBrowser.exe (PID: 8748)
      • AVGBrowser.exe (PID: 8924)
      • AVGBrowser.exe (PID: 9148)
      • AVGBrowser.exe (PID: 9156)
      • AVGBrowser.exe (PID: 3812)
      • AVGBrowser.exe (PID: 8204)
      • AVGBrowser.exe (PID: 1904)
      • AVGBrowser.exe (PID: 9164)
      • AVGBrowser.exe (PID: 3920)
      • AVGBrowser.exe (PID: 3744)
      • AVGBrowser.exe (PID: 9084)
      • AVGBrowser.exe (PID: 8328)
      • AVGBrowser.exe (PID: 8588)
      • AVGBrowser.exe (PID: 8604)
      • AVGBrowser.exe (PID: 8868)
      • AVGBrowser.exe (PID: 8776)
      • AVGBrowser.exe (PID: 8420)
      • AVGBrowser.exe (PID: 8616)
      • AVGBrowser.exe (PID: 9048)
      • AVGBrowserProtect.exe (PID: 9084)
      • AVGBrowser.exe (PID: 6972)
      • AVGBrowser.exe (PID: 8412)
      • setup.exe (PID: 2796)
      • setup.exe (PID: 6932)
      • AVGBrowser.exe (PID: 8568)
      • AVGBrowser.exe (PID: 8252)
      • AVGBrowser.exe (PID: 8216)
      • AVGBrowser.exe (PID: 8224)
      • AVGBrowser.exe (PID: 8384)
      • AVGBrowser.exe (PID: 8380)
      • AVGBrowser.exe (PID: 9200)

    • Reads the BIOS version

      • avg_secure_browser_setup.exe (PID: 7540)
      • AVGBrowser.exe (PID: 2804)
      • AVGBrowser.exe (PID: 4640)
      • AVGBrowser.exe (PID: 8252)

    • Starts SC.EXE for service management

      • CheatEngine75.tmp (PID: 7656)

    • Windows service management via SC.EXE

      • sc.exe (PID: 8072)
      • sc.exe (PID: 4872)

    • Uses ICACLS.EXE to modify access control lists

      • CheatEngine75.tmp (PID: 7656)

    • Searches for installed software

      • avg_secure_browser_setup.exe (PID: 7540)
      • updater.exe (PID: 8008)
      • setup.exe (PID: 7404)
      • AVGBrowser.exe (PID: 2804)
      • AVGBrowser.exe (PID: 4640)
      • setup.exe (PID: 6932)
      • AVGBrowser.exe (PID: 8252)

    • Process drops legitimate windows executable

      • CheatEngine75.tmp (PID: 7656)
      • installer.exe (PID: 7080)

    • Process drops SQLite DLL files

      • CheatEngine75.tmp (PID: 7656)

    • Adds/modifies Windows certificates

      • saBSI.exe (PID: 7500)
      • servicehost.exe (PID: 4628)

    • Disables SEHOP

      • AVGBrowserUpdate.exe (PID: 6004)

    • Starts itself from another location

      • AVGBrowserUpdate.exe (PID: 6004)

    • Creates/Modifies COM task schedule object

      • AVGBrowserUpdateComRegisterShell64.exe (PID: 6996)
      • AVGBrowserUpdateComRegisterShell64.exe (PID: 7948)
      • AVGBrowserUpdate.exe (PID: 6004)
      • AVGBrowserUpdate.exe (PID: 6976)
      • AVGBrowserUpdateComRegisterShell64.exe (PID: 6800)
      • installer.exe (PID: 7080)

    • Executes as Windows Service

      • AVGBrowserUpdate.exe (PID: 7252)
      • servicehost.exe (PID: 4628)
      • elevation_service.exe (PID: 2084)
      • elevation_service.exe (PID: 4640)
      • elevation_service.exe (PID: 7548)
      • elevation_service.exe (PID: 8900)

    • Detected use of alternative data streams (AltDS)

