| URL: | https://www.idrive.com/idrive/sh/sh?k=v8t1x1v1u8 |
| Full analysis: | https://app.any.run/tasks/20dd3cde-4cf7-40a2-abaf-10831d12db22 |
| Verdict: | Malicious activity |
| Threats: | Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. |
| Analysis date: | May 07, 2026, 20:59:46 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 03E64323E2C2742036EE633DA7319735 |
| SHA1: | CC732A194D4C8CA05387B65AADD526B9543C2516 |
| SHA256: | 1A5D05986382805E2A857069A15EB4D4FAEF499B4D31628EE0B9EFA44A0AB2B4 |
| SSDEEP: | 3:N8DSL7E8YACUUTJd:2OL79MN/ |
MALICIOUS
Changes the autorun value in the registry
- ABRIR_DOCUMENTO_ENVIADO_EQUIVALENTE_FACTURA_FEV45801__UNIDAD DE INVESTIGACION CRIMINAL DE LA DEFENSA SAS 991032901_ .exe (PID: 8632)
- ABRIR_DOCUMENTO_ENVIADO_EQUIVALENTE_FACTURA_FEV45801__UNIDAD DE INVESTIGACION CRIMINAL DE LA DEFENSA SAS 991032901_ .exe (PID: 8948)
Actions looks like stealing of personal data
- MSBuild.exe (PID: 8728)
SUSPICIOUS
Possible stealing from crypto wallets
- MSBuild.exe (PID: 8728)
Executable content was dropped or overwritten
- ABRIR_DOCUMENTO_ENVIADO_EQUIVALENTE_FACTURA_FEV45801__UNIDAD DE INVESTIGACION CRIMINAL DE LA DEFENSA SAS 991032901_ .exe (PID: 8948)
- ABRIR_DOCUMENTO_ENVIADO_EQUIVALENTE_FACTURA_FEV45801__UNIDAD DE INVESTIGACION CRIMINAL DE LA DEFENSA SAS 991032901_ .exe (PID: 8632)
Contacting a server suspected of hosting an CnC
- MSBuild.exe (PID: 8728)
INFO
Application launched itself
- msedge.exe (PID: 684)
Checks supported languages
- identity_helper.exe (PID: 2000)
- ABRIR_DOCUMENTO_ENVIADO_EQUIVALENTE_FACTURA_FEV45801__UNIDAD DE INVESTIGACION CRIMINAL DE LA DEFENSA SAS 991032901_ .exe (PID: 8632)
- MSBuild.exe (PID: 8728)
- ABRIR_DOCUMENTO_ENVIADO_EQUIVALENTE_FACTURA_FEV45801__UNIDAD DE INVESTIGACION CRIMINAL DE LA DEFENSA SAS 991032901_ .exe (PID: 8948)
- MSBuild.exe (PID: 8352)
Reads the computer name
- identity_helper.exe (PID: 2000)
- ABRIR_DOCUMENTO_ENVIADO_EQUIVALENTE_FACTURA_FEV45801__UNIDAD DE INVESTIGACION CRIMINAL DE LA DEFENSA SAS 991032901_ .exe (PID: 8632)
- MSBuild.exe (PID: 8728)
- ABRIR_DOCUMENTO_ENVIADO_EQUIVALENTE_FACTURA_FEV45801__UNIDAD DE INVESTIGACION CRIMINAL DE LA DEFENSA SAS 991032901_ .exe (PID: 8948)
- MSBuild.exe (PID: 8352)
The sample compiled with english language support
- msedge.exe (PID: 8164)
- WinRAR.exe (PID: 8400)
- ABRIR_DOCUMENTO_ENVIADO_EQUIVALENTE_FACTURA_FEV45801__UNIDAD DE INVESTIGACION CRIMINAL DE LA DEFENSA SAS 991032901_ .exe (PID: 8632)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 8400)
Reads Environment values
- identity_helper.exe (PID: 2000)
Reads security settings of Internet Explorer
- WinRAR.exe (PID: 8400)
Creates files or folders in the user directory
- ABRIR_DOCUMENTO_ENVIADO_EQUIVALENTE_FACTURA_FEV45801__UNIDAD DE INVESTIGACION CRIMINAL DE LA DEFENSA SAS 991032901_ .exe (PID: 8632)
Launching a file from a Registry key
- ABRIR_DOCUMENTO_ENVIADO_EQUIVALENTE_FACTURA_FEV45801__UNIDAD DE INVESTIGACION CRIMINAL DE LA DEFENSA SAS 991032901_ .exe (PID: 8632)
- ABRIR_DOCUMENTO_ENVIADO_EQUIVALENTE_FACTURA_FEV45801__UNIDAD DE INVESTIGACION CRIMINAL DE LA DEFENSA SAS 991032901_ .exe (PID: 8948)
Create files in a temporary directory
- ABRIR_DOCUMENTO_ENVIADO_EQUIVALENTE_FACTURA_FEV45801__UNIDAD DE INVESTIGACION CRIMINAL DE LA DEFENSA SAS 991032901_ .exe (PID: 8948)
- ABRIR_DOCUMENTO_ENVIADO_EQUIVALENTE_FACTURA_FEV45801__UNIDAD DE INVESTIGACION CRIMINAL DE LA DEFENSA SAS 991032901_ .exe (PID: 8632)
Reads the machine GUID from the registry
- MSBuild.exe (PID: 8728)
- MSBuild.exe (PID: 8352)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
167
Monitored processes
32
Malicious processes
4
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 684 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-features=HttpsUpgrades,HttpsFirstModeV2,HttpsOnlyMode,HttpsFirstBalancedMode --no-first-run --no-default-browser-check https://www.idrive.com/idrive/sh/sh?k=v8t1x1v1u8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Version: 133.0.3065.92 Modules
| |||||||||||||||
| 2000 | "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=6552,i,15198021588391149169,1320623085446677037,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\identity_helper.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: PWA Identity Proxy Host Exit code: 0 Version: 133.0.3065.92 Modules
