URL:

flappybirdsequel.pages.dev

Full analysis: https://app.any.run/tasks/4dd56e72-9a90-474e-a85f-0082ec541183
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 26, 2025, 18:42:52
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
obfuscated-js
arch-doc
loader
evasion
antivm
Indicators:
MD5:

A24E350C829385C6A45E25D49E2CA2EF

SHA1:

CE6D95998AADA259B174569FFE63649DC6B9DD13

SHA256:

1938F499E8CEEF727A8B66EF503EC1A52AC629F001DA720FFF76E20C02BB5C6B

SSDEEP:

3:uUHWfA3L2T:ue8A3KT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Application launched itself

      • setup.exe (PID: 9424)
      • setup.exe (PID: 10196)
      • setup.exe (PID: 11016)
      • AvastBrowserInstaller.exe (PID: 6456)
      • setup.exe (PID: 8448)
      • AvastBrowser.exe (PID: 12128)
      • AvastBrowser.exe (PID: 11688)
      • setup.exe (PID: 12388)
      • AvastBrowser.exe (PID: 1272)
      • AvastBrowser.exe (PID: 12556)
      • chrmstp.exe (PID: 12048)
      • chrmstp.exe (PID: 3140)
      • AvastBrowser.exe (PID: 132)

    • Executable content was dropped or overwritten

      • avast_secure_browser_setup.exe (PID: 6980)
      • AvastBrowserUpdateSetup.exe (PID: 5500)
      • AvastBrowserUpdate.exe (PID: 704)
      • AvastBrowserInstaller.exe (PID: 11316)
      • setup.exe (PID: 8448)
      • AvastBrowserInstaller.exe (PID: 3800)
      • AvastBrowser.exe (PID: 12208)

    • Executes as Windows Service

      • AvastBrowserUpdate.exe (PID: 5408)
      • elevation_service.exe (PID: 6592)
      • elevation_service.exe (PID: 3304)
      • elevation_service.exe (PID: 6080)
      • elevation_service.exe (PID: 12744)

    • Starts itself from another location

      • AvastBrowserUpdate.exe (PID: 704)

    • Potential Corporate Privacy Violation

      • AvastBrowserUpdate.exe (PID: 5408)

    • Process requests binary or script from the Internet

      • AvastBrowserUpdate.exe (PID: 5408)

    • There is functionality for taking screenshot (YARA)

      • avast_secure_browser_setup.exe (PID: 6980)
      • AvastBrowserInstaller.exe (PID: 6456)
      • AvastBrowserInstaller.exe (PID: 3800)

    • There is functionality for VM detection VirtualBox (YARA)

      • AvastBrowserInstaller.exe (PID: 6456)
      • AvastBrowserInstaller.exe (PID: 3800)

    • There is functionality for VM detection VMWare (YARA)

      • AvastBrowserInstaller.exe (PID: 6456)
      • AvastBrowserInstaller.exe (PID: 3800)

    • There is functionality for VM detection antiVM strings (YARA)

      • AvastBrowserInstaller.exe (PID: 3800)
      • AvastBrowserInstaller.exe (PID: 6456)

    • Likely accesses (executes) a file from the Public directory

      • AvastBrowser.exe (PID: 6992)
      • AvastBrowser.exe (PID: 13004)
      • AvastBrowser.exe (PID: 5760)

    • Checks for external IP

      • AvastBrowser.exe (PID: 12752)

  • INFO

    • Application launched itself

      • msedge.exe (PID: 1512)

    • Launch of the file from Downloads directory

      • msedge.exe (PID: 8536)
      • msedge.exe (PID: 1512)
      • msedge.exe (PID: 9128)
      • msedge.exe (PID: 8628)
      • msedge.exe (PID: 1348)
      • msedge.exe (PID: 5720)
      • msedge.exe (PID: 1616)
      • msedge.exe (PID: 5972)
      • msedge.exe (PID: 9396)
      • msedge.exe (PID: 9536)
      • msedge.exe (PID: 9732)
      • msedge.exe (PID: 9804)
      • msedge.exe (PID: 9912)
      • msedge.exe (PID: 11244)
      • msedge.exe (PID: 11144)
      • msedge.exe (PID: 10368)

    • Reads the computer name

      • identity_helper.exe (PID: 7796)
      • setup.exe (PID: 9424)

    • Checks supported languages

      • identity_helper.exe (PID: 7796)
      • setup.exe (PID: 9424)
      • setup.exe (PID: 9508)

    • Reads Environment values

      • identity_helper.exe (PID: 7796)

    • Creates files in the program directory

      • setup.exe (PID: 9424)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 7344)
      • msedge.exe (PID: 1512)
      • msedge.exe (PID: 6980)