      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7952)

    • The process creates files with name similar to system file names

      • installer.exe (PID: 7080)
      • servicehost.exe (PID: 4628)

    • Executes application which crashes

      • CheatEngine75.tmp (PID: 5432)

    • Creates a software uninstall entry

      • installer.exe (PID: 7080)
      • servicehost.exe (PID: 4628)
      • setup.exe (PID: 7404)
      • avg_secure_browser_setup.exe (PID: 7540)
      • elevation_service.exe (PID: 4640)
      • elevation_service.exe (PID: 7548)

    • Reads Mozilla Firefox installation path

      • uihost.exe (PID: 7360)
      • servicehost.exe (PID: 4628)

    • Potential Corporate Privacy Violation

      • AVGBrowserUpdate.exe (PID: 7252)

    • Application launched itself

      • setup.exe (PID: 7404)
      • AVGBrowser.exe (PID: 2804)
      • AVGBrowser.exe (PID: 4640)
      • AVGBrowser.exe (PID: 8420)
      • setup.exe (PID: 6932)
      • AVGBrowser.exe (PID: 8252)

    • Starts CMD.EXE for commands execution

      • servicehost.exe (PID: 4628)
      • updater.exe (PID: 8008)

    • Hides command output

      • cmd.exe (PID: 7784)

    • The process checks if it is being run in the virtual environment

      • AVGBrowser.exe (PID: 4640)

    • Reads the date of Windows installation

      • AVGBrowser.exe (PID: 8568)

  • INFO

    • Application launched itself

      • msedge.exe (PID: 5156)

    • Reads the computer name

      • identity_helper.exe (PID: 7212)
      • CheatEngine75.tmp (PID: 7328)
      • CheatEngine75.exe (PID: 2736)
      • saBSI.exe (PID: 7500)
      • CheatEngine75.tmp (PID: 5432)
      • WZSetup.exe (PID: 7536)
      • CheatEngine75.tmp (PID: 7656)
      • avg_secure_browser_setup.exe (PID: 7540)
      • Kernelmoduleunloader.exe (PID: 4944)
      • AVGBrowserUpdate.exe (PID: 6004)
      • AVGBrowserUpdate.exe (PID: 7760)
      • AVGBrowserUpdate.exe (PID: 6976)
      • installer.exe (PID: 7080)
      • AVGBrowserUpdate.exe (PID: 3052)
      • AVGBrowserUpdate.exe (PID: 7252)
      • AVGBrowserUpdate.exe (PID: 7236)
      • Cheat Engine.exe (PID: 6480)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7952)
      • uihost.exe (PID: 7360)
      • servicehost.exe (PID: 4628)
      • AVGBrowserInstaller.exe (PID: 2212)
      • setup.exe (PID: 7404)
      • updater.exe (PID: 8008)
      • AVGBrowser.exe (PID: 2804)
      • AVGBrowser.exe (PID: 7252)
      • elevation_service.exe (PID: 2084)
      • AVGBrowser.exe (PID: 5040)
      • elevation_service.exe (PID: 4640)
      • AVGBrowser.exe (PID: 4640)
      • elevation_service.exe (PID: 7548)
      • AVGBrowser.exe (PID: 4536)
      • AVGBrowser.exe (PID: 7612)
      • AVGBrowser.exe (PID: 8420)
      • AVGBrowser.exe (PID: 8412)
      • AVGBrowserProtect.exe (PID: 9084)
      • AVGBrowser.exe (PID: 8568)
      • setup.exe (PID: 6932)
      • AVGBrowser.exe (PID: 8224)
      • AVGBrowser.exe (PID: 8252)

    • Reads Environment values

      • identity_helper.exe (PID: 7212)
      • avg_secure_browser_setup.exe (PID: 7540)
      • AVGBrowser.exe (PID: 2804)
      • AVGBrowser.exe (PID: 4640)
      • AVGBrowser.exe (PID: 8252)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 5156)
      • msedge.exe (PID: 6384)

