URL:

nezur.io

Full analysis: https://app.any.run/tasks/4d0e0162-4c52-4057-ad68-45c584aa6d8b
Verdict: Malicious activity
Analysis date: April 24, 2025, 09:45:42
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
discord
obfuscated-js
Indicators:
MD5:

7BC0387B217C2E1F30ADCD0E08252528

SHA1:

0D05AB5C261690CB345FA4CAC6B0ECA75977CEA8

SHA256:

12F2628648FD53CF5E47DCBC1558A330A039410E84415384C8148A2A2B8F763B

SSDEEP:

3:bMKn:oK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 7372)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 5680)
      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 4016)
      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 1912)
      • msiexec.exe (PID: 6032)
      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 7372)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 5680)
      • Nezur_Interface.exe (PID: 6136)
      • Nezur_Interface.exe (PID: 7548)
      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 1912)
      • Nezur_Interface.exe (PID: 6972)

    • Starts a Microsoft application from unusual location

      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 7372)
      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 1912)

    • Starts itself from another location

      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 1912)

    • Executable content was dropped or overwritten

      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 1912)
      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 4016)
      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 7372)

    • Searches for installed software

      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 1912)

    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 6032)

    • Creates a software uninstall entry

      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 7372)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6032)

    • Creates file in the systems drive root

      • explorer.exe (PID: 5492)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 6032)

  • INFO

    • Application launched itself

      • msedge.exe (PID: 7504)

    • Reads the computer name

      • identity_helper.exe (PID: 5776)
      • Nezur_Interface.exe (PID: 6136)
      • Nezur_Interface.exe (PID: 7548)
      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 1912)
      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 7372)
      • msiexec.exe (PID: 6032)
      • msiexec.exe (PID: 8172)
      • msiexec.exe (PID: 5232)
      • Nezur_Interface.exe (PID: 6972)
      • msiexec.exe (PID: 8116)
      • msiexec.exe (PID: 6240)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 5680)
      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 4016)
      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 1912)
      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 7372)
      • msiexec.exe (PID: 6032)
      • msedge.exe (PID: 4728)
      • msedge.exe (PID: 7504)
      • msedge.exe (PID: 7764)

    • Reads the software policy settings

      • slui.exe (PID: 5972)
      • explorer.exe (PID: 5492)
      • msiexec.exe (PID: 6032)
      • slui.exe (PID: 1600)
      • Nezur_Interface.exe (PID: 6972)

    • Checks supported languages

      • Nezur_Interface.exe (PID: 7548)
      • identity_helper.exe (PID: 5776)
      • Nezur_Interface.exe (PID: 6136)
      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 4016)
      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 1912)
      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 7372)
      • msiexec.exe (PID: 6032)
      • msiexec.exe (PID: 8172)
      • msiexec.exe (PID: 5232)
      • msiexec.exe (PID: 8116)
      • msiexec.exe (PID: 6240)
      • Nezur_Interface.exe (PID: 6972)

    • Reads Microsoft Office registry keys

      • msedge.exe (PID: 7504)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 5492)

    • Reads Environment values

      • identity_helper.exe (PID: 5776)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 7504)
      • WinRAR.exe (PID: 5680)
      • msiexec.exe (PID: 6032)
      • msedge.exe (PID: 4728)

    • Checks proxy server information

      • explorer.exe (PID: 5492)
      • slui.exe (PID: 1600)
      • Nezur_Interface.exe (PID: 6972)

    • Create files in a temporary directory

      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 4016)
      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 1912)
      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 7372)

    • Process checks computer location settings

      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 1912)

    • Creates files or folders in the user directory

      • explorer.exe (PID: 5492)

    • Creates files in the program directory

      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 7372)
      • Nezur_Interface.exe (PID: 6972)

    • Reads the machine GUID from the registry

      • windowsdesktop-runtime-8.0.15-win-x64.exe (PID: 7372)
      • msiexec.exe (PID: 6032)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 6032)

    • Attempting to use instant messaging service

      • msedge.exe (PID: 7764)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
255
Monitored processes
116
Malicious processes
6
Suspicious processes
2

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs sppextcomobj.exe no specs slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs winrar.exe nezur_interface.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs nezur_interface.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs rundll32.exe no specs explorer.exe windowsdesktop-runtime-8.0.15-win-x64.exe windowsdesktop-runtime-8.0.15-win-x64.exe windowsdesktop-runtime-8.0.15-win-x64.exe msedge.exe no specs msiexec.exe msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs nezur_interface.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
232"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4236 --field-trial-handle=2320,i,8640667007976186058,8908626077168074025,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
444"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=74 --mojo-platform-channel-handle=8800 --field-trial-handle=2320,i,8640667007976186058,8908626077168074025,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
496C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
536"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5980 --field-trial-handle=2320,i,8640667007976186058,8908626077168074025,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
632"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=6692 --field-trial-handle=2320,i,8640667007976186058,8908626077168074025,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
660"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3876 --field-trial-handle=2320,i,8640667007976186058,8908626077168074025,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
664C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
812"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win-x64&os=win10&apphost_version=8.0.13&gui=trueC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—Nezur_Interface.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1004"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=63 --mojo-platform-channel-handle=5792 --field-trial-handle=2320,i,8640667007976186058,8908626077168074025,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1096"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5536 --field-trial-handle=2320,i,8640667007976186058,8908626077168074025,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
36 791
Read events
35 656
Write events
1 080
Delete events
55