    • The sample compiled with english language support

      • msedge.exe (PID: 1512)
      • msedge.exe (PID: 7344)
      • avast_secure_browser_setup.exe (PID: 6980)
      • AvastBrowserUpdateSetup.exe (PID: 5500)
      • AvastBrowserUpdate.exe (PID: 704)
      • AvastBrowserUpdate.exe (PID: 5408)
      • AvastBrowserInstaller.exe (PID: 3800)
      • AvastBrowserInstaller.exe (PID: 11316)
      • setup.exe (PID: 8448)
      • msedge.exe (PID: 6980)
      • AvastBrowser.exe (PID: 12208)

    • The sample compiled with czech language support

      • AvastBrowserUpdateSetup.exe (PID: 5500)
      • AvastBrowserUpdate.exe (PID: 704)

    • The sample compiled with arabic language support

      • AvastBrowserUpdateSetup.exe (PID: 5500)
      • AvastBrowserUpdate.exe (PID: 704)

    • The sample compiled with bulgarian language support

      • AvastBrowserUpdateSetup.exe (PID: 5500)
      • AvastBrowserUpdate.exe (PID: 704)

    • The sample compiled with german language support

      • AvastBrowserUpdateSetup.exe (PID: 5500)
      • AvastBrowserUpdate.exe (PID: 704)

    • The sample compiled with Indonesian language support

      • AvastBrowserUpdateSetup.exe (PID: 5500)
      • AvastBrowserUpdate.exe (PID: 704)

    • The sample compiled with russian language support

      • AvastBrowserUpdateSetup.exe (PID: 5500)
      • AvastBrowserUpdate.exe (PID: 704)

    • The sample compiled with Italian language support

      • AvastBrowserUpdateSetup.exe (PID: 5500)
      • AvastBrowserUpdate.exe (PID: 704)

    • The sample compiled with swedish language support

      • AvastBrowserUpdateSetup.exe (PID: 5500)
      • AvastBrowserUpdate.exe (PID: 704)

    • The sample compiled with japanese language support

      • AvastBrowserUpdateSetup.exe (PID: 5500)
      • AvastBrowserUpdate.exe (PID: 704)

    • The sample compiled with korean language support

      • AvastBrowserUpdateSetup.exe (PID: 5500)
      • AvastBrowserUpdate.exe (PID: 704)

    • The sample compiled with polish language support

      • AvastBrowserUpdateSetup.exe (PID: 5500)
      • AvastBrowserUpdate.exe (PID: 704)

    • The sample compiled with portuguese language support

      • AvastBrowserUpdateSetup.exe (PID: 5500)
      • AvastBrowserUpdate.exe (PID: 704)

    • The sample compiled with slovak language support

      • AvastBrowserUpdateSetup.exe (PID: 5500)
      • AvastBrowserUpdate.exe (PID: 704)

    • The sample compiled with turkish language support

      • AvastBrowserUpdateSetup.exe (PID: 5500)
      • AvastBrowserUpdate.exe (PID: 704)

    • The sample compiled with chinese language support

      • AvastBrowserUpdateSetup.exe (PID: 5500)
      • AvastBrowserUpdate.exe (PID: 704)

    • The sample compiled with french language support

      • AvastBrowserUpdate.exe (PID: 704)
      • AvastBrowserUpdateSetup.exe (PID: 5500)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
435
Monitored processes
282
Malicious processes
3
Suspicious processes
6