| |||||||||||||||
| 2232 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2332 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=5848,i,15198021588391149169,1320623085446677037,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 133.0.3065.92 Modules
| |||||||||||||||
| 2368 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=5584,i,15198021588391149169,1320623085446677037,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 133.0.3065.92 Modules
| |||||||||||||||
| 4312 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3692,i,15198021588391149169,1320623085446677037,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 133.0.3065.92 Modules
| |||||||||||||||
| 4316 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.142 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.92 --initial-client-data=0x294,0x298,0x29c,0x28c,0x2a4,0x7ffe2392f208,0x7ffe2392f214,0x7ffe2392f220 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Version: 133.0.3065.92 Modules
| |||||||||||||||
| 4328 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3672,i,15198021588391149169,1320623085446677037,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 133.0.3065.92 Modules
| |||||||||||||||
| 4396 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2324,i,15198021588391149169,1320623085446677037,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 133.0.3065.92 Modules
| |||||||||||||||
| 4564 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=2748,i,15198021588391149169,1320623085446677037,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 133.0.3065.92 Modules
| |||||||||||||||
Total events
6 322
Read events
6 312
Write events
10
Delete events
0
Modification events
| (PID) Process: | (8400) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (8400) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (8400) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Downloads\chromium_build 1.zip | |||
| (PID) Process: | (8400) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Downloads\FACTURA_FEV45801__UNIDAD DE INVESTIGACION CRIMINAL DE LA DEFENSA SAS 9910329017.rar | |||
| (PID) Process: | (8400) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (8400) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (8400) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (8400) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (8632) ABRIR_DOCUMENTO_ENVIADO_EQUIVALENTE_FACTURA_FEV45801__UNIDAD DE INVESTIGACION CRIMINAL DE LA DEFENSA SAS 991032901_ .exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | ASUS App Service |
Value: cmd /c cd /d "C:\Users\admin\AppData\Roaming\ASUS App Service" & "C:\Users\admin\AppData\Roaming\ASUS App Service\ABRIR_DOCUMENTO_ENVIADO_EQUIVALENTE_FACTURA_FEV45801__UNIDAD DE INVESTIGACION CRIMINAL DE LA DEFENSA SAS 991032901_ .exe" | |||
| (PID) Process: | (8948) ABRIR_DOCUMENTO_ENVIADO_EQUIVALENTE_FACTURA_FEV45801__UNIDAD DE INVESTIGACION CRIMINAL DE LA DEFENSA SAS 991032901_ .exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | ASUS App Service |
Value: cmd /c cd /d "C:\Users\admin\AppData\Roaming\ASUS App Service" & "C:\Users\admin\AppData\Roaming\ASUS App Service\ABRIR_DOCUMENTO_ENVIADO_EQUIVALENTE_FACTURA_FEV45801__UNIDAD DE INVESTIGACION CRIMINAL DE LA DEFENSA SAS 991032901_ .exe" | |||
Executable files
8
Suspicious files
81
Text files
259
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 684 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old~RFdfbb6.TMP | — | |
MD5:— | SHA256:— | |||
| 684 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old | — | |
MD5:— | SHA256:— | |||
| 684 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RFdfbb6.TMP | — | |
MD5:— | SHA256:— | |||
| 684 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RFdfbb6.TMP | — | |
MD5:— | SHA256:— | |||
| 684 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 684 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RFdfbc5.TMP | — | |
MD5:— | SHA256:— | |||
| 684 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 684 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RFdfbc5.TMP | — | |
MD5:— | SHA256:— | |||
| 684 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RFdfbc5.TMP | — | |
MD5:— | SHA256:— | |||
| 684 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
159
TCP/UDP connections
68
DNS requests
62
