URL:

https://www.worldmonitor.app/api/download?platform=windows-msi

Full analysis: https://app.any.run/tasks/aa6233c2-13c1-4dae-8f31-cb67bc121c76
Verdict: Malicious activity
Analysis date: March 05, 2026, 16:36:36
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
github
Indicators:
MD5:

8302CD93B4611583B8057E2879FEAC2F

SHA1:

0C7E94B2873B6E1B6F6AE1F7D2C069F815E0D605

SHA256:

241D3A792E1E43CFE93E32195499E43DB5741DCB1970FA088E125E4FF41EDE42

SSDEEP:

3:N8DSLJJBIvML8VK8LBKE0Z1/LEn:2OLhDgVF8bY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 1156)

    • Changes the autorun value in the registry

      • MicrosoftEdgeUpdate.exe (PID: 7236)

    • Potential DLL hijacking behavior detected

      • msedgewebview2.exe (PID: 4828)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 5580)

    • Starts POWERSHELL.EXE for commands execution

      • msiexec.exe (PID: 6500)

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 6500)

    • Manipulates environment variables

      • powershell.exe (PID: 1156)

    • Downloads file from URI via Powershell

      • powershell.exe (PID: 1156)

    • Starts process via Powershell

      • powershell.exe (PID: 1156)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 1156)

    • Executable content was dropped or overwritten

      • MicrosoftEdgeWebview2Setup.exe (PID: 5336)
      • MicrosoftEdgeUpdate.exe (PID: 7236)
      • powershell.exe (PID: 1156)
      • MicrosoftEdge_X64_145.0.3800.82.exe (PID: 8852)
      • setup.exe (PID: 3952)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeUpdate.exe (PID: 7236)
      • MicrosoftEdgeWebview2Setup.exe (PID: 5336)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 7236)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 8648)
      • MicrosoftEdgeUpdate.exe (PID: 9160)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 684)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5896)

    • Application launched itself

      • setup.exe (PID: 3952)
      • MicrosoftEdgeUpdate.exe (PID: 8640)
      • msedgewebview2.exe (PID: 6060)

    • Searches for installed software

      • setup.exe (PID: 3952)

  • INFO

    • Checks supported languages

      • identity_helper.exe (PID: 6800)
      • msiexec.exe (PID: 6500)
      • msiexec.exe (PID: 5048)
      • MicrosoftEdgeWebview2Setup.exe (PID: 5336)
      • MicrosoftEdgeUpdate.exe (PID: 7236)
      • MicrosoftEdgeUpdate.exe (PID: 9160)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 8648)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5896)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 684)
      • MicrosoftEdgeUpdate.exe (PID: 7972)
      • MicrosoftEdgeUpdate.exe (PID: 7548)
      • MicrosoftEdge_X64_145.0.3800.82.exe (PID: 8852)
      • setup.exe (PID: 3952)
      • setup.exe (PID: 8368)
      • MicrosoftEdgeUpdate.exe (PID: 8640)
      • MicrosoftEdgeUpdate.exe (PID: 6296)
      • msedgewebview2.exe (PID: 6060)
      • world-monitor.exe (PID: 2368)
      • msedgewebview2.exe (PID: 9204)
      • msedgewebview2.exe (PID: 4828)
      • msedgewebview2.exe (PID: 1948)
      • msedgewebview2.exe (PID: 1872)
      • msedgewebview2.exe (PID: 5900)
      • msedgewebview2.exe (PID: 5736)
      • node.exe (PID: 684)
      • msedgewebview2.exe (PID: 7868)
      • msedgewebview2.exe (PID: 7652)

    • Reads Environment values

      • identity_helper.exe (PID: 6800)
      • MicrosoftEdgeUpdate.exe (PID: 7972)
      • MicrosoftEdgeUpdate.exe (PID: 6296)
      • msedgewebview2.exe (PID: 6060)
      • msedgewebview2.exe (PID: 4828)

    • Reads the computer name

      • identity_helper.exe (PID: 6800)
      • msiexec.exe (PID: 6500)
      • msiexec.exe (PID: 5048)
      • MicrosoftEdgeUpdate.exe (PID: 7236)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 8648)
      • MicrosoftEdgeUpdate.exe (PID: 9160)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 684)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5896)
      • MicrosoftEdgeUpdate.exe (PID: 7972)
      • MicrosoftEdgeUpdate.exe (PID: 7548)
      • MicrosoftEdgeUpdate.exe (PID: 8640)
      • MicrosoftEdge_X64_145.0.3800.82.exe (PID: 8852)
      • setup.exe (PID: 3952)
      • MicrosoftEdgeUpdate.exe (PID: 6296)
      • world-monitor.exe (PID: 2368)
      • msedgewebview2.exe (PID: 6060)
      • msedgewebview2.exe (PID: 4828)
      • msedgewebview2.exe (PID: 1948)
      • node.exe (PID: 684)
      • msedgewebview2.exe (PID: 7868)

