URL:

edgedl.me.gvt1.com

Full analysis: https://app.any.run/tasks/b2fa74ad-b23f-43d6-a19f-b9ca46cd4155
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 16, 2024, 19:36:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

0BE689C143B9D610085E1A469D891BE4

SHA1:

8237F030D52B5800F7860C94FBF0B1CE6B0FB34F

SHA256:

2B297C7B1A66C0391C056D2346943D5E648BE48E14F3BD234A1B79E270680F88

SSDEEP:

3:kDUupGT:kD1pK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • GoogleUpdateSetup.exe (PID: 1576)
      • ChromeSetup.exe (PID: 2440)
      • GoogleUpdate.exe (PID: 1768)
      • 109.0.5414.120_chrome_installer.exe (PID: 1592)
      • setup.exe (PID: 3252)

    • Changes the autorun value in the registry

      • setup.exe (PID: 3252)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • ChromeSetup.exe (PID: 2440)
      • GoogleUpdateSetup.exe (PID: 1576)
      • GoogleUpdate.exe (PID: 1768)
      • 109.0.5414.120_chrome_installer.exe (PID: 1592)
      • setup.exe (PID: 3252)

    • Disables SEHOP

      • GoogleUpdate.exe (PID: 1768)

    • Creates/Modifies COM task schedule object

      • GoogleUpdate.exe (PID: 2260)

    • Reads the Internet Settings

      • GoogleUpdate.exe (PID: 2244)
      • GoogleUpdate.exe (PID: 2968)

    • Executes as Windows Service

      • GoogleUpdate.exe (PID: 1848)

    • Reads settings of System Certificates

      • GoogleUpdate.exe (PID: 2244)
      • GoogleUpdate.exe (PID: 2968)

    • Reads security settings of Internet Explorer

      • GoogleUpdate.exe (PID: 2968)

    • Checks Windows Trust Settings

      • GoogleUpdate.exe (PID: 2968)

    • Application launched itself

      • setup.exe (PID: 3252)
      • setup.exe (PID: 3256)
      • GoogleUpdate.exe (PID: 1848)

    • Reads the date of Windows installation

      • setup.exe (PID: 3256)

    • Searches for installed software

      • setup.exe (PID: 3252)

    • Creates a software uninstall entry

      • setup.exe (PID: 3252)

  • INFO

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 3916)
      • iexplore.exe (PID: 2472)

    • Application launched itself

      • iexplore.exe (PID: 2472)
      • chrome.exe (PID: 392)

    • Checks supported languages

      • ChromeSetup.exe (PID: 2440)
      • GoogleUpdate.exe (PID: 3516)
      • GoogleUpdate.exe (PID: 1768)
      • GoogleUpdateSetup.exe (PID: 1576)
      • GoogleUpdate.exe (PID: 1900)
      • GoogleUpdate.exe (PID: 2260)
      • GoogleUpdate.exe (PID: 2244)
      • GoogleUpdate.exe (PID: 2968)
      • GoogleUpdate.exe (PID: 1848)
      • 109.0.5414.120_chrome_installer.exe (PID: 1592)
      • setup.exe (PID: 3172)
      • setup.exe (PID: 3256)
      • setup.exe (PID: 3252)
      • GoogleUpdateOnDemand.exe (PID: 3744)
      • GoogleUpdate.exe (PID: 1316)
      • GoogleUpdate.exe (PID: 2080)
      • setup.exe (PID: 4064)
      • GoogleCrashHandler.exe (PID: 548)
      • elevation_service.exe (PID: 3684)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3916)
      • iexplore.exe (PID: 2472)

    • The process uses the downloaded file

      • iexplore.exe (PID: 2472)
      • ChromeSetup.exe (PID: 2440)
      • chrome.exe (PID: 3824)
      • chrome.exe (PID: 996)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2472)

    • Create files in a temporary directory

      • ChromeSetup.exe (PID: 2440)
      • GoogleUpdate.exe (PID: 2968)

