File name:

Dying.Light.2.Save.Editor_1.0.5_x64-setup.exe

Full analysis: https://app.any.run/tasks/11475bef-61cc-4456-8fdc-d505d88249f7
Verdict: Malicious activity
Analysis date: April 20, 2024, 09:00:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

7F031F23591EC2BA9B5CE6E19F1528E9

SHA1:

1D251B875F5D3D77E8EE2AD4E55745CE7A8F4C57

SHA256:

133AD4A63BDFC45610AEED22020B9DF70DC0DA4D1D6B5D88707518B03D077B1B

SSDEEP:

98304:ZJ8RYPhpF/ZKC5vyod0aPstfEW85U5ViIcv8w4wTrljQ+1ZVV9qur+B2oz0xZaMQ:Z3jvMtp0i

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Dying.Light.2.Save.Editor_1.0.5_x64-setup.exe (PID: 3040)
      • MicrosoftEdgeWebview2Setup.exe (PID: 3584)
      • MicrosoftEdgeUpdate.exe (PID: 2380)

    • Changes the autorun value in the registry

      • MicrosoftEdgeUpdate.exe (PID: 2380)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • Dying.Light.2.Save.Editor_1.0.5_x64-setup.exe (PID: 3040)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Dying.Light.2.Save.Editor_1.0.5_x64-setup.exe (PID: 3040)

    • Executable content was dropped or overwritten

      • Dying.Light.2.Save.Editor_1.0.5_x64-setup.exe (PID: 3040)
      • MicrosoftEdgeWebview2Setup.exe (PID: 3584)
      • MicrosoftEdgeUpdate.exe (PID: 2380)

    • Searches for installed software

      • Dying.Light.2.Save.Editor_1.0.5_x64-setup.exe (PID: 3040)

    • Process drops legitimate windows executable

      • Dying.Light.2.Save.Editor_1.0.5_x64-setup.exe (PID: 3040)
      • MicrosoftEdgeWebview2Setup.exe (PID: 3584)
      • MicrosoftEdgeUpdate.exe (PID: 2380)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeWebview2Setup.exe (PID: 3584)
      • MicrosoftEdgeUpdate.exe (PID: 2380)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdate.exe (PID: 2360)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 2380)

    • Reads the Internet Settings

      • MicrosoftEdgeUpdate.exe (PID: 1424)
      • MicrosoftEdgeUpdate.exe (PID: 3020)

    • Reads settings of System Certificates

      • MicrosoftEdgeUpdate.exe (PID: 1424)
      • MicrosoftEdgeUpdate.exe (PID: 3020)

    • Reads security settings of Internet Explorer

      • MicrosoftEdgeUpdate.exe (PID: 1424)

    • Checks Windows Trust Settings

      • MicrosoftEdgeUpdate.exe (PID: 1424)

  • INFO

    • Checks supported languages

      • Dying.Light.2.Save.Editor_1.0.5_x64-setup.exe (PID: 3040)
      • MicrosoftEdgeWebview2Setup.exe (PID: 3584)
      • MicrosoftEdgeUpdate.exe (PID: 2380)
      • MicrosoftEdgeUpdate.exe (PID: 2360)
      • MicrosoftEdgeUpdate.exe (PID: 1424)
      • MicrosoftEdgeUpdate.exe (PID: 452)
      • MicrosoftEdgeUpdate.exe (PID: 3020)

    • Reads the computer name

      • Dying.Light.2.Save.Editor_1.0.5_x64-setup.exe (PID: 3040)
      • MicrosoftEdgeUpdate.exe (PID: 2380)
      • MicrosoftEdgeUpdate.exe (PID: 452)
      • MicrosoftEdgeUpdate.exe (PID: 2360)
      • MicrosoftEdgeUpdate.exe (PID: 1424)
      • MicrosoftEdgeUpdate.exe (PID: 3020)

    • Create files in a temporary directory

      • Dying.Light.2.Save.Editor_1.0.5_x64-setup.exe (PID: 3040)
      • MicrosoftEdgeWebview2Setup.exe (PID: 3584)
      • MicrosoftEdgeUpdate.exe (PID: 2380)
      • MicrosoftEdgeUpdate.exe (PID: 1424)

    • Creates files or folders in the user directory

      • MicrosoftEdgeUpdate.exe (PID: 2380)
      • MicrosoftEdgeUpdate.exe (PID: 1424)

    • Reads the machine GUID from the registry

      • MicrosoftEdgeUpdate.exe (PID: 2380)
      • MicrosoftEdgeUpdate.exe (PID: 452)
      • MicrosoftEdgeUpdate.exe (PID: 3020)
      • MicrosoftEdgeUpdate.exe (PID: 1424)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 1424)

    • Checks proxy server information

      • MicrosoftEdgeUpdate.exe (PID: 1424)

    • Reads the software policy settings

      • MicrosoftEdgeUpdate.exe (PID: 1424)
      • MicrosoftEdgeUpdate.exe (PID: 3020)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:09:25 21:56:47+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x3640
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.5.0
ProductVersionNumber: 1.0.5.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: A Dying Light 2 Save Editor. Allows to edit inventory and skills.
FileVersion: 1.0.5
LegalCopyright: -
ProductName: Dying Light 2 Save Editor
ProductVersion: 1.0.5
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
7
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start dying.light.2.save.editor_1.0.5_x64-setup.exe microsoftedgewebview2setup.exe microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe

Process information

PID
CMD
Path
Indicators
Parent process
452"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=false" /installsource otherinstallcmd /sessionid "{621CB6BF-A338-4B38-8B12-FEA030DD3B8B}" /silentC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Version:
1.3.185.29
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1424"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODUuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xODUuMjkiIGlzbWFjaGluZT0iMCIgc2Vzc2lvbmlkPSJ7NjIxQ0I2QkYtQTMzOC00QjM4LThCMTItRkVBMDMwREQzQjhCfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntDNTcyM0RCQy1ENThELTQyMDEtQjk1My0wNDVDOTc1NDg3RDl9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iMyIgZGlza190eXBlPSIwIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4yNDU0NiIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4ODYiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRFTEwiIHByb2R1Y3RfbmFtZT0iREVMTCIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuMy4xODUuMjkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE4MzE1OTI3NzM0IiBpbnN0YWxsX3RpbWVfbXM9IjQ4NCIvPjwvYXBwPjwvcmVxdWVzdD4C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.185.29
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2360"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserverC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.185.29
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2380C:\Users\admin\AppData\Local\Temp\EUF161.tmp\MicrosoftEdgeUpdate.exe /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"C:\Users\admin\AppData\Local\Temp\EUF161.tmp\MicrosoftEdgeUpdate.exe
MicrosoftEdgeWebview2Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Version:
1.3.185.29
Modules
Images
c:\users\admin\appdata\local\temp\euf161.tmp\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3020"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" -EmbeddingC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Version:
1.3.185.29
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3040"C:\Users\admin\Desktop\Dying.Light.2.Save.Editor_1.0.5_x64-setup.exe" C:\Users\admin\Desktop\Dying.Light.2.Save.Editor_1.0.5_x64-setup.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
A Dying Light 2 Save Editor. Allows to edit inventory and skills.
Version:
1.0.5
Modules
Images
c:\users\admin\desktop\dying.light.2.save.editor_1.0.5_x64-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
3584C:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe /silent /installC:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
Dying.Light.2.Save.Editor_1.0.5_x64-setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update Setup
Version:
1.3.185.29
Modules
Images
c:\users\admin\appdata\local\temp\microsoftedgewebview2setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
Total events
13 295
Read events
11 723
Write events
1 532
Delete events
40

Modification events

(PID) Process:(2380) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate
Operation:delete valueName:eulaaccepted
Value:
(PID) Process:(2380) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate
Operation:writeName:path
Value:
C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
(PID) Process:(2380) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate
Operation:writeName:UninstallCmdLine
Value:
"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /uninstall
(PID) Process:(2380) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:pv
Value:
1.3.185.29
(PID) Process:(2380) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:name
Value:
Microsoft Edge Update
(PID) Process:(2380) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:pv
Value:
1.3.185.29
(PID) Process:(2380) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Microsoft Edge Update
Value:
"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.185.29\MicrosoftEdgeUpdateCore.exe"
(PID) Process:(2380) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate
Operation:writeName:edgeupdate_task_name_c
Value:
MicrosoftEdgeUpdateTaskUserS-1-5-21-1302019708-1500728564-335382590-1000Core{5EC14B06-6031-4069-9FBB-E0F86DB9D17E}
(PID) Process:(2380) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate
Operation:writeName:edgeupdate_task_name_ua
Value:
MicrosoftEdgeUpdateTaskUserS-1-5-21-1302019708-1500728564-335382590-1000UA{9E538E20-D241-425A-831A-FE5296F801D9}
(PID) Process:(2360) MicrosoftEdgeUpdate.exeKey:HKEY_CLASSES_ROOT\CLSID\{81093D63-7825-417B-BFC8-ADC63FA4E53D}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Both
Executable files
206
Suspicious files
4
Text files
5
Unknown types
1

