File name:

Dying.Light.2.Save.Editor_1.0.5_x64-setup.exe

Full analysis: https://app.any.run/tasks/11475bef-61cc-4456-8fdc-d505d88249f7
Verdict: Malicious activity
Analysis date: April 20, 2024, 09:00:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

7F031F23591EC2BA9B5CE6E19F1528E9

SHA1:

1D251B875F5D3D77E8EE2AD4E55745CE7A8F4C57

SHA256:

133AD4A63BDFC45610AEED22020B9DF70DC0DA4D1D6B5D88707518B03D077B1B

SSDEEP:

98304:ZJ8RYPhpF/ZKC5vyod0aPstfEW85U5ViIcv8w4wTrljQ+1ZVV9qur+B2oz0xZaMQ:Z3jvMtp0i

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Dying.Light.2.Save.Editor_1.0.5_x64-setup.exe (PID: 3040)
      • MicrosoftEdgeWebview2Setup.exe (PID: 3584)
      • MicrosoftEdgeUpdate.exe (PID: 2380)

    • Changes the autorun value in the registry

      • MicrosoftEdgeUpdate.exe (PID: 2380)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Dying.Light.2.Save.Editor_1.0.5_x64-setup.exe (PID: 3040)

    • Searches for installed software

      • Dying.Light.2.Save.Editor_1.0.5_x64-setup.exe (PID: 3040)

    • Process drops legitimate windows executable

      • Dying.Light.2.Save.Editor_1.0.5_x64-setup.exe (PID: 3040)
      • MicrosoftEdgeWebview2Setup.exe (PID: 3584)
      • MicrosoftEdgeUpdate.exe (PID: 2380)

    • The process creates files with name similar to system file names

      • Dying.Light.2.Save.Editor_1.0.5_x64-setup.exe (PID: 3040)

    • Executable content was dropped or overwritten

      • Dying.Light.2.Save.Editor_1.0.5_x64-setup.exe (PID: 3040)
      • MicrosoftEdgeWebview2Setup.exe (PID: 3584)
      • MicrosoftEdgeUpdate.exe (PID: 2380)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeWebview2Setup.exe (PID: 3584)
      • MicrosoftEdgeUpdate.exe (PID: 2380)

    • Reads the Internet Settings

      • MicrosoftEdgeUpdate.exe (PID: 1424)
      • MicrosoftEdgeUpdate.exe (PID: 3020)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 2380)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdate.exe (PID: 2360)

    • Reads security settings of Internet Explorer

      • MicrosoftEdgeUpdate.exe (PID: 1424)

    • Reads settings of System Certificates

      • MicrosoftEdgeUpdate.exe (PID: 1424)
      • MicrosoftEdgeUpdate.exe (PID: 3020)

    • Checks Windows Trust Settings

      • MicrosoftEdgeUpdate.exe (PID: 1424)

  • INFO

    • Checks supported languages

      • Dying.Light.2.Save.Editor_1.0.5_x64-setup.exe (PID: 3040)
      • MicrosoftEdgeWebview2Setup.exe (PID: 3584)
      • MicrosoftEdgeUpdate.exe (PID: 2380)
      • MicrosoftEdgeUpdate.exe (PID: 2360)
      • MicrosoftEdgeUpdate.exe (PID: 1424)
      • MicrosoftEdgeUpdate.exe (PID: 452)
      • MicrosoftEdgeUpdate.exe (PID: 3020)

    • Reads the computer name

      • Dying.Light.2.Save.Editor_1.0.5_x64-setup.exe (PID: 3040)
      • MicrosoftEdgeUpdate.exe (PID: 2380)
      • MicrosoftEdgeUpdate.exe (PID: 2360)
      • MicrosoftEdgeUpdate.exe (PID: 1424)
      • MicrosoftEdgeUpdate.exe (PID: 452)
      • MicrosoftEdgeUpdate.exe (PID: 3020)

    • Create files in a temporary directory

      • Dying.Light.2.Save.Editor_1.0.5_x64-setup.exe (PID: 3040)
      • MicrosoftEdgeWebview2Setup.exe (PID: 3584)
      • MicrosoftEdgeUpdate.exe (PID: 2380)
      • MicrosoftEdgeUpdate.exe (PID: 1424)

    • Creates files or folders in the user directory

      • MicrosoftEdgeUpdate.exe (PID: 2380)
      • MicrosoftEdgeUpdate.exe (PID: 1424)

    • Reads the machine GUID from the registry

      • MicrosoftEdgeUpdate.exe (PID: 452)
      • MicrosoftEdgeUpdate.exe (PID: 2380)
      • MicrosoftEdgeUpdate.exe (PID: 3020)
      • MicrosoftEdgeUpdate.exe (PID: 1424)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 1424)

    • Checks proxy server information

      • MicrosoftEdgeUpdate.exe (PID: 1424)

