URL:

edgedl.me.gvt1.com

Full analysis: https://app.any.run/tasks/b2fa74ad-b23f-43d6-a19f-b9ca46cd4155
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 16, 2024, 19:36:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

0BE689C143B9D610085E1A469D891BE4

SHA1:

8237F030D52B5800F7860C94FBF0B1CE6B0FB34F

SHA256:

2B297C7B1A66C0391C056D2346943D5E648BE48E14F3BD234A1B79E270680F88

SSDEEP:

3:kDUupGT:kD1pK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • ChromeSetup.exe (PID: 2440)
      • GoogleUpdateSetup.exe (PID: 1576)
      • GoogleUpdate.exe (PID: 1768)
      • 109.0.5414.120_chrome_installer.exe (PID: 1592)
      • setup.exe (PID: 3252)

    • Changes the autorun value in the registry

      • setup.exe (PID: 3252)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • ChromeSetup.exe (PID: 2440)
      • GoogleUpdateSetup.exe (PID: 1576)
      • GoogleUpdate.exe (PID: 1768)
      • 109.0.5414.120_chrome_installer.exe (PID: 1592)
      • setup.exe (PID: 3252)

    • Disables SEHOP

      • GoogleUpdate.exe (PID: 1768)

    • Creates/Modifies COM task schedule object

      • GoogleUpdate.exe (PID: 2260)

    • Reads the Internet Settings

      • GoogleUpdate.exe (PID: 2244)
      • GoogleUpdate.exe (PID: 2968)

    • Executes as Windows Service

      • GoogleUpdate.exe (PID: 1848)

    • Reads security settings of Internet Explorer

      • GoogleUpdate.exe (PID: 2968)

    • Checks Windows Trust Settings

      • GoogleUpdate.exe (PID: 2968)

    • Reads settings of System Certificates

      • GoogleUpdate.exe (PID: 2244)
      • GoogleUpdate.exe (PID: 2968)

    • Application launched itself

      • setup.exe (PID: 3252)
      • setup.exe (PID: 3256)
      • GoogleUpdate.exe (PID: 1848)

    • Searches for installed software

      • setup.exe (PID: 3252)

    • Creates a software uninstall entry

      • setup.exe (PID: 3252)

    • Reads the date of Windows installation

      • setup.exe (PID: 3256)

  • INFO

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2472)

    • Checks supported languages

      • ChromeSetup.exe (PID: 2440)
      • GoogleUpdate.exe (PID: 3516)
      • GoogleUpdate.exe (PID: 1768)
      • GoogleUpdateSetup.exe (PID: 1576)
      • GoogleUpdate.exe (PID: 1900)
      • GoogleUpdate.exe (PID: 2968)
      • GoogleUpdate.exe (PID: 2244)
      • GoogleUpdate.exe (PID: 2260)
      • GoogleUpdate.exe (PID: 1848)
      • setup.exe (PID: 3256)
      • 109.0.5414.120_chrome_installer.exe (PID: 1592)
      • setup.exe (PID: 3252)
      • setup.exe (PID: 3172)
      • setup.exe (PID: 4064)
      • GoogleCrashHandler.exe (PID: 548)
      • GoogleUpdate.exe (PID: 1316)
      • GoogleUpdateOnDemand.exe (PID: 3744)
      • GoogleUpdate.exe (PID: 2080)
      • elevation_service.exe (PID: 3684)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 2472)
      • iexplore.exe (PID: 3916)

    • Create files in a temporary directory

      • ChromeSetup.exe (PID: 2440)
      • GoogleUpdate.exe (PID: 2968)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 2472)
      • iexplore.exe (PID: 3916)

    • Reads the machine GUID from the registry

      • GoogleUpdate.exe (PID: 3516)
      • GoogleUpdate.exe (PID: 1768)
      • GoogleUpdate.exe (PID: 1848)
      • GoogleUpdate.exe (PID: 2244)
      • GoogleUpdate.exe (PID: 2968)
      • setup.exe (PID: 3252)
      • GoogleUpdate.exe (PID: 2080)
      • GoogleUpdate.exe (PID: 1316)
      • setup.exe (PID: 3256)
      • elevation_service.exe (PID: 3684)