    • Reads the computer name

      • GoogleUpdate.exe (PID: 3516)
      • GoogleUpdate.exe (PID: 1900)
      • GoogleUpdate.exe (PID: 2968)
      • GoogleUpdate.exe (PID: 2260)
      • GoogleUpdate.exe (PID: 2244)
      • GoogleUpdate.exe (PID: 1768)
      • GoogleUpdate.exe (PID: 1848)
      • 109.0.5414.120_chrome_installer.exe (PID: 1592)
      • setup.exe (PID: 3252)
      • setup.exe (PID: 3256)
      • GoogleCrashHandler.exe (PID: 548)
      • GoogleUpdate.exe (PID: 1316)
      • GoogleUpdate.exe (PID: 2080)
      • elevation_service.exe (PID: 3684)

    • Reads the machine GUID from the registry

      • GoogleUpdate.exe (PID: 3516)
      • GoogleUpdate.exe (PID: 1768)
      • GoogleUpdate.exe (PID: 1848)
      • GoogleUpdate.exe (PID: 2244)
      • GoogleUpdate.exe (PID: 2968)
      • setup.exe (PID: 3252)
      • GoogleUpdate.exe (PID: 2080)
      • setup.exe (PID: 3256)
      • elevation_service.exe (PID: 3684)
      • GoogleUpdate.exe (PID: 1316)

    • Creates files in the program directory

      • GoogleUpdateSetup.exe (PID: 1576)
      • GoogleUpdate.exe (PID: 1768)
      • GoogleUpdate.exe (PID: 1900)
      • GoogleUpdate.exe (PID: 2260)
      • GoogleUpdate.exe (PID: 2244)
      • GoogleUpdate.exe (PID: 1848)
      • GoogleUpdate.exe (PID: 2968)
      • setup.exe (PID: 3252)
      • 109.0.5414.120_chrome_installer.exe (PID: 1592)
      • setup.exe (PID: 3256)
      • GoogleUpdate.exe (PID: 1316)
      • GoogleCrashHandler.exe (PID: 548)

    • Checks proxy server information

      • GoogleUpdate.exe (PID: 2968)

    • Reads the software policy settings

      • GoogleUpdate.exe (PID: 2244)
      • GoogleUpdate.exe (PID: 2968)
      • GoogleUpdate.exe (PID: 1848)
      • GoogleUpdate.exe (PID: 1316)

    • Creates files or folders in the user directory

      • GoogleUpdate.exe (PID: 2968)