    • Reads the software policy settings

      • MicrosoftEdgeUpdate.exe (PID: 1424)
      • MicrosoftEdgeUpdate.exe (PID: 3020)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:09:25 21:56:47+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x3640
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.5.0
ProductVersionNumber: 1.0.5.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: A Dying Light 2 Save Editor. Allows to edit inventory and skills.
FileVersion: 1.0.5
LegalCopyright: -
ProductName: Dying Light 2 Save Editor
ProductVersion: 1.0.5
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
7
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start dying.light.2.save.editor_1.0.5_x64-setup.exe microsoftedgewebview2setup.exe microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe

Process information

PID
CMD
Path
Indicators
Parent process
452"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=false" /installsource otherinstallcmd /sessionid "{621CB6BF-A338-4B38-8B12-FEA030DD3B8B}" /silentC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Version:
1.3.185.29
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1424"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODUuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xODUuMjkiIGlzbWFjaGluZT0iMCIgc2Vzc2lvbmlkPSJ7NjIxQ0I2QkYtQTMzOC00QjM4LThCMTItRkVBMDMwREQzQjhCfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntDNTcyM0RCQy1ENThELTQyMDEtQjk1My0wNDVDOTc1NDg3RDl9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iMyIgZGlza190eXBlPSIwIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4yNDU0NiIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4ODYiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRFTEwiIHByb2R1Y3RfbmFtZT0iREVMTCIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuMy4xODUuMjkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE4MzE1OTI3NzM0IiBpbnN0YWxsX3RpbWVfbXM9IjQ4NCIvPjwvYXBwPjwvcmVxdWVzdD4C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.185.29
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2360"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserverC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.185.29
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2380C:\Users\admin\AppData\Local\Temp\EUF161.tmp\MicrosoftEdgeUpdate.exe /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"C:\Users\admin\AppData\Local\Temp\EUF161.tmp\MicrosoftEdgeUpdate.exe
MicrosoftEdgeWebview2Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Version:
1.3.185.29
Modules
Images
c:\users\admin\appdata\local\temp\euf161.tmp\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3020"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" -EmbeddingC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Version:
1.3.185.29
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3040"C:\Users\admin\Desktop\Dying.Light.2.Save.Editor_1.0.5_x64-setup.exe" C:\Users\admin\Desktop\Dying.Light.2.Save.Editor_1.0.5_x64-setup.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
A Dying Light 2 Save Editor. Allows to edit inventory and skills.
Version:
1.0.5
Modules
Images
c:\users\admin\desktop\dying.light.2.save.editor_1.0.5_x64-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
3584C:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe /silent /installC:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
Dying.Light.2.Save.Editor_1.0.5_x64-setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update Setup
Version:
1.3.185.29
Modules
Images
c:\users\admin\appdata\local\temp\microsoftedgewebview2setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
Total events
13 295
Read events
11 723
Write events
1 532
Delete events
40

Modification events

(PID) Process:(2380) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate
Operation:delete valueName:eulaaccepted
Value:
(PID) Process:(2380) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate
Operation:writeName:path
Value:
C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
(PID) Process:(2380) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate
Operation:writeName:UninstallCmdLine
Value:
"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /uninstall
(PID) Process:(2380) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:pv
Value:
1.3.185.29
(PID) Process:(2380) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:name
Value:
Microsoft Edge Update
(PID) Process:(2380) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:pv
Value:
1.3.185.29
(PID) Process:(2380) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Microsoft Edge Update
Value:
"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.185.29\MicrosoftEdgeUpdateCore.exe"
(PID) Process:(2380) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate
Operation:writeName:edgeupdate_task_name_c
Value:
MicrosoftEdgeUpdateTaskUserS-1-5-21-1302019708-1500728564-335382590-1000Core{5EC14B06-6031-4069-9FBB-E0F86DB9D17E}
(PID) Process:(2380) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate
Operation:writeName:edgeupdate_task_name_ua
Value:
MicrosoftEdgeUpdateTaskUserS-1-5-21-1302019708-1500728564-335382590-1000UA{9E538E20-D241-425A-831A-FE5296F801D9}
(PID) Process:(2360) MicrosoftEdgeUpdate.exeKey:HKEY_CLASSES_ROOT\CLSID\{81093D63-7825-417B-BFC8-ADC63FA4E53D}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Both
Executable files
206
Suspicious files
4
Text files
5
Unknown types
1