Modification events

(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5\ApplicationViewManagement\W32:000000000004034A
Operation:writeName:VirtualDesktop
Value:
1000000030304456BFA0DB55E4278845B426357D5B5F97B3
(PID) Process:(7504) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(7504) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(7504) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(7504) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(7504) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
9C6C9D5D19922F00
(PID) Process:(7504) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
9457A95D19922F00
(PID) Process:(7504) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\262986
Operation:writeName:WindowTabManagerFileMappingId
Value:
{92FD4669-3524-4A7A-A963-1093C6EADE64}
(PID) Process:(7504) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\262986
Operation:writeName:WindowTabManagerFileMappingId
Value:
{FDDA8361-C2F0-408A-A524-E22F00070174}
(PID) Process:(7504) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\262986
Operation:writeName:WindowTabManagerFileMappingId
Value:
{48F0A903-2762-40E5-B346-2A8CE86F5AFB}
Executable files
582
Suspicious files
1 649
Text files
404
Unknown types
2

Dropped files

PID
Process
Filename
Type
7504msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF10b603.TMP —
MD5:—
SHA256:—
7504msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
7504msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF10b603.TMP —
MD5:—
SHA256:—
7504msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
7504msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF10b603.TMP —
MD5:—
SHA256:—
7504msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
7504msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF10b603.TMP —
MD5:—
SHA256:—
7504msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
7504msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF10b613.TMP —
MD5:—
SHA256:—
7504msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
49
TCP/UDP connections
314
DNS requests
369
Threats
46

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4812
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4812
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1324
svchost.exe
HEAD
200
208.89.74.21:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9b9f8fb4-8a65-41e4-bda3-5416858f0aeb?P1=1746052102&P2=404&P3=2&P4=frHqfsUF9ztjk%2fFOmkkhPawona9vHg5VfVxjsUXeoUt96f%2fMNqyXCCOpHigX0Ebof1Z0PR0jRezNpe8MRmi6sw%3d%3d
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5492
explorer.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1324
svchost.exe
GET
206
208.89.74.21:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9b9f8fb4-8a65-41e4-bda3-5416858f0aeb?P1=1746052102&P2=404&P3=2&P4=frHqfsUF9ztjk%2fFOmkkhPawona9vHg5VfVxjsUXeoUt96f%2fMNqyXCCOpHigX0Ebof1Z0PR0jRezNpe8MRmi6sw%3d%3d
unknown
—
—
whitelisted
1324
svchost.exe
GET
206
208.89.74.21:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9b9f8fb4-8a65-41e4-bda3-5416858f0aeb?P1=1746052102&P2=404&P3=2&P4=frHqfsUF9ztjk%2fFOmkkhPawona9vHg5VfVxjsUXeoUt96f%2fMNqyXCCOpHigX0Ebof1Z0PR0jRezNpe8MRmi6sw%3d%3d
unknown
—
—
whitelisted
1324
svchost.exe
GET
206
208.89.74.21:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9b9f8fb4-8a65-41e4-bda3-5416858f0aeb?P1=1746052102&P2=404&P3=2&P4=frHqfsUF9ztjk%2fFOmkkhPawona9vHg5VfVxjsUXeoUt96f%2fMNqyXCCOpHigX0Ebof1Z0PR0jRezNpe8MRmi6sw%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7764
msedge.exe
13.107.43.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7764
msedge.exe
104.26.7.104:443
nezur.io
—
—
unknown
7504
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
7764
msedge.exe
150.171.28.11:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.78
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
  • 2.19.11.105
  • 2.19.11.120
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
config.edge.skype.com
  • 13.107.43.16
whitelisted
nezur.io
  • 104.26.7.104
  • 172.67.74.136
  • 104.26.6.104
unknown
edge.microsoft.com
  • 150.171.28.11
  • 150.171.27.11
  • 150.171.30.11
  • 150.171.29.11
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.45
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
bzib.nelreports.net
  • 23.48.23.26
  • 23.48.23.51
whitelisted
www.bing.com
  • 92.123.104.14
  • 92.123.104.18
  • 92.123.104.16
  • 92.123.104.9
  • 92.123.104.17
  • 92.123.104.5
  • 92.123.104.13
  • 92.123.104.4
  • 92.123.104.19
  • 92.123.104.56
  • 92.123.104.67
  • 92.123.104.62
  • 92.123.104.52
  • 92.123.104.47
  • 92.123.104.61
  • 92.123.104.58
  • 92.123.104.41
  • 92.123.104.31
  • 92.123.104.26
  • 92.123.104.21
  • 92.123.104.29
  • 92.123.104.32
  • 92.123.104.30
  • 92.123.104.33
  • 92.123.104.20
  • 92.123.104.24
  • 2.23.227.215
  • 2.23.227.208
  • 2.23.227.221
  • 92.123.104.65
  • 92.123.104.12
  • 92.123.104.6
whitelisted

Threats

PID
Process
Class
Message
7764
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge
7764
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge
7764
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
7764
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
7764
msedge.exe
Misc activity
ET INFO Discord Chat Service Domain in DNS Lookup (discord .com)
7764
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
7764
msedge.exe
Misc activity
ET INFO Discord Chat Service Domain in DNS Lookup (discord .com)
7764
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
7764
msedge.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
7764
msedge.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
nezur.io