Dropped files

PID
Process
Filename
Type
3584MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUF161.tmp\MicrosoftEdgeUpdate.exeexecutable
MD5:24E62A7C8D7F60336E60C003AF843A87
SHA256:43F7DE9FAE6B79A844D7DA6056AC82BEADF028A347E227C2BC33D503F7EB402C
3040Dying.Light.2.Save.Editor_1.0.5_x64-setup.exeC:\Users\admin\AppData\Local\Temp\nsdDB3B.tmp\nsis_tauri_utils.dllexecutable
MD5:0BA06473CEC3F0E72FC6865D870B6BD9
SHA256:2B454443F12806D9E531E18BF19933C0AAD1CD8AE397C71B99E814566E6BB5FD
3040Dying.Light.2.Save.Editor_1.0.5_x64-setup.exeC:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exeexecutable
MD5:8B9812BA27E12C79319D859E97955CA4
SHA256:A63D59B2AF0C7B2BE6984280386042A230DAB928E3B426D51A0AFB2EFF5F98E9
3584MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUF161.tmp\msedgeupdate.dllexecutable
MD5:C1C4E3A4D49561DD0F6BC85F8062530D
SHA256:E9F1D362867BEB3A767233DE9D5AF3A6E2762BB0627F291C6CB8F9FAFFB922EA
3584MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUF161.tmp\MicrosoftEdgeUpdateBroker.exeexecutable
MD5:B8D34226A11443D575F205E3DC9D87E8
SHA256:57DB243B4FBAE3EE90C0F52E0D6871BCD47E8D23236381F051704350C8297F7C
3584MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUF161.tmp\MicrosoftEdgeUpdateOnDemand.exeexecutable
MD5:C92CA531CE39BF9D2CBDE706D0AB0F33
SHA256:1036A2DE84DACC337935012B6BD83A4EC3384A6B786DA37440B93B826951E0E1
3040Dying.Light.2.Save.Editor_1.0.5_x64-setup.exeC:\Users\admin\AppData\Local\Temp\nsdDB3B.tmp\nsDialogs.dllexecutable
MD5:6C3F8C94D0727894D706940A8A980543
SHA256:56B96ADD1978B1ABBA286F7F8982B0EFBE007D4A48B3DED6A4D408E01D753FE2
3584MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUF161.tmp\psmachine.dllexecutable
MD5:F8D310659F880D22565A2E357A8A76BD
SHA256:378C60410E61AA59D072001D67993614F75DCDECF6B5CCF306E4DD571170D47C
3584MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUF161.tmp\MicrosoftEdgeUpdateComRegisterShell64.exeexecutable
MD5:8200A55843C5C0DA5CA8E01F77038BCC
SHA256:098EB4C373A48EE49681D83F9F03E3701F6DFD5361B6A071242CA23B3162EE96
3040Dying.Light.2.Save.Editor_1.0.5_x64-setup.exeC:\Users\admin\AppData\Local\Temp\nsdDB3B.tmp\System.dllexecutable
MD5:CFF85C549D536F651D4FB8387F1976F2
SHA256:8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
14
DNS requests
9
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1424
MicrosoftEdgeUpdate.exe
GET
304
23.53.40.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5528561835a6ce9d
unknown
—
—
unknown
1424
MicrosoftEdgeUpdate.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
unknown
856
svchost.exe
HEAD
200
199.232.214.172:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/d87a3bbd-7fe5-4ec3-b806-293cca78b363?P1=1714208462&P2=404&P3=2&P4=NsAwOZLYiw0ZtPGYGs7qGsDbA5OhBAHg7U94O44ZJCGxlKmP5mfgGMOuFaECtTB5nCOt4I0lgct4bUKOi0Z5VA%3d%3d
unknown
—
—
unknown
856
svchost.exe
GET
—
199.232.214.172:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/d87a3bbd-7fe5-4ec3-b806-293cca78b363?P1=1714208462&P2=404&P3=2&P4=NsAwOZLYiw0ZtPGYGs7qGsDbA5OhBAHg7U94O44ZJCGxlKmP5mfgGMOuFaECtTB5nCOt4I0lgct4bUKOi0Z5VA%3d%3d
unknown
—
—
unknown
1080
svchost.exe
GET
304
23.53.40.10:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?393982f109b60f02
unknown
—
—
unknown
1080
svchost.exe
GET
200
23.53.40.10:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?aab46216fbac899d
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3040
Dying.Light.2.Save.Editor_1.0.5_x64-setup.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
unknown
3040
Dying.Light.2.Save.Editor_1.0.5_x64-setup.exe
23.32.238.163:443
msedge.sf.dl.delivery.mp.microsoft.com
Akamai International B.V.
DE
unknown
1424
MicrosoftEdgeUpdate.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3020
MicrosoftEdgeUpdate.exe
13.67.191.143:443
msedge.api.cdp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1424
MicrosoftEdgeUpdate.exe
20.42.65.84:443
self.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
796
svchost.exe
239.255.255.250:1900
—
—
—
unknown

DNS requests

Domain
IP
Reputation
go.microsoft.com
  • 23.35.238.131
whitelisted
msedge.sf.dl.delivery.mp.microsoft.com
  • 23.32.238.163
  • 23.32.238.138
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
msedge.api.cdp.microsoft.com
  • 13.67.191.143
whitelisted
self.events.data.microsoft.com
  • 20.42.65.84
whitelisted
ctldl.windowsupdate.com
  • 23.53.40.8
  • 23.53.40.51
  • 23.53.40.50
  • 23.53.40.42
  • 23.53.40.83
  • 23.53.40.9
  • 23.53.40.74
  • 23.53.40.81
  • 23.53.40.10
  • 23.53.40.82
  • 23.53.40.19
  • 23.53.40.16
  • 23.53.40.11
  • 23.53.40.73
  • 23.53.40.75
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
msedge.f.tlu.dl.delivery.mp.microsoft.com
  • 199.232.214.172
  • 199.232.210.172
whitelisted

Threats

PID
Process
Class
Message
856
svchost.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Dying.Light.2.Save.Editor_1.0.5_x64-setup.exe