URL:

https://www.microsoft.com/es-es/download/details.aspx?id=105522

Full analysis: https://app.any.run/tasks/3855cfc1-3ac2-48fa-91f4-4ed5d3b83ea6
Verdict: Malicious activity
Analysis date: July 24, 2025, 20:54:05
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-scr
arch-html
qrcode
Indicators:
MD5:

802868F33A6F3AE3B6C2D62666AFA12D

SHA1:

48D100B613FEF049D62F77180CCA18D603B0F05F

SHA256:

2EEA7B944C729993498FBA2DD845746B727655B65532DC970C0EE2F8DBFC41F6

SSDEEP:

3:N8DSLZRtRnBJC2EIM/q9wX:2OLTDBnEI0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • BingWallpaperInstaller.exe (PID: 8032)
      • MicrosoftEdgeUpdate.exe (PID: 4040)
      • DefaultSetup.exe (PID: 6876)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • BingWallpaperInstaller.exe (PID: 8032)
      • BingWallpaper.exe (PID: 4884)
      • 8d246b86-d2a7-4925-9dfe-041192717a31.exe (PID: 2348)
      • MicrosoftEdgeUpdate.exe (PID: 4040)
      • MicrosoftEdge_X64_138.0.3351.95.exe (PID: 9716)
      • setup.exe (PID: 9736)

    • Reads security settings of Internet Explorer

      • BingWallpaperInstaller.exe (PID: 8032)
      • BingWallpaper.exe (PID: 4884)
      • DefaultSetup.exe (PID: 6876)
      • MicrosoftEdgeUpdate.exe (PID: 4040)
      • MicrosoftEdgeUpdate.exe (PID: 7944)

    • Reads the Internet Settings

      • BingWallpaper.exe (PID: 4884)

    • Reads settings of System Certificates

      • BingWallpaper.exe (PID: 4884)

    • Process drops legitimate windows executable

      • BingWallpaper.exe (PID: 4884)
      • 8d246b86-d2a7-4925-9dfe-041192717a31.exe (PID: 2348)
      • MicrosoftEdgeUpdate.exe (PID: 4040)
      • MicrosoftEdge_X64_138.0.3351.95.exe (PID: 9716)
      • setup.exe (PID: 9736)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeUpdate.exe (PID: 4040)
      • 8d246b86-d2a7-4925-9dfe-041192717a31.exe (PID: 2348)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 4040)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6400)
      • MicrosoftEdgeUpdate.exe (PID: 7140)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5712)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6544)

    • Application launched itself

      • setup.exe (PID: 9736)
      • MicrosoftEdgeUpdate.exe (PID: 7944)

    • Creates a software uninstall entry

      • setup.exe (PID: 9736)

    • Searches for installed software

      • setup.exe (PID: 9736)

    • Executes application which crashes

      • BingWallpaper.exe (PID: 4884)

  • INFO

    • Application launched itself

      • chrome.exe (PID: 984)
      • firefox.exe (PID: 7608)
      • firefox.exe (PID: 7412)
      • chrome.exe (PID: 4412)
      • msedge.exe (PID: 9080)
      • msedge.exe (PID: 10224)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 984)

    • Reads the computer name

      • BingWallpaperInstaller.exe (PID: 8032)
      • BingWallpaper.exe (PID: 4884)
      • DefaultSetup.exe (PID: 6876)
      • MicrosoftEdgeUpdate.exe (PID: 4040)
      • MicrosoftEdgeUpdate.exe (PID: 7140)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6400)
      • MicrosoftEdgeUpdate.exe (PID: 7352)
      • MicrosoftEdgeUpdate.exe (PID: 7884)
      • MicrosoftEdgeUpdate.exe (PID: 7944)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5712)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6544)
      • MicrosoftEdge_X64_138.0.3351.95.exe (PID: 9716)
      • setup.exe (PID: 9736)
      • identity_helper.exe (PID: 7556)
      • MicrosoftEdgeUpdate.exe (PID: 7592)
      • BingWallpaper.exe (PID: 3740)

    • Checks supported languages

      • BingWallpaperInstaller.exe (PID: 8032)
      • BingWallpaper.exe (PID: 4884)
      • 8d246b86-d2a7-4925-9dfe-041192717a31.exe (PID: 2348)
      • DefaultSetup.exe (PID: 6876)
      • MicrosoftEdgeUpdate.exe (PID: 7140)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5712)
      • MicrosoftEdgeUpdate.exe (PID: 4040)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6400)
      • MicrosoftEdgeUpdate.exe (PID: 7352)
      • MicrosoftEdgeUpdate.exe (PID: 7884)
      • MicrosoftEdgeUpdate.exe (PID: 7944)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6544)
      • MicrosoftEdge_X64_138.0.3351.95.exe (PID: 9716)
      • setup.exe (PID: 9736)
      • setup.exe (PID: 9756)
      • identity_helper.exe (PID: 7556)
      • MicrosoftEdgeUpdate.exe (PID: 7592)
      • BingWallpaper.exe (PID: 3740)

    • The sample compiled with english language support

      • BingWallpaperInstaller.exe (PID: 8032)
      • BingWallpaper.exe (PID: 4884)
      • 8d246b86-d2a7-4925-9dfe-041192717a31.exe (PID: 2348)
      • MicrosoftEdgeUpdate.exe (PID: 4040)
      • MicrosoftEdge_X64_138.0.3351.95.exe (PID: 9716)
      • setup.exe (PID: 9736)

    • Reads the machine GUID from the registry

      • BingWallpaperInstaller.exe (PID: 8032)
      • MicrosoftEdgeUpdate.exe (PID: 7944)

    • Process checks computer location settings

      • BingWallpaperInstaller.exe (PID: 8032)
      • BingWallpaper.exe (PID: 4884)
      • DefaultSetup.exe (PID: 6876)
      • MicrosoftEdgeUpdate.exe (PID: 4040)
      • setup.exe (PID: 9736)

    • Create files in a temporary directory

      • BingWallpaperInstaller.exe (PID: 8032)
      • BingWallpaper.exe (PID: 4884)
      • 8d246b86-d2a7-4925-9dfe-041192717a31.exe (PID: 2348)

    • Disables trace logs

      • BingWallpaperInstaller.exe (PID: 8032)

    • Reads the software policy settings

      • BingWallpaper.exe (PID: 4884)
      • BingWallpaperInstaller.exe (PID: 8032)
      • DefaultSetup.exe (PID: 6876)
      • MicrosoftEdgeUpdate.exe (PID: 7352)
      • MicrosoftEdgeUpdate.exe (PID: 7944)
      • WerFault.exe (PID: 1612)
      • MicrosoftEdgeUpdate.exe (PID: 7592)
      • slui.exe (PID: 9132)

    • Creates files or folders in the user directory

      • BingWallpaperInstaller.exe (PID: 8032)
      • BingWallpaper.exe (PID: 4884)
      • MicrosoftEdgeUpdate.exe (PID