    • The process uses the downloaded file

      • iexplore.exe (PID: 2472)
      • ChromeSetup.exe (PID: 2440)
      • chrome.exe (PID: 3824)
      • chrome.exe (PID: 996)

    • Reads the computer name

      • GoogleUpdate.exe (PID: 3516)
      • GoogleUpdate.exe (PID: 1768)
      • GoogleUpdate.exe (PID: 2260)
      • GoogleUpdate.exe (PID: 1900)
      • GoogleUpdate.exe (PID: 2244)
      • GoogleUpdate.exe (PID: 2968)
      • GoogleUpdate.exe (PID: 1848)
      • 109.0.5414.120_chrome_installer.exe (PID: 1592)
      • setup.exe (PID: 3252)
      • setup.exe (PID: 3256)
      • GoogleUpdate.exe (PID: 1316)
      • GoogleCrashHandler.exe (PID: 548)
      • GoogleUpdate.exe (PID: 2080)
      • elevation_service.exe (PID: 3684)

    • Creates files in the program directory

      • GoogleUpdateSetup.exe (PID: 1576)
      • GoogleUpdate.exe (PID: 1900)
      • GoogleUpdate.exe (PID: 2260)
      • GoogleUpdate.exe (PID: 2244)
      • GoogleUpdate.exe (PID: 1768)
      • GoogleUpdate.exe (PID: 1848)
      • GoogleUpdate.exe (PID: 2968)
      • setup.exe (PID: 3252)
      • 109.0.5414.120_chrome_installer.exe (PID: 1592)
      • GoogleCrashHandler.exe (PID: 548)
      • GoogleUpdate.exe (PID: 1316)
      • setup.exe (PID: 3256)

    • Application launched itself

      • iexplore.exe (PID: 2472)
      • chrome.exe (PID: 392)

    • Checks proxy server information

      • GoogleUpdate.exe (PID: 2968)

    • Creates files or folders in the user directory

      • GoogleUpdate.exe (PID: 2968)

    • Reads the software policy settings

      • GoogleUpdate.exe (PID: 2968)
      • GoogleUpdate.exe (PID: 1848)
      • GoogleUpdate.exe (PID: 2244)
      • GoogleUpdate.exe (PID: 1316)