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs sppextcomobj.exe no specs msedge.exe no specs msedge.exe no specs slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs setup.exe setup.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs setup.exe setup.exe no specs msedge.exe no specs msedge.exe no specs systemsettings.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs setup.exe setup.exe no specs msedge.exe no specs systemsettings.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs avast_secure_browser_setup.exe avastbrowserinstaller.exe msedge.exe no specs avastbrowserinstaller.exe avastbrowserupdatesetup.exe avastbrowserupdate.exe avastbrowserupdate.exe no specs avastbrowserupdate.exe no specs avastbrowserupdatecomregistershell64.exe no specs avastbrowserupdatecomregistershell64.exe no specs avastbrowserupdatecomregistershell64.exe no specs avastbrowserupdate.exe avastbrowserupdate.exe no specs avastbrowserupdate.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs avastbrowserinstaller.exe setup.exe setup.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs avastbrowsercrashhandler.exe no specs avastbrowsercrashhandler64.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe elevation_service.exe no specs elevation_service.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs msedge.exe no specs avastbrowser.exe avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe elevation_service.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs msedge.exe no specs msedge.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs msedge.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowserprotect.exe no specs avastbrowser.exe no specs setup.exe no specs setup.exe no specs avastbrowser.exe no specs avastbrowser.exe avastbrowser.exe no specs elevation_service.exe no specs avastbrowser.exe avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs msedge.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs chrmstp.exe no specs chrmstp.exe no specs chrmstp.exe no specs chrmstp.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs msedge.exe no specs msedge.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe avastbrowser.exe avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs msedge.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs avastbrowser.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
132"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1993.6\AvastBrowserUpdateComRegisterShell64.exe" C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1993.6\AvastBrowserUpdateComRegisterShell64.exe—AvastBrowserUpdate.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
HIGH
Description:
Avast Browser Com Register Shell 64
Exit code:
0
Version:
1.8.1993.6
Modules
Images
c:\program files (x86)\avast software\browser\update\1.8.1993.6\avastbrowserupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
132"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --enable-protectC:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe—AvastBrowser.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
MEDIUM
Description:
Avast Secure Browser
Exit code:
0
Version:
134.0.29548.179
Modules
Images
c:\program files\avast software\browser\application\avastbrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\avast software\browser\application\134.0.29548.179\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\winmm.dll
c:\windows\system32\advapi32.dll
236"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /handoff "bundlename=Avast Secure Browser&appguid={A8504530-742B-42BC-895D-2BAD6406F698}&appname=Avast Secure Browser&needsadmin=true&lang=en&brand=6205&installargs= --no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies" /installsource otherinstallcmd /sessionid "{4D1C94ED-AA2B-4ACA-B253-73FDA8EE3CCF}" /silentC:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe—AvastBrowserUpdate.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
HIGH
Description:
Avast Browser
Exit code:
0
Version:
1.8.1993.6
Modules
Images
c:\program files (x86)\avast software\browser\update\avastbrowserupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
704"C:\Program Files (x86)\GUM40F.tmp\AvastBrowserUpdate.exe" /silent /install "bundlename=Avast Secure Browser&appguid={A8504530-742B-42BC-895D-2BAD6406F698}&appname=Avast Secure Browser&needsadmin=true&lang=en&brand=6205&installargs= --no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies"C:\Program Files (x86)\GUM40F.tmp\AvastBrowserUpdate.exe
AvastBrowserUpdateSetup.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
HIGH
Description:
Avast Browser
Exit code:
0
Version:
1.8.1993.6
Modules
Images
c:\program files (x86)\gum40f.tmp\avastbrowserupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
772"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --field-trial-handle=2036,i,15309191118927614559,2531963845303268062,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:8C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe—AvastBrowser.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
LOW
Description:
Avast Secure Browser
Exit code:
0
Version:
134.0.29548.179
Modules
Images
c:\program files\avast software\browser\application\avastbrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\avast software\browser\application\134.0.29548.179\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
872"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=44 --field-trial-handle=2036,i,15309191118927614559,2531963845303268062,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:2C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe—AvastBrowser.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
LOW
Description:
Avast Secure Browser
Exit code:
0
Version:
134.0.29548.179
Modules
Images
c:\program files\avast software\browser\application\avastbrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\avast software\browser\application\134.0.29548.179\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1052"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5340 --field-trial-handle=2072,i,5828473173359198548,16233189036963380576,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1272"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --enable-protectC:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe—AvastBrowser.exe
User:
admin
Company:
Gen Digital Inc.
Integrity Level:
MEDIUM
Description:
Avast Secure Browser
Exit code:
0
Version:
134.0.29548.179
Modules
Images
c:\program files\avast software\browser\application\avastbrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\avast software\browser\application\134.0.29548.179\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\winmm.dll
c:\windows\system32\advapi32.dll
1312"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6132 --field-trial-handle=2072,i,5828473173359198548,16233189036963380576,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1348"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=9700 --field-trial-handle=2072,i,5828473173359198548,16233189036963380576,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
70 086
Read events
67 366
Write events
2 626
Delete events
94

Modification events

(PID) Process:(1512) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(1512) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(1512) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(1512) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(1512) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
956B9199A4942F00
(PID) Process:(1512) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
8C6C9B99A4942F00
(PID) Process:(1512) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\262916
Operation:writeName:WindowTabManagerFileMappingId
Value:
{F9E0C13D-4B9C-417E-B3ED-106841B77D72}
(PID) Process:(1512) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\262916
Operation:writeName:WindowTabManagerFileMappingId
Value:
{B897CD3D-2642-4D6E-A96C-1C9CA7572AA3}
(PID) Process:(1512) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
9559D099A4942F00
(PID) Process:(1512) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\262916
Operation:writeName:WindowTabManagerFileMappingId
Value:
{AD9B27AE-84A9-45A1-B7F3-3E1633E43D93}
Executable files
259
Suspicious files
2 910
Text files
848
Unknown types
1