    • Application launched itself

      • msedge.exe (PID: 1068)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 8364)
      • msiexec.exe (PID: 6500)

    • Manual execution by a user

      • msiexec.exe (PID: 8364)

    • Manages system restore points

      • SrTasks.exe (PID: 8004)

    • Checks proxy server information

      • powershell.exe (PID: 1156)
      • MicrosoftEdgeUpdate.exe (PID: 7972)
      • MicrosoftEdgeUpdate.exe (PID: 8640)
      • MicrosoftEdgeUpdate.exe (PID: 6296)
      • slui.exe (PID: 7532)
      • msedgewebview2.exe (PID: 6060)

    • The sample compiled with english language support

      • powershell.exe (PID: 1156)
      • MicrosoftEdgeWebview2Setup.exe (PID: 5336)
      • MicrosoftEdgeUpdate.exe (PID: 7236)
      • MicrosoftEdge_X64_145.0.3800.82.exe (PID: 8852)
      • setup.exe (PID: 3952)

    • Create files in a temporary directory

      • MicrosoftEdgeWebview2Setup.exe (PID: 5336)
      • msedgewebview2.exe (PID: 6060)

    • The executable file from the user directory is run by the Powershell process

      • MicrosoftEdgeWebview2Setup.exe (PID: 5336)

    • Launching a file from a Registry key

      • MicrosoftEdgeUpdate.exe (PID: 7236)

    • Creates files or folders in the user directory

      • MicrosoftEdgeUpdate.exe (PID: 7236)
      • MicrosoftEdge_X64_145.0.3800.82.exe (PID: 8852)
      • MicrosoftEdgeUpdate.exe (PID: 8640)
      • setup.exe (PID: 8368)
      • setup.exe (PID: 3952)
      • msedgewebview2.exe (PID: 6060)
      • msedgewebview2.exe (PID: 9204)
      • msedgewebview2.exe (PID: 1948)
      • world-monitor.exe (PID: 2368)
      • node.exe (PID: 684)

    • Disables trace logs

      • powershell.exe (PID: 1156)

    • Reads security settings of Internet Explorer

      • MicrosoftEdgeUpdate.exe (PID: 7236)
      • MicrosoftEdgeUpdate.exe (PID: 8640)
      • msedgewebview2.exe (PID: 6060)

    • Process checks computer location settings

      • MicrosoftEdgeUpdate.exe (PID: 7236)
      • setup.exe (PID: 3952)
      • msedgewebview2.exe (PID: 6060)
      • msedgewebview2.exe (PID: 5736)
      • node.exe (PID: 684)
      • msedgewebview2.exe (PID: 7652)
      • msedgewebview2.exe (PID: 1872)

    • Reads the machine GUID from the registry

      • MicrosoftEdgeUpdate.exe (PID: 8640)
      • msedgewebview2.exe (PID: 6060)