    • Executes as Windows Service

      • elevation_service.exe (PID: 3684)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
81
Monitored processes
36
Malicious processes
11
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe chromesetup.exe googleupdate.exe no specs googleupdatesetup.exe googleupdate.exe googleupdate.exe no specs googleupdate.exe no specs googleupdate.exe googleupdate.exe googleupdate.exe 109.0.5414.120_chrome_installer.exe setup.exe setup.exe no specs setup.exe no specs setup.exe no specs googlecrashhandler.exe no specs googleupdate.exe googleupdateondemand.exe no specs googleupdate.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs elevation_service.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
392"C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installerC:\Program Files\Google\Chrome\Application\chrome.exe
GoogleUpdate.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
548"C:\Program Files\Google\Update\1.3.36.372\GoogleCrashHandler.exe"C:\Program Files\Google\Update\1.3.36.372\GoogleCrashHandler.exe—GoogleUpdate.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Crash Handler
Exit code:
0
Version:
1.3.36.371
Modules
Images
c:\program files\google\update\1.3.36.372\googlecrashhandler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
908"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x696c8b38,0x696c8b48,0x696c8b54C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
996"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=3792 --field-trial-handle=1180,i,1244763754199929775,12855257402762080963,131072 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1044"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=3940 --field-trial-handle=1180,i,1244763754199929775,12855257402762080963,131072 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1316"C:\Program Files\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zNzIiIHNoZWxsX3ZlcnNpb249IjEuMy4zMy4yMyIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9IntDRTk1RTFFQS1CODE2LTQ5MkYtQkYxNi1CNTdEN0FBRDY3RUF9IiB1c2VyaWQ9IntGQzVBMkFEMy1DREE1LTQ1RDItOTEzNS1FMzcxRjQxNUVBMzh9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgcmVxdWVzdGlkPSJ7MDg0QUEzQkItQkVEMi00ODc4LUI1NjgtN0ZCMkE4RDBGRjkwfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIzIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4yNDU0NiIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4ODYiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNDLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTA5LjAuNTQxNC4xMjAiIGFwPSJzdGFibGUtYXJjaF94ODYtc3RhdHNkZWZfMSIgbGFuZz0iZW4iIGJyYW5kPSIiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxOTk4IiBpbnN0YWxsZGF0ZT0iNDI1NiIgaWlkPSJ7NERGNTMxQjEtRDQ2OC1BODg3LTZFMEMtNTg4QzE0NjREODA5fSIgY29ob3J0PSIxOjFnOHg6IiBjb2hvcnRuYW1lPSJXaW5kb3dzIDciPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vZWRnZWRsLm1lLmd2dDEuY29tL2VkZ2VkbC9yZWxlYXNlMi9jaHJvbWUvYWNpaHRrY3VleXllM3ltb2oyYWZ2djd1bHp4YV8xMDkuMC41NDE0LjEyMC8xMDkuMC41NDE0LjEyMF9jaHJvbWVfaW5zdGFsbGVyLmV4ZSIgZG93bmxvYWRlZD0iODkyNjgyNjQiIHRvdGFsPSI4OTI2ODI2NCIgZG93bmxvYWRfdGltZV9tcz0iODkxNDEiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5NjYwOSIgc291cmNlX3VybF9pbmRleD0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9Ijc1MCIgZG93bmxvYWRfdGltZV9tcz0iOTA2MDkiIGRvd25sb2FkZWQ9Ijg5MjY4MjY0IiB0b3RhbD0iODkyNjgyNjQiIGluc3RhbGxfdGltZV9tcz0iMTM5MzciLz48L2FwcD48L3JlcXVlc3Q-C:\Program Files\Google\Update\GoogleUpdate.exe
GoogleUpdate.exe
User:
SYSTEM
Company:
Google Inc.
Integrity Level:
SYSTEM
Description:
Google Installer
Exit code:
0
Version:
1.3.33.23
Modules
Images
c:\program files\google\update\googleupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
1572"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=3660 --field-trial-handle=1180,i,1244763754199929775,12855257402762080963,131072 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1576"C:\Users\admin\AppData\Local\Temp\GUM7683.tmp\GoogleUpdateSetup.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={4DF531B1-D468-A887-6E0C-588C1464D809}&lang=en&browser=2&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=stable-arch_x86-statsdef_1&installdataindex=defaultbrowser" /installelevated /nomitagC:\Users\admin\AppData\Local\Temp\GUM7683.tmp\GoogleUpdateSetup.exe
GoogleUpdate.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Update Setup
Exit code:
0
Version:
1.3.36.372
Modules
Images
c:\users\admin\appdata\local\temp\gum7683.tmp\googleupdatesetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1592"C:\Program Files\Google\Update\Install\{AC059B01-B721-4FB6-82E9-3B343626BAE0}\109.0.5414.120_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --system-level /installerdata="C:\Program Files\Google\Update\Install\{AC059B01-B721-4FB6-82E9-3B343626BAE0}\guiEE31.tmp"C:\Program Files\Google\Update\Install\{AC059B01-B721-4FB6-82E9-3B343626BAE0}\109.0.5414.120_chrome_installer.exe
GoogleUpdate.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome Installer
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\update\install\{ac059b01-b721-4fb6-82e9-3b343626bae0}\109.0.5414.120_chrome_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1692"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2152 --field-trial-handle=1180,i,1244763754199929775,12855257402762080963,131072 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
55 117
Read events
51 394
Write events
3 509
Delete events
214

Modification events

(PID) Process:(2472) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2472) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(2472) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31088911
(PID) Process:(2472) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(2472) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31088911
(PID) Process:(2472) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2472) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2472) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2472) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2472) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
214
Suspicious files
45
Text files
77
Unknown types
36