    • Executes as Windows Service

      • elevation_service.exe (PID: 3684)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
81
Monitored processes
36
Malicious processes
11
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe chromesetup.exe googleupdate.exe no specs googleupdatesetup.exe googleupdate.exe googleupdate.exe no specs googleupdate.exe no specs googleupdate.exe googleupdate.exe googleupdate.exe 109.0.5414.120_chrome_installer.exe setup.exe setup.exe no specs setup.exe no specs setup.exe no specs googlecrashhandler.exe no specs googleupdate.exe googleupdateondemand.exe no specs googleupdate.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs elevation_service.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
392"C:\Program Files\Google\Chrome\Application\chrome.exe" --from-installerC:\Program Files\Google\Chrome\Application\chrome.exe
GoogleUpdate.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
548"C:\Program Files\Google\Update\1.3.36.372\GoogleCrashHandler.exe"C:\Program Files\Google\Update\1.3.36.372\GoogleCrashHandler.exe—GoogleUpdate.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Crash Handler
Exit code:
0
Version:
1.3.36.371
Modules
Images
c:\program files\google\update\1.3.36.372\googlecrashhandler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
908"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x696c8b38,0x696c8b48,0x696c8b54C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
996"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=3792 --field-trial-handle=1180,i,1244763754199929775,12855257402762080963,131072 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1044"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=3940 --field-trial-handle=1180,i,1244763754199929775,12855257402762080963,131072 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1316"C:\Program Files\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNi4zNzIiIHNoZWxsX3ZlcnNpb249IjEuMy4zMy4yMyIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9IntDRTk1RTFFQS1CODE2LTQ5MkYtQkYxNi1CNTdEN0FBRDY3RUF9IiB1c2VyaWQ9IntGQzVBMkFEMy1DREE1LTQ1RDItOTEzNS1FMzcxRjQxNUVBMzh9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgcmVxdWVzdGlkPSJ7MDg0QUEzQkItQkVEMi00ODc4LUI1NjgtN0ZCMkE4RDBGRjkwfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSIzIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjEuNzYwMS4yNDU0NiIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4ODYiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNDLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTA5LjAuNTQxNC4xMjAiIGFwPSJzdGFibGUtYXJjaF94ODYtc3RhdHNkZWZfMSIgbGFuZz0iZW4iIGJyYW5kPSIiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxOTk4IiBpbnN0YWxsZGF0ZT0iNDI1NiIgaWlkPSJ7NERGNTMxQjEtRDQ2OC1BODg3LTZFMEMtNTg4QzE0NjREODA5fSIgY29ob3J0PSIxOjFnOHg6IiBjb2hvcnRuYW1lPSJXaW5kb3dzIDciPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vZWRnZWRsLm1lLmd2dDEuY29tL2VkZ2VkbC9yZWxlYXNlMi9jaHJvbWUvYWNpaHRrY3VleXllM3ltb2oyYWZ2djd1bHp4YV8xMDkuMC41NDE0LjEyMC8xMDkuMC41NDE0LjEyMF9jaHJvbWVfaW5zdGFsbGVyLmV4ZSIgZG93bmxvYWRlZD0iODkyNjgyNjQiIHRvdGFsPSI4OTI2ODI2NCIgZG93bmxvYWRfdGltZV9tcz0iODkxNDEiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5NjYwOSIgc291cmNlX3VybF9pbmRleD0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9Ijc1MCIgZG93bmxvYWRfdGltZV9tcz0iOTA2MDkiIGRvd25sb2FkZWQ9Ijg5MjY4MjY0IiB0b3RhbD0iODkyNjgyNjQiIGluc3RhbGxfdGltZV9tcz0iMTM5MzciLz48L2FwcD48L3JlcXVlc3Q-C:\Program Files\Google\Update\GoogleUpdate.exe
GoogleUpdate.exe
User:
SYSTEM
Company:
Google Inc.
Integrity Level:
SYSTEM
Description:
Google Installer
Exit code:
0
Version:
1.3.33.23
Modules
Images
c:\program files\google\update\googleupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
1572"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=3660 --field-trial-handle=1180,i,1244763754199929775,12855257402762080963,131072 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1576"C:\Users\admin\AppData\Local\Temp\GUM7683.tmp\GoogleUpdateSetup.exe" /installsource taggedmi /install "appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&iid={4DF531B1-D468-A887-6E0C-588C1464D809}&lang=en&browser=2&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&ap=stable-arch_x86-statsdef_1&installdataindex=defaultbrowser" /installelevated /nomitagC:\Users\admin\AppData\Local\Temp\GUM7683.tmp\GoogleUpdateSetup.exe
GoogleUpdate.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Update Setup
Exit code:
0
Version:
1.3.36.372
Modules
Images
c:\users\admin\appdata\local\temp\gum7683.tmp\googleupdatesetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1592"C:\Program Files\Google\Update\Install\{AC059B01-B721-4FB6-82E9-3B343626BAE0}\109.0.5414.120_chrome_installer.exe" --verbose-logging --do-not-launch-chrome --system-level /installerdata="C:\Program Files\Google\Update\Install\{AC059B01-B721-4FB6-82E9-3B343626BAE0}\guiEE31.tmp"C:\Program Files\Google\Update\Install\{AC059B01-B721-4FB6-82E9-3B343626BAE0}\109.0.5414.120_chrome_installer.exe
GoogleUpdate.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome Installer
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\update\install\{ac059b01-b721-4fb6-82e9-3b343626bae0}\109.0.5414.120_chrome_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1692"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2152 --field-trial-handle=1180,i,1244763754199929775,12855257402762080963,131072 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
55 117
Read events
51 394
Write events
3 509
Delete events
214

Modification events

(PID) Process:(2472) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2472) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(2472) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31088911
(PID) Process:(2472) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(2472) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31088911
(PID) Process:(2472) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2472) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2472) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2472) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2472) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
214
Suspicious files
45
Text files
77
Unknown types
36