Threats
12
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
8164 | msedge.exe | GET | 302 | 148.66.234.46:443 | https://www.idrive.com/idrive/sh/sh?k=v8t1x1v1u8 | US | — | — | unknown |
8164 | msedge.exe | GET | 200 | 150.171.28.11:80 | http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:MK5p2CEh6dLE01IW2V19k9nBrnS5CorJqSmBpAwEuzE&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 | US | text | 101 b | whitelisted |
8164 | msedge.exe | GET | 200 | 150.171.27.11:443 | https://edge.microsoft.com/serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.19045&devicefamily=desktop&installdate=1661339457&clientversion=133.0.3065.92&experimentationmode=2&scpguard=0&scpfull=0&scpver=0 | US | text | 132 b | whitelisted |
8164 | msedge.exe | GET | 200 | 104.18.22.222:443 | https://copilot.microsoft.com/c/api/user/eligibility | US | text | 25 b | whitelisted |
8164 | msedge.exe | GET | 200 | 150.171.109.100:443 | https://api.edgeoffer.microsoft.com/edgeoffer/pb/experiments?appId=edge-extensions&country=US | US | binary | 82 b | whitelisted |
8164 | msedge.exe | GET | 200 | 150.171.22.17:443 | https://config.edge.skype.com/config/v1/Edge/133.0.3065.92?clientId=4489578223053569932&agents=EdgeRuntime%2CEdgeRuntimeConfig%2CEdgeDomainActions&osname=win&client=edge&channel=stable&scpfre=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=67&mngd=0&installdate=1661339457&edu=0&soobedate=1504771245&bphint=2&fg=1&lbfgdate=1778187593&lafgdate=0 | US | text | 43.4 Kb | whitelisted |
8164 | msedge.exe | GET | 200 | 148.66.234.46:443 | https://www.idrive.com/idrive/sh/sh/v8t1x1v1u8 | US | text | 34.0 Kb | unknown |
8164 | msedge.exe | GET | 200 | 188.114.97.3:443 | https://static.idriveonlinebackup.com/include/css/theme.css | US | text | 438 Kb | unknown |
8164 | msedge.exe | GET | 200 | 184.86.251.27:443 | https://www.bing.com/bloomfilterfiles/ExpandedDomainsFilterGlobal.json | NL | text | 665 Kb | whitelisted |
8164 | msedge.exe | GET | 200 | 188.114.97.3:443 | https://static.idriveonlinebackup.com/include/css/styles_receiver.css?ver=1.0.25 | US | text | 79.0 Kb | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | Not routed | — | whitelisted |
6684 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
5276 | MoUsoCoreWorker.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
— | — | 48.192.1.64:443 | activation-v2.sls.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
4 | System | 192.168.100.255:138 | — | Not routed | — | whitelisted |
8164 | msedge.exe | 150.171.22.17:443 | config.edge.skype.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
8164 | msedge.exe | 150.171.28.11:80 | edge.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
8164 | msedge.exe | 148.66.234.46:443 | www.idrive.com | ASN-FLEXENTIAL | US | whitelisted |
8164 | msedge.exe | 150.171.27.11:443 | edge.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
8164 | msedge.exe | 150.171.109.100:443 | api.edgeoffer.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
edge.microsoft.com |
| whitelisted |
config.edge.skype.com |
| whitelisted |
www.idrive.com |
| whitelisted |
api.edgeoffer.microsoft.com |
| whitelisted |
copilot.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
static.idriveonlinebackup.com |
| unknown |
Threats
PID | Process | Class | Message |
|---|---|---|---|
8164 | msedge.exe | Not Suspicious Traffic | INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com) |
8164 | msedge.exe | Not Suspicious Traffic | INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com) |
6684 | svchost.exe | Unknown Traffic | ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW) |
8164 | msedge.exe | Not Suspicious Traffic | INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com) |
8164 | msedge.exe | Not Suspicious Traffic | INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com) |
2232 | svchost.exe | Potentially Bad Traffic | ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain |
2232 | svchost.exe | Misc activity | ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain |
8728 | MSBuild.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 25 |
8728 | MSBuild.exe | A Network Trojan was detected | MALWARE [ANY.RUN] Win32/Common RAT related JA3 hash observed |
8728 | MSBuild.exe | Misc activity | HUNTING [ANY.RUN] TLS cert too long-lived (>2029-12-31) |