    • Checks supported languages

      • identity_helper.exe (PID: 7212)
      • CheatEngine75.exe (PID: 7308)
      • CheatEngine75.tmp (PID: 7328)
      • CheatEngine75.exe (PID: 2736)
      • CheatEngine75.tmp (PID: 5432)
      • saBSI.exe (PID: 7500)
      • avg_secure_browser_setup.exe (PID: 7540)
      • WZSetup.exe (PID: 7536)
      • CheatEngine75.tmp (PID: 7656)
      • CheatEngine75.exe (PID: 7592)
      • _setup64.tmp (PID: 4228)
      • Kernelmoduleunloader.exe (PID: 4944)
      • AVGBrowserUpdateSetup.exe (PID: 4556)
      • AVGBrowserUpdate.exe (PID: 6004)
      • installer.exe (PID: 7808)
      • AVGBrowserUpdate.exe (PID: 7760)
      • AVGBrowserUpdate.exe (PID: 6976)
      • AVGBrowserUpdateComRegisterShell64.exe (PID: 6996)
      • AVGBrowserUpdateComRegisterShell64.exe (PID: 7948)
      • AVGBrowserUpdateComRegisterShell64.exe (PID: 6800)
      • installer.exe (PID: 7080)
      • AVGBrowserUpdate.exe (PID: 7252)
      • AVGBrowserUpdate.exe (PID: 3052)
      • AVGBrowserUpdate.exe (PID: 7236)
      • windowsrepair.exe (PID: 8056)
      • Cheat Engine.exe (PID: 6480)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7952)
      • servicehost.exe (PID: 4628)
      • uihost.exe (PID: 7360)
      • AVGBrowserInstaller.exe (PID: 2212)
      • setup.exe (PID: 7404)
      • setup.exe (PID: 8024)
      • updater.exe (PID: 8008)
      • AVGBrowser.exe (PID: 1356)
      • AVGBrowser.exe (PID: 2804)
      • AVGBrowserCrashHandler.exe (PID: 7904)
      • AVGBrowserCrashHandler64.exe (PID: 3840)
      • AVGBrowser.exe (PID: 5040)
      • AVGBrowser.exe (PID: 7252)
      • elevation_service.exe (PID: 2084)
      • AVGBrowser.exe (PID: 4968)
      • AVGBrowser.exe (PID: 8032)
      • AVGBrowser.exe (PID: 7604)
      • AVGBrowser.exe (PID: 8056)
      • AVGBrowser.exe (PID: 8088)
      • elevation_service.exe (PID: 4640)
      • AVGBrowser.exe (PID: 3640)
      • AVGBrowser.exe (PID: 4640)
      • AVGBrowser.exe (PID: 4536)
      • AVGBrowser.exe (PID: 7552)
      • AVGBrowser.exe (PID: 7612)
      • AVGBrowser.exe (PID: 5040)
      • elevation_service.exe (PID: 7548)
      • AVGBrowser.exe (PID: 7928)
      • AVGBrowser.exe (PID: 3812)
      • AVGBrowser.exe (PID: 7184)
      • AVGBrowser.exe (PID: 7356)
      • AVGBrowser.exe (PID: 2484)
      • AVGBrowser.exe (PID: 2676)
      • AVGBrowser.exe (PID: 8220)
      • AVGBrowser.exe (PID: 2484)
      • AVGBrowser.exe (PID: 7044)
      • AVGBrowser.exe (PID: 8324)
      • AVGBrowser.exe (PID: 8572)
      • AVGBrowser.exe (PID: 8484)
      • AVGBrowser.exe (PID: 8472)
      • AVGBrowser.exe (PID: 8588)
      • AVGBrowser.exe (PID: 8264)
      • AVGBrowser.exe (PID: 8880)
      • AVGBrowser.exe (PID: 8964)
      • AVGBrowser.exe (PID: 8972)
      • AVGBrowser.exe (PID: 8656)
      • AVGBrowser.exe (PID: 8708)
      • AVGBrowser.exe (PID: 8828)
      • AVGBrowser.exe (PID: 8748)
      • AVGBrowser.exe (PID: 8760)
      • AVGBrowser.exe (PID: 8924)
      • AVGBrowser.exe (PID: 9156)
      • AVGBrowser.exe (PID: 9148)
      • AVGBrowser.exe (PID: 1904)
      • AVGBrowser.exe (PID: 3812)
      • AVGBrowser.exe (PID: 8204)
      • AVGBrowser.exe (PID: 9164)
      • AVGBrowser.exe (PID: 3744)
      • AVGBrowser.exe (PID: 3920)
      • AVGBrowser.exe (PID: 9076)
      • AVGBrowser.exe (PID: 9084)
      • AVGBrowser.exe (PID: 8328)
      • AVGBrowser.exe (PID: 8588)
      • AVGBrowser.exe (PID: 8604)
      • AVGBrowser.exe (PID: 8776)
      • AVGBrowser.exe (PID: 8868)
      • AVGBrowser.exe (PID: 8616)
      • AVGBrowser.exe (PID: 9048)
      • AVGBrowser.exe (PID: 8216)
      • AVGBrowserProtect.exe (PID: 9084)
      • AVGBrowser.exe (PID: 6972)
      • AVGBrowser.exe (PID: 8420)
      • AVGBrowser.exe (PID: 8412)
      • setup.exe (PID: 2796)
      • AVGBrowser.exe (PID: 8568)
      • setup.exe (PID: 6932)
      • AVGBrowser.exe (PID: 8224)
      • AVGBrowser.exe (PID: 8252)
      • AVGBrowser.exe (PID: 9200)