    • Creates a software uninstall entry

      • setup.exe (PID: 3952)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
210
Monitored processes
52
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs slui.exe srtasks.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs microsoftedgewebview2setup.exe microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe microsoftedge_x64_145.0.3800.82.exe setup.exe setup.exe no specs microsoftedgeupdate.exe world-monitor.exe msedgewebview2.exe msedgewebview2.exe no specs msedgewebview2.exe no specs msedgewebview2.exe msedgewebview2.exe no specs msedgewebview2.exe no specs node.exe conhost.exe no specs msedgewebview2.exe no specs msedgewebview2.exe no specs msedgewebview2.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
664"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=6592,i,9122115976277654861,1511397755121259160,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
684"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.223.11\MicrosoftEdgeUpdateComRegisterShell64.exe" /user C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.223.11\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.223.11
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\1.3.223.11\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
684"\\?\C:\Program Files\World Monitor\sidecar\node\node.exe" "C:\Program Files\World Monitor\sidecar\local-api-server.mjs"C:\Program Files\World Monitor\sidecar\node\node.exe
world-monitor.exe
User:
admin
Company:
Node.js
Integrity Level:
MEDIUM
Description:
Node.js JavaScript Runtime
Version:
22.14.0
Modules
Images
c:\program files\world monitor\sidecar\node\node.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\dbghelp.dll
1068"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-features=HttpsUpgrades,HttpsFirstModeV2,HttpsOnlyMode,HttpsFirstBalancedMode --no-first-run --no-default-browser-check https://www.worldmonitor.app/api/download?platform=windows-msiC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1156powershell.exe -NoProfile -windowstyle hidden try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 } catch {}; Invoke-WebRequest -Uri "https://go.microsoft.com/fwlink/p/?LinkId=2124703" -OutFile "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" ; Start-Process -FilePath "$env:TEMP\MicrosoftEdgeWebview2Setup.exe" -ArgumentList ('/silent', '/install') -WaitC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1868"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4280,i,9122115976277654861,1511397755121259160,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1872"C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\145.0.3800.82\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\app.worldmonitor.desktop\EBWebView" --webview-exe-name=world-monitor.exe --webview-exe-version=2.5.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--expose-gc --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=8 --skip-read-main-dll --metrics-shmem-handle=4800,i,2866494553436989617,12651996256039720693,2097152 --field-trial-handle=1848,i,9263693862350292922,17999343793802704499,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4864 /prefetch:1C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\145.0.3800.82\msedgewebview2.exe—msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge WebView2
Version:
145.0.3800.82
Modules
Images
c:\users\admin\appdata\local\microsoft\edgewebview\application\145.0.3800.82\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\microsoft\edgewebview\application\145.0.3800.82\msedge_elf.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\shcore.dll
1948"C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\145.0.3800.82\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\app.worldmonitor.desktop\EBWebView" --webview-exe-name=world-monitor.exe --webview-exe-version=2.5.23 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --startup-read-main-dll --metrics-shmem-handle=2156,i,2439359415159761728,1287835888617567029,524288 --field-trial-handle=1848,i,9263693862350292922,17999343793802704499,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2164 /prefetch:3C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\145.0.3800.82\msedgewebview2.exe
msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge WebView2
Version:
145.0.3800.82
Modules
Images
c:\users\admin\appdata\local\microsoft\edgewebview\application\145.0.3800.82\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\microsoft\edgewebview\application\145.0.3800.82\msedge_elf.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\shcore.dll
2248"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3652,i,9122115976277654861,1511397755121259160,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2368"C:\Program Files\World Monitor\world-monitor.exe"C:\Program Files\World Monitor\world-monitor.exe
msiexec.exe
User:
admin
Company:
worldmonitor
Integrity Level:
MEDIUM
Description:
World Monitor
Version:
2.5.23
Modules
Images
c:\program files\world monitor\world-monitor.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
22 177
Read events
20 546
Write events
1 554
Delete events
77

Modification events

(PID) Process:(6500) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
48000000000000006230CF59BEACDC0164190000B0130000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6500) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
48000000000000006230CF59BEACDC0164190000B0130000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6500) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
15
(PID) Process:(5580) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000B690F059BEACDC01CC1500000C110000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5580) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000B690F059BEACDC01CC1500005C220000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5580) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000B690F059BEACDC01CC1500002C1C0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5580) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000B690F059BEACDC01CC15000098020000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5580) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:delete keyName:(default)
Value:
(PID) Process:(5580) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\11000001
Operation:writeName:Element
Value:
0000000000000000000000000000000006000000000000004800000000000000715E5C2FA985EB1190A89A9B763584210000000000000000745E5C2FA985EB1190A89A9B7635842100000000000000000000000000000000
(PID) Process:(5580) VSSVC.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{9dea862c-5cdd-4e70-acc1-f32b344d4795}\Elements\12000002
Operation:delete keyName:(default)
Value:
Executable files
210
Suspicious files
251
Text files
405
Unknown types
0