Dropped files

PID
Process
Filename
Type
3040Dying.Light.2.Save.Editor_1.0.5_x64-setup.exeC:\Users\admin\AppData\Local\Temp\nsdDB3B.tmp\modern-wizard.bmpimage
MD5:CBE40FD2B1EC96DAEDC65DA172D90022
SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
3040Dying.Light.2.Save.Editor_1.0.5_x64-setup.exeC:\Users\admin\AppData\Local\Temp\nsdDB3B.tmp\nsis_tauri_utils.dllexecutable
MD5:0BA06473CEC3F0E72FC6865D870B6BD9
SHA256:2B454443F12806D9E531E18BF19933C0AAD1CD8AE397C71B99E814566E6BB5FD
3584MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUF161.tmp\psuser.dllexecutable
MD5:A31ECA09CDCABC67EFFCB4936494B299
SHA256:BB5D826EF9D058DA708D6EFF8CC696C05CF9D3111953F471CF91AEF23CD1396B
3584MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUF161.tmp\MicrosoftEdgeUpdate.exeexecutable
MD5:24E62A7C8D7F60336E60C003AF843A87
SHA256:43F7DE9FAE6B79A844D7DA6056AC82BEADF028A347E227C2BC33D503F7EB402C
3584MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUF161.tmp\MicrosoftEdgeUpdateOnDemand.exeexecutable
MD5:C92CA531CE39BF9D2CBDE706D0AB0F33
SHA256:1036A2DE84DACC337935012B6BD83A4EC3384A6B786DA37440B93B826951E0E1
3584MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUF161.tmp\psmachine.dllexecutable
MD5:F8D310659F880D22565A2E357A8A76BD
SHA256:378C60410E61AA59D072001D67993614F75DCDECF6B5CCF306E4DD571170D47C
3584MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUF161.tmp\msedgeupdate.dllexecutable
MD5:C1C4E3A4D49561DD0F6BC85F8062530D
SHA256:E9F1D362867BEB3A767233DE9D5AF3A6E2762BB0627F291C6CB8F9FAFFB922EA
3584MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUF161.tmp\NOTICE.TXTtext
MD5:6DD5BF0743F2366A0BDD37E302783BCD
SHA256:91D3FC490565DED7621FF5198960E501B6DB857D5DD45AF2FE7C3ECD141145F5
3584MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUF161.tmp\MicrosoftEdgeComRegisterShellARM64.exeexecutable
MD5:E0A4142F6FD7098661DD27F41F6B51D3
SHA256:52496289BD868F12474D9DCA3F063853923F541803388B427487EF63F52C6E8A
3584MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUF161.tmp\MicrosoftEdgeUpdateBroker.exeexecutable
MD5:B8D34226A11443D575F205E3DC9D87E8
SHA256:57DB243B4FBAE3EE90C0F52E0D6871BCD47E8D23236381F051704350C8297F7C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
14
DNS requests
9
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
856
svchost.exe
HEAD
200
199.232.214.172:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/d87a3bbd-7fe5-4ec3-b806-293cca78b363?P1=1714208462&P2=404&P3=2&P4=NsAwOZLYiw0ZtPGYGs7qGsDbA5OhBAHg7U94O44ZJCGxlKmP5mfgGMOuFaECtTB5nCOt4I0lgct4bUKOi0Z5VA%3d%3d
unknown
—
—
unknown
1424
MicrosoftEdgeUpdate.exe
GET
304
23.53.40.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5528561835a6ce9d
unknown
—
—
unknown
856
svchost.exe
GET
—
199.232.214.172:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/d87a3bbd-7fe5-4ec3-b806-293cca78b363?P1=1714208462&P2=404&P3=2&P4=NsAwOZLYiw0ZtPGYGs7qGsDbA5OhBAHg7U94O44ZJCGxlKmP5mfgGMOuFaECtTB5nCOt4I0lgct4bUKOi0Z5VA%3d%3d
unknown
—
—
unknown
1424
MicrosoftEdgeUpdate.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
unknown
1080
svchost.exe
GET
200
23.53.40.10:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?aab46216fbac899d
unknown
—
—
unknown
1080
svchost.exe
GET
304
23.53.40.10:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?393982f109b60f02
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3040
Dying.Light.2.Save.Editor_1.0.5_x64-setup.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
unknown
3040
Dying.Light.2.Save.Editor_1.0.5_x64-setup.exe
23.32.238.163:443
msedge.sf.dl.delivery.mp.microsoft.com
Akamai International B.V.
DE
unknown
1424
MicrosoftEdgeUpdate.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3020
MicrosoftEdgeUpdate.exe
13.67.191.143:443
msedge.api.cdp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1424
MicrosoftEdgeUpdate.exe
20.42.65.84:443
self.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
796
svchost.exe
239.255.255.250:1900
—
—
—
unknown

DNS requests

Domain
IP
Reputation
go.microsoft.com
  • 23.35.238.131
whitelisted
msedge.sf.dl.delivery.mp.microsoft.com
  • 23.32.238.163
  • 23.32.238.138
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
msedge.api.cdp.microsoft.com
  • 13.67.191.143
whitelisted
self.events.data.microsoft.com
  • 20.42.65.84
whitelisted
ctldl.windowsupdate.com
  • 23.53.40.8
  • 23.53.40.51
  • 23.53.40.50
  • 23.53.40.42
  • 23.53.40.83
  • 23.53.40.9
  • 23.53.40.74
  • 23.53.40.81
  • 23.53.40.10
  • 23.53.40.82
  • 23.53.40.19
  • 23.53.40.16
  • 23.53.40.11
  • 23.53.40.73
  • 23.53.40.75
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
msedge.f.tlu.dl.delivery.mp.microsoft.com
  • 199.232.214.172
  • 199.232.210.172
whitelisted

Threats

PID
Process
Class
Message
856
svchost.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Dying.Light.2.Save.Editor_1.0.5_x64-setup.exe