Dropped files

PID
Process
Filename
Type
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAder
MD5:58AE077B2C647953A4BF11E0985751A9
SHA256:33D1F33B714843583A6E44F1D3F406322BF45700697E1685C6EF0CD2D0B0EBB4
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:DDA0FC44DAB0EC257887205EBE94EE97
SHA256:F99A563BB87B6A35CF806AD4B847E3F39FA53171D0D762E1A0AA748F86D7EDC1
3916iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\chrome-logo-m100[1].svgimage
MD5:C978F2A2D0110B5D47E01BCF6576BCF0
SHA256:1357DD965397A99CBC937DDD2345A9897D527F7229C8B0F2AEEBAC97680CC66D
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_520FA7AD0A5B7A5300910F5BBDCB6D0Cder
MD5:B7EBE3AAF61E0817E30B7B206EF0B225
SHA256:A99D29CC628C0CBF865DE0A27D1B8387AFDBD9CECEE636E3BE961C2293477073
3916iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\chrome-logo-2023[1].pngimage
MD5:0D939991AF502A44B3D128181F13A2FA
SHA256:46C86DEEB625C7616A77777CA7EE7BEA12493B9611923C66405796F3DCCE3185
3916iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\icon-warning[1].svgimage
MD5:5306108600365CA08EAA4CA7463CBBB6
SHA256:9337180E35CAE8A5A0577F8DFF2CF822AAD2406D267A4BDD642CC6C79224F088
3916iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\icon-help[1].jpgimage
MD5:31301C8B938DA756C73D00E0EC95FDB2
SHA256:6EADEC320F64326146500629EAF8BC5D801EA1192FB1DC3EC59D4C789FB55338
3916iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\chrome-logo-new[1].pngimage
MD5:54DCE8D3E263B2D833A69A3330943DE0
SHA256:DA0CBE9FF412CBC770372FF389AE92BFEE1144F5E89F88204D38C87F4FC58636
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:C1431D5EDAE7857643EBD898CBCEDC88
SHA256:81730EDFA438459CB7D83A96CAEA05D20A804734B2461CA6352568992DD84BC3
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_FA6E4B522C9C404D38E1A6F1BB26EC85binary
MD5:57F6E050E3BB8FE548F1F5490916AB46
SHA256:0F3740A55C3175BF0B1C45B9974655ACE5F702DED0281081707BA1B17A15590F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
67
DNS requests
31
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3916
iexplore.exe
GET
302
34.104.35.123:80
http://edgedl.me.gvt1.com/
unknown
—
—
—
3916
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f78d505714a595e3
unknown
—
—
—
3916
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?545e1839169dd0e6
unknown
—
—
—
3916
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
—
3916
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCGGqSzvzmf7hIegNAI9yko
unknown
binary
472 b
—
3916
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
binary
724 b
—
3916
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEAch2W18yjrFCctU7xjW0Yc%3D
unknown
binary
471 b
—
3916
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCAKlf1nuem1AlkNvBwxf5A
unknown
binary
472 b
—
2472
iexplore.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?70b4a85d87201c80
unknown
—
—
—
3916
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCSnN9%2FWcCK6QmbjMlxbrBK
unknown
binary
472 b
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
3916
iexplore.exe
34.104.35.123:80
edgedl.me.gvt1.com
GOOGLE
US
unknown
3916
iexplore.exe
172.217.16.132:443
www.google.com
GOOGLE
US
unknown
3916
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3916
iexplore.exe
142.250.185.131:80
ocsp.pki.goog
GOOGLE
US
unknown
3916
iexplore.exe
216.58.212.138:443
fonts.googleapis.com
GOOGLE
US
unknown
3916
iexplore.exe
142.250.185.131:443
ocsp.pki.goog
GOOGLE
US
unknown
3916
iexplore.exe
142.250.185.227:443
fonts.gstatic.com
GOOGLE
US
unknown

DNS requests

Domain
IP
Reputation
edgedl.me.gvt1.com
  • 34.104.35.123
unknown
www.google.com
  • 172.217.16.132
  • 142.250.186.36
unknown
ctldl.windowsupdate.com
  • 93.184.221.240
unknown
ocsp.pki.goog
  • 142.250.185.131
unknown
fonts.googleapis.com
  • 216.58.212.138
unknown
www.gstatic.com
  • 142.250.185.131
unknown
fonts.gstatic.com
  • 142.250.185.227
unknown
tools.google.com
  • 142.250.186.46
unknown
api.bing.com
  • 13.107.5.80
unknown
www.bing.com
  • 92.123.104.33
  • 92.123.104.40
  • 92.123.104.32
  • 92.123.104.7
  • 92.123.104.67
  • 92.123.104.21
  • 92.123.104.64
  • 92.123.104.28
  • 92.123.104.43
unknown

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO EXE - Served Attached HTTP
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
edgedl.me.gvt1.com