    • The process uses the downloaded file

      • msedge.exe (PID: 7600)
      • msedge.exe (PID: 5156)
      • CheatEngine75.tmp (PID: 5432)
      • Cheat Engine.exe (PID: 6480)

    • Create files in a temporary directory

      • CheatEngine75.exe (PID: 7308)
      • CheatEngine75.exe (PID: 2736)
      • CheatEngine75.tmp (PID: 5432)
      • avg_secure_browser_setup.exe (PID: 7540)
      • WZSetup.exe (PID: 7536)
      • CheatEngine75.exe (PID: 7592)
      • saBSI.exe (PID: 7500)
      • CheatEngine75.tmp (PID: 7656)
      • installer.exe (PID: 7080)
      • AVGBrowserUpdate.exe (PID: 7252)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7952)
      • AVGBrowser.exe (PID: 2804)
      • AVGBrowser.exe (PID: 4640)

    • Process checks computer location settings

      • CheatEngine75.tmp (PID: 7328)
      • CheatEngine75.tmp (PID: 5432)
      • avg_secure_browser_setup.exe (PID: 7540)
      • AVGBrowserUpdate.exe (PID: 6004)
      • Cheat Engine.exe (PID: 6480)
      • servicehost.exe (PID: 4628)
      • AVGBrowser.exe (PID: 2804)
      • AVGBrowser.exe (PID: 8032)
      • AVGBrowser.exe (PID: 7552)
      • AVGBrowser.exe (PID: 7604)
      • AVGBrowser.exe (PID: 4640)
      • AVGBrowser.exe (PID: 7928)
      • AVGBrowser.exe (PID: 8328)
      • AVGBrowser.exe (PID: 8616)
      • AVGBrowser.exe (PID: 8604)
      • AVGBrowser.exe (PID: 8868)
      • AVGBrowser.exe (PID: 9164)
      • AVGBrowser.exe (PID: 8568)
      • AVGBrowser.exe (PID: 8252)