Dropped files

PID
Process
Filename
Type
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAder
MD5:58AE077B2C647953A4BF11E0985751A9
SHA256:33D1F33B714843583A6E44F1D3F406322BF45700697E1685C6EF0CD2D0B0EBB4
3916iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\chrome[1].htmhtml
MD5:7CBC7A15781190E00D512A0C938D3F28
SHA256:46A8C642152C42ACA7750EB75157EBA7A38963FB90AFC2094DD82A70019C58CC
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:CAA7875CA8BBC6DA37F4B6FBA14A4141
SHA256:7A481B32A1BE97D66233D5EB58EAAFC34DD2A2B0BA8184F5EF4B57F682146D95
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_FA6E4B522C9C404D38E1A6F1BB26EC85der
MD5:5A17068D4606E1E5A5744FB7595F3AE3
SHA256:F7EAD61980FE9D2CA06E7619EB30003234DB0B4279AB0190E07AAC145B707FDF
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_FA6E4B522C9C404D38E1A6F1BB26EC85binary
MD5:57F6E050E3BB8FE548F1F5490916AB46
SHA256:0F3740A55C3175BF0B1C45B9974655ACE5F702DED0281081707BA1B17A15590F
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAder
MD5:AC89A852C2AAA3D389B2D2DD312AD367
SHA256:0B720E19270C672F9B6E0EC40B468AC49376807DE08A814573FE038779534F45
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:DDA0FC44DAB0EC257887205EBE94EE97
SHA256:F99A563BB87B6A35CF806AD4B847E3F39FA53171D0D762E1A0AA748F86D7EDC1
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:C1431D5EDAE7857643EBD898CBCEDC88
SHA256:81730EDFA438459CB7D83A96CAEA05D20A804734B2461CA6352568992DD84BC3
3916iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\icon-warning[1].svgimage
MD5:5306108600365CA08EAA4CA7463CBBB6
SHA256:9337180E35CAE8A5A0577F8DFF2CF822AAD2406D267A4BDD642CC6C79224F088
3916iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\icon-help[1].jpgimage
MD5:31301C8B938DA756C73D00E0EC95FDB2
SHA256:6EADEC320F64326146500629EAF8BC5D801EA1192FB1DC3EC59D4C789FB55338
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
67
DNS requests
31
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3916
iexplore.exe
GET
302
34.104.35.123:80
http://edgedl.me.gvt1.com/
unknown
—
—
unknown
3916
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f78d505714a595e3
unknown
—
—
unknown
3916
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?545e1839169dd0e6
unknown
—
—
unknown
3916
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
3916
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
binary
724 b
unknown
3916
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCGGqSzvzmf7hIegNAI9yko
unknown
binary
472 b
unknown
3916
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEAch2W18yjrFCctU7xjW0Yc%3D
unknown
binary
471 b
unknown
3916
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCAKlf1nuem1AlkNvBwxf5A
unknown
binary
472 b
unknown
2472
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?70b4a85d87201c80
unknown
—
—
unknown
3916
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCSnN9%2FWcCK6QmbjMlxbrBK
unknown
binary
472 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3916
iexplore.exe
34.104.35.123:80
edgedl.me.gvt1.com
GOOGLE
US
whitelisted
3916
iexplore.exe
172.217.16.132:443
www.google.com
GOOGLE
US
whitelisted
3916
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3916
iexplore.exe
142.250.185.131:80
ocsp.pki.goog
GOOGLE
US
whitelisted
3916
iexplore.exe
216.58.212.138:443
fonts.googleapis.com
GOOGLE
US
whitelisted
3916
iexplore.exe
142.250.185.131:443
ocsp.pki.goog
GOOGLE
US
whitelisted
3916
iexplore.exe
142.250.185.227:443
fonts.gstatic.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
edgedl.me.gvt1.com
  • 34.104.35.123
whitelisted
www.google.com
  • 172.217.16.132
  • 142.250.186.36
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.pki.goog
  • 142.250.185.131
whitelisted
fonts.googleapis.com
  • 216.58.212.138
whitelisted
www.gstatic.com
  • 142.250.185.131
whitelisted
fonts.gstatic.com
  • 142.250.185.227
whitelisted
tools.google.com
  • 142.250.186.46
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 92.123.104.33
  • 92.123.104.40
  • 92.123.104.32
  • 92.123.104.7
  • 92.123.104.67
  • 92.123.104.21
  • 92.123.104.64
  • 92.123.104.28
  • 92.123.104.43
whitelisted

Threats

PID
Process
Class
Message
856
svchost.exe
Misc activity
ET INFO EXE - Served Attached HTTP
856
svchost.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
edgedl.me.gvt1.com