Dropped files

PID
Process
Filename
Type
1512msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF10b400.TMP —
MD5:—
SHA256:—
1512msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF10b400.TMP —
MD5:—
SHA256:—
1512msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
1512msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF10b41f.TMP —
MD5:—
SHA256:—
1512msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF10b40f.TMP —
MD5:—
SHA256:—
1512msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF10b42f.TMP —
MD5:—
SHA256:—
1512msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
1512msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
1512msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
1512msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
76
TCP/UDP connections
648
DNS requests
670
Threats
254

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4156
SystemSettings.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4156
SystemSettings.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
10456
SIHClient.exe
GET
200
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
10456
SIHClient.exe
GET
200
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5392
svchost.exe
HEAD
200
208.89.74.21:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/68591036-2289-4858-9f7f-9149e89c8a08?P1=1748295845&P2=404&P3=2&P4=GUXrT%2fJCeqy8YrhK2x09W6UipoQJmZttTp04wTgF5scPzn1yKip%2fxZirCX6tDr5e%2bxWsqIKlcZyNoKIf5C88Lg%3d%3d
unknown
—
—
whitelisted
5392
svchost.exe
GET
206
208.89.74.21:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/68591036-2289-4858-9f7f-9149e89c8a08?P1=1748295845&P2=404&P3=2&P4=GUXrT%2fJCeqy8YrhK2x09W6UipoQJmZttTp04wTgF5scPzn1yKip%2fxZirCX6tDr5e%2bxWsqIKlcZyNoKIf5C88Lg%3d%3d
unknown
—
—
whitelisted
5392
svchost.exe
GET
206
208.89.74.21:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/68591036-2289-4858-9f7f-9149e89c8a08?P1=1748295845&P2=404&P3=2&P4=GUXrT%2fJCeqy8YrhK2x09W6UipoQJmZttTp04wTgF5scPzn1yKip%2fxZirCX6tDr5e%2bxWsqIKlcZyNoKIf5C88Lg%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5796
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7344
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7344
msedge.exe
104.21.80.1:443
flappybirdsequel.pages.dev
—
—
shared
7344
msedge.exe
150.171.27.11:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7344
msedge.exe
13.107.253.45:443
edge-mobile-static.azureedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
whitelisted
google.com
  • 142.250.185.238
  • 172.217.16.206
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.218.209.163
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
flappybirdsequel.pages.dev
  • 104.21.80.1
  • 104.21.96.1
  • 104.21.48.1
  • 104.21.64.1
  • 104.21.112.1
  • 104.21.32.1
  • 104.21.16.1
shared
edge.microsoft.com
  • 150.171.27.11
  • 150.171.28.11
  • 185.106.140.7
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.253.45
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
www.bing.com
  • 2.16.241.218
  • 2.16.241.201
  • 2.16.241.205
  • 104.126.37.162
  • 104.126.37.160
  • 104.126.37.139
  • 104.126.37.146
  • 104.126.37.144
  • 104.126.37.155
  • 104.126.37.161
  • 104.126.37.152
  • 104.126.37.154
  • 104.126.37.128
  • 104.126.37.123
  • 104.126.37.185
  • 104.126.37.186
  • 104.126.37.177
  • 104.126.37.129
  • 104.126.37.176
  • 104.126.37.179
  • 104.126.37.163
  • 104.126.37.137
  • 104.126.37.147
  • 104.126.37.136
  • 2.23.227.208
  • 2.23.227.215
  • 2.19.96.88
  • 2.19.96.8
  • 2.19.96.50
  • 2.19.96.18
  • 2.19.96.66
  • 2.19.96.129
  • 2.19.96.107
  • 2.19.96.90
  • 2.19.96.91
  • 2.19.96.128
  • 2.19.96.83
  • 2.19.96.26
  • 2.16.241.222
  • 2.19.96.35
  • 2.19.96.82
  • 2.19.96.120
  • 2.19.96.11
  • 2.19.96.80
whitelisted

Threats

PID
Process
Class
Message
7344
msedge.exe
Misc activity
ET INFO DNS Query to Cloudflare Page Developer Domain (pages .dev)
7344
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Pages platform for frontend developers to collaborate and deploy websites (pages .dev)
7344
msedge.exe
Misc activity
ET INFO Observed Cloudflare Page Developer Domain (pages .dev in TLS SNI)
7344
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Pages platform for frontend developers to collaborate and deploy websites (pages .dev)
7344
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Pages platform for frontend developers to collaborate and deploy websites (pages .dev)
7344
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Pages platform for frontend developers to collaborate and deploy websites (pages .dev)
7344
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
7344
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
7344
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Pages platform for frontend developers to collaborate and deploy websites (pages .dev)
7344
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Pages platform for frontend developers to collaborate and deploy websites (pages .dev)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
flappybirdsequel.pages.dev