    • Reads the software policy settings

      • CheatEngine75.tmp (PID: 5432)
      • saBSI.exe (PID: 7500)
      • WZSetup.exe (PID: 7536)
      • avg_secure_browser_setup.exe (PID: 7540)
      • installer.exe (PID: 7080)
      • AVGBrowserUpdate.exe (PID: 3052)
      • AVGBrowserUpdate.exe (PID: 7252)
      • WerFault.exe (PID: 3920)
      • WerFault.exe (PID: 8160)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7952)
      • servicehost.exe (PID: 4628)
      • uihost.exe (PID: 7360)
      • updater.exe (PID: 8008)

    • The sample compiled with english language support

      • CheatEngine75.tmp (PID: 5432)
      • WZSetup.exe (PID: 7536)
      • avg_secure_browser_setup.exe (PID: 7540)
      • CheatEngine75.tmp (PID: 7656)
      • saBSI.exe (PID: 7500)
      • AVGBrowserUpdateSetup.exe (PID: 4556)
      • installer.exe (PID: 7808)
      • AVGBrowserUpdate.exe (PID: 6004)
      • installer.exe (PID: 7080)
      • AVGBrowserInstaller.exe (PID: 2212)
      • setup.exe (PID: 7404)

    • The sample compiled with arabic language support

      • CheatEngine75.tmp (PID: 5432)
      • AVGBrowserUpdateSetup.exe (PID: 4556)
      • AVGBrowserUpdate.exe (PID: 6004)
      • avg_secure_browser_setup.exe (PID: 7540)

    • Reads the machine GUID from the registry

      • CheatEngine75.tmp (PID: 5432)
      • saBSI.exe (PID: 7500)
      • WZSetup.exe (PID: 7536)
      • avg_secure_browser_setup.exe (PID: 7540)
      • AVGBrowserUpdate.exe (PID: 6004)
      • installer.exe (PID: 7080)
      • AVGBrowserUpdate.exe (PID: 7252)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7952)
      • uihost.exe (PID: 7360)
      • servicehost.exe (PID: 4628)
      • updater.exe (PID: 8008)
      • AVGBrowser.exe (PID: 2804)
      • AVGBrowser.exe (PID: 4640)

    • Checks proxy server information

      • CheatEngine75.tmp (PID: 5432)
      • saBSI.exe (PID: 7500)
      • WZSetup.exe (PID: 7536)
      • avg_secure_browser_setup.exe (PID: 7540)
      • AVGBrowserUpdate.exe (PID: 3052)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7952)
      • WerFault.exe (PID: 8160)
      • WerFault.exe (PID: 3920)
      • AVGBrowser.exe (PID: 2804)
      • AVGBrowser.exe (PID: 4640)
      • AVGBrowserProtect.exe (PID: 9084)
      • AVGBrowser.exe (PID: 8252)

    • Creates files in the program directory

      • saBSI.exe (PID: 7500)
      • CheatEngine75.tmp (PID: 7656)
      • AVGBrowserUpdateSetup.exe (PID: 4556)
      • AVGBrowserUpdate.exe (PID: 6004)
      • installer.exe (PID: 7808)
      • AVGBrowserUpdate.exe (PID: 7252)
      • installer.exe (PID: 7080)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7952)
      • servicehost.exe (PID: 4628)
      • uihost.exe (PID: 7360)
      • AVGBrowserInstaller.exe (PID: 2212)
      • setup.exe (PID: 7404)
      • updater.exe (PID: 8008)
      • avg_secure_browser_setup.exe (PID: 7540)
      • setup.exe (PID: 6932)

    • Sends debugging messages

      • saBSI.exe (PID: 7500)
      • avg_secure_browser_setup.exe (PID: 7540)
      • Kernelmoduleunloader.exe (PID: 4944)
      • installer.exe (PID: 7080)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7952)
      • AVGBrowser.exe (PID: 1356)