Dropped files

PID
Process
Filename
Type
1068msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old~RF1e4f47.TMP —
MD5:—
SHA256:—
1068msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old —
MD5:—
SHA256:—
1068msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF1e4f56.TMP —
MD5:—
SHA256:—
1068msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF1e4f47.TMP —
MD5:—
SHA256:—
1068msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
1068msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
1068msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF1e4f66.TMP —
MD5:—
SHA256:—
1068msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old —
MD5:—
SHA256:—
1068msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF1e4f85.TMP —
MD5:—
SHA256:—
1068msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
87
TCP/UDP connections
272
DNS requests
244
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3088
msedge.exe
GET
302
172.67.74.107:443
https://www.worldmonitor.app/api/download?platform=windows-msi
unknown
—
—
unknown
3088
msedge.exe
GET
302
140.82.121.4:443
https://github.com/koala73/worldmonitor/releases/download/v2.5.23/World.Monitor_2.5.23_x64_en-US.msi
unknown
—
—
whitelisted
3088
msedge.exe
GET
304
150.171.28.11:443
https://edge.microsoft.com/abusiveadblocking/api/v1/blocklist
unknown
—
—
whitelisted
—
—
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQ3L3%2F%2Fa6ADK8NraY2GXzVaYrHG4AQUb6t%2B2v%2BXQ3LsO2d33oJhNYhHQoUCEzMAAAAGb6JMMcOVb6sAAAAAAAY%3D
unknown
—
—
whitelisted
—
—
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAjTxtAB8my1oj8MfWpz%2F7Y%3D
unknown
—
—
whitelisted
3088
msedge.exe
GET
200
150.171.27.11:443
https://edge.microsoft.com/serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.19045&devicefamily=desktop&installdate=1661339457&clientversion=133.0.3065.92&experimentationmode=2&scpguard=0&scpfull=0&scpver=0
unknown
text
295 b
whitelisted
3088
msedge.exe
GET
200
150.171.28.11:80
http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:lcyMJGFz_aUO2TocLMtx_NOsloQdzjttd9fO6PdyRig&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
3088
msedge.exe
GET
200
104.18.22.222:443
https://copilot.microsoft.com/c/api/user/eligibility
unknown
text
25 b
whitelisted
3088
msedge.exe
GET
200
52.123.243.88:443
https://config.edge.skype.com/config/v1/Edge/133.0.3065.92?clientId=4489578223053569932&agents=Edge%2CEdgeConfig%2CEdgeServices%2CEdgeFirstRun%2CEdgeFirstRunConfig&osname=win&client=edge&channel=stable&scpfre=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=66&mngd=0&installdate=1661339457&edu=0&soobedate=1504771245&bphint=2&fg=1&lbfgdate=1766135237&lafgdate=0
unknown
text
4.38 Kb
whitelisted
3088
msedge.exe
POST
200
142.250.201.163:443
https://update.googleapis.com/service/update2/json?cup2key=14:PgFoWIMkt7RCJqBAC6gqSjdvJPctxkPsRiY1g3bigvg&cup2hreq=764fd5af8c33f201d1f66276be32c3ea77d3e3922c74431bea6369226aadd4b8
unknown
text
891 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6768
MoUsoCoreWorker.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
5568
SearchApp.exe
92.123.104.6:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
8400
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
492
RUXIMICS.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
204.79.197.203:80
oneocsp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3088
msedge.exe
150.171.28.11:80
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3088
msedge.exe
52.123.243.88:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3088
msedge.exe
150.171.27.11:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 92.123.104.6
  • 92.123.104.63
  • 92.123.104.66
  • 92.123.104.67
  • 92.123.104.62
  • 92.123.104.61
  • 92.123.104.7
  • 92.123.104.65
  • 92.123.104.64
whitelisted
google.com
  • 142.251.36.110
whitelisted
self.events.data.microsoft.com
  • 52.182.143.213
  • 52.168.117.169
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
oneocsp.microsoft.com
  • 204.79.197.203
whitelisted
edge.microsoft.com
  • 150.171.28.11
  • 150.171.27.11
whitelisted
config.edge.skype.com
  • 52.123.243.88
  • 52.123.243.197
  • 52.123.243.194
  • 52.123.243.216
  • 150.171.22.17
  • 52.123.243.223
  • 52.123.224.75
  • 52.123.243.203
  • 52.123.224.71
  • 52.123.224.67
  • 52.123.224.69
  • 52.123.224.68
  • 52.123.243.221
whitelisted
www.worldmonitor.app
  • 172.67.74.107
  • 104.26.4.161
  • 104.26.5.161
whitelisted
api.edgeoffer.microsoft.com
  • 13.107.213.44
  • 13.107.246.44
whitelisted
copilot.microsoft.com
  • 104.18.22.222
  • 104.18.23.222
whitelisted

Threats

PID
Process
Class
Message
3088
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access release user assets on GitHub
3404
svchost.exe
Misc activity
ET INFO Packed Executable Download
6768
MoUsoCoreWorker.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
1156
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
1156
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
1156
powershell.exe
Misc activity
ET INFO Request for EXE via Powershell
1156
powershell.exe
Misc activity
ET INFO Packed Executable Download
1948
msedgewebview2.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
1948
msedgewebview2.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
Process
Message
msedgewebview2.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\app.worldmonitor.desktop directory exists )
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.worldmonitor.app/api/download?platform=windows-msi