    • Creates files or folders in the user directory

      • WZSetup.exe (PID: 7536)
      • avg_secure_browser_setup.exe (PID: 7540)
      • WerFault.exe (PID: 8160)
      • WerFault.exe (PID: 3920)
      • AVGBrowser.exe (PID: 2804)
      • AVGBrowser.exe (PID: 5040)
      • AVGBrowser.exe (PID: 4640)
      • AVGBrowser.exe (PID: 3640)
      • AVGBrowser.exe (PID: 7612)
      • AVGBrowser.exe (PID: 9048)
      • AVGBrowser.exe (PID: 8420)
      • setup.exe (PID: 6932)
      • AVGBrowser.exe (PID: 8252)
      • AVGBrowser.exe (PID: 8224)

    • The sample compiled with Italian language support

      • AVGBrowserUpdateSetup.exe (PID: 4556)
      • AVGBrowserUpdate.exe (PID: 6004)

    • The sample compiled with french language support

      • AVGBrowserUpdateSetup.exe (PID: 4556)
      • AVGBrowserUpdate.exe (PID: 6004)

    • The sample compiled with bulgarian language support

      • AVGBrowserUpdateSetup.exe (PID: 4556)
      • AVGBrowserUpdate.exe (PID: 6004)

    • The sample compiled with german language support

      • AVGBrowserUpdateSetup.exe (PID: 4556)
      • AVGBrowserUpdate.exe (PID: 6004)

    • The sample compiled with swedish language support

      • AVGBrowserUpdateSetup.exe (PID: 4556)
      • AVGBrowserUpdate.exe (PID: 6004)

    • The sample compiled with turkish language support

      • AVGBrowserUpdateSetup.exe (PID: 4556)
      • AVGBrowserUpdate.exe (PID: 6004)

    • The sample compiled with czech language support

      • AVGBrowserUpdateSetup.exe (PID: 4556)
      • AVGBrowserUpdate.exe (PID: 6004)

    • The sample compiled with Indonesian language support

      • AVGBrowserUpdateSetup.exe (PID: 4556)
      • AVGBrowserUpdate.exe (PID: 6004)

    • The sample compiled with korean language support

      • AVGBrowserUpdateSetup.exe (PID: 4556)
      • AVGBrowserUpdate.exe (PID: 6004)

    • The sample compiled with japanese language support

      • AVGBrowserUpdateSetup.exe (PID: 4556)
      • AVGBrowserUpdate.exe (PID: 6004)

    • The sample compiled with portuguese language support

      • AVGBrowserUpdateSetup.exe (PID: 4556)
      • AVGBrowserUpdate.exe (PID: 6004)

    • The sample compiled with polish language support

      • AVGBrowserUpdateSetup.exe (PID: 4556)
      • AVGBrowserUpdate.exe (PID: 6004)

    • The sample compiled with russian language support

      • AVGBrowserUpdateSetup.exe (PID: 4556)
      • AVGBrowserUpdate.exe (PID: 6004)

    • The sample compiled with slovak language support

      • AVGBrowserUpdateSetup.exe (PID: 4556)
      • AVGBrowserUpdate.exe (PID: 6004)

    • The sample compiled with chinese language support

      • AVGBrowserUpdateSetup.exe (PID: 4556)
      • AVGBrowserUpdate.exe (PID: 6004)

    • Creates a software uninstall entry

      • CheatEngine75.tmp (PID: 7656)

    • Process checks whether UAC notifications are on

      • avg_secure_browser_setup.exe (PID: 7540)

    • Reads CPU info

      • AVGBrowser.exe (PID: 4640)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
323
Monitored processes
186
Malicious processes
101
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs cheatengine75.exe cheatengine75.tmp no specs cheatengine75.exe cheatengine75.tmp msedge.exe no specs msedge.exe no specs msedge.exe no specs sabsi.exe wzsetup.exe avg_secure_browser_setup.exe cheatengine75.exe cheatengine75.tmp net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs _setup64.tmp no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs kernelmoduleunloader.exe avgbrowserupdatesetup.exe avgbrowserupdate.exe installer.exe msedge.exe no specs avgbrowserupdate.exe no specs avgbrowserupdate.exe no specs avgbrowserupdatecomregistershell64.exe no specs avgbrowserupdatecomregistershell64.exe no specs avgbrowserupdatecomregistershell64.exe no specs installer.exe avgbrowserupdate.exe avgbrowserupdate.exe no specs avgbrowserupdate.exe msedge.exe no specs windowsrepair.exe no specs icacls.exe no specs conhost.exe no specs cheat engine.exe no specs cheatengine-x86_64-sse4-avx2.exe werfault.exe werfault.exe msedge.exe no specs servicehost.exe uihost.exe msedge.exe no specs avgbrowserinstaller.exe setup.exe setup.exe no specs msedge.exe no specs updater.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs msedge.exe no specs avgbrowsercrashhandler.exe no specs avgbrowsercrashhandler64.exe no specs avgbrowser.exe avgbrowser.exe avgbrowser.exe no specs avgbrowser.exe elevation_service.exe no specs avgbrowser.exe no specs elevation_service.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe elevation_service.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs msedge.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs msedge.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowserprotect.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs setup.exe no specs setup.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs elevation_service.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs avgbrowser.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
624\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—icacls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
716"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5944 --field-trial-handle=2344,i,16777097896447282664,1776946739984909186,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
936"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5380 --field-trial-handle=2344,i,16777097896447282664,1776946739984909186,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1356"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\AVG\Browser\User Data\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=131.0.27652.87 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ff81f9afd48,0x7ff81f9afd54,0x7ff81f9afd60C:\Program Files\AVG\Browser\Application\AVGBrowser.exe
AVGBrowser.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
MEDIUM
Description:
AVG Secure Browser
Exit code:
1
Version:
131.0.27652.87
Modules
Images
c:\program files\avg\browser\application\avgbrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\avg\browser\application\131.0.27652.87\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\shcore.dll
c:\windows\system32\combase.dll
1612\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1796"icacls" "C:\Program Files\Cheat Engine 7.5" /grant *S-1-15-2-1:(OI)(CI)(RX)C:\Windows\System32\icacls.exe—CheatEngine75.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1904"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=5304,i,11920816892527778695,7203208085570246490,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:8C:\Program Files\AVG\Browser\Application\AVGBrowser.exe—AVGBrowser.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
LOW
Description:
AVG Secure Browser
Exit code:
0
Version:
131.0.27652.87
2084"C:\Program Files\AVG\Browser\Application\131.0.27652.87\elevation_service.exe"C:\Program Files\AVG\Browser\Application\131.0.27652.87\elevation_service.exe—services.exe
User:
SYSTEM
Company:
Gen Digital Inc.
Integrity Level:
SYSTEM
Description:
AVG Secure Browser
Exit code:
0
Version:
131.0.27652.87
Modules
Images
c:\program files\avg\browser\application\131.0.27652.87\elevation_service.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
2212"C:\Program Files (x86)\AVG\Browser\Update\Install\{50DFC146-AFD1-46E4-8663-C81751C4D29E}\AVGBrowserInstaller.exe" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies --auto-launch-chrome --system-levelC:\Program Files (x86)\AVG\Browser\Update\Install\{50DFC146-AFD1-46E4-8663-C81751C4D29E}\AVGBrowserInstaller.exe
AVGBrowserUpdate.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
HIGH
Description:
AVG Secure Browser Installer
Exit code:
0
Version:
131.0.27652.87
Modules
Images
c:\program files (x86)\avg\browser\update\install\{50dfc146-afd1-46e4-8663-c81751c4d29e}\avgbrowserinstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\shell32.dll
2280"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=8660 --field-trial-handle=2344,i,16777097896447282664,1776946739984909186,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
61 034
Read events
58 816
Write events
2 125
Delete events
93

Modification events

(PID) Process:(5156) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(5156) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(5156) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(5156) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(5156) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
48170BCB00892F00
(PID) Process:(5156) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
EBC925CB00892F00
(PID) Process:(5156) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\328528
Operation:writeName:WindowTabManagerFileMappingId
Value:
{5B3F64D2-5981-4633-A79A-3EAE0EE7E447}
(PID) Process:(5156) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\328528
Operation:writeName:WindowTabManagerFileMappingId
Value:
{C895C772-8EDF-4497-98C7-48B4E5BA4EF9}
(PID) Process:(5156) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\328528
Operation:writeName:WindowTabManagerFileMappingId
Value:
{F4E3CF76-1417-4282-A590-9151250D4704}
(PID) Process:(5156) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\328528
Operation:writeName:WindowTabManagerFileMappingId
Value:
{E75A0429-590C-483F-B113-0AE1383280A0}
Executable files
317
Suspicious files
1 006
Text files
1 072
Unknown types
88

Dropped files

PID
Process
Filename
Type
5156msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF134c6e.TMP —
MD5:—
SHA256:—
5156msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
5156msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF134c6e.TMP —
MD5:—
SHA256:—
5156msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
5156msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF134c6e.TMP —
MD5:—
SHA256:—
5156msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
5156msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF134c6e.TMP —
MD5:—
SHA256:—
5156msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
5156msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF134c6e.TMP —
MD5:—
SHA256:—
5156msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
65
TCP/UDP connections
206
DNS requests
232
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1740
svchost.exe
HEAD
200
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9b9f8fb4-8a65-41e4-bda3-5416858f0aeb?P1=1735952967&P2=404&P3=2&P4=Cq7RAmrbcI519s7%2f4Zcj3tZ3jMiky5YsJPVSP5VghdFjkmweWVLqtBEZWwKl5gjwicdmOq1N%2fSyUWiZ9EzZIuQ%3d%3d
unknown
—
—
whitelisted
1740
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9b9f8fb4-8a65-41e4-bda3-5416858f0aeb?P1=1735952967&P2=404&P3=2&P4=Cq7RAmrbcI519s7%2f4Zcj3tZ3jMiky5YsJPVSP5VghdFjkmweWVLqtBEZWwKl5gjwicdmOq1N%2fSyUWiZ9EzZIuQ%3d%3d
unknown
—
—
whitelisted
7540
avg_secure_browser_setup.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAQ1YD96iIrhbAWwDxU8xvw%3D
unknown
—
—
whitelisted
—
—
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5156
msedge.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQVD%2BnGf79Hpedv3mhy6uKMVZkPCQQUDyrLIIcouOxvSK4rVKYpqhekzQwCEC3f8W6AAH75eq1%2BTyzy40w%3D
unknown
—
—
whitelisted
5156
msedge.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEEj8k7RgVZSNNqfJionWlBY%3D
unknown
—
—
whitelisted
5156
msedge.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEGIdbQxSAZ47kHkVIIkhHAo%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1488
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
—
—
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5156
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
6384
msedge.exe
104.17.24.14:443
cdnjs.cloudflare.com
—
—
whitelisted
6384
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.49
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
google.com
  • 172.217.16.206
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
www.cheatengine.org
  • 104.20.94.94
  • 172.67.35.220
  • 104.20.95.94
whitelisted
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.45
whitelisted
bzib.nelreports.net
  • 2.16.168.113
  • 2.16.168.107
whitelisted

Threats

PID
Process
Class
Message
6384
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
6384
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
6384
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
6384
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
7252
AVGBrowserUpdate.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
—
—
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
—
—
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
—
—
Misc activity
ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI
—
—
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
Process
Message
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in current directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-1CEG3.tmp\prod0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-1CEG3.tmp\prod0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-1CEG3.tmp\prod0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-1CEG3.tmp\prod0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-1CEG3.tmp\prod0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-1CEG3.tmp\prod0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
saBSI.exe
NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-1CEG3.tmp\prod0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-1CEG3.tmp\prod0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.cheatengine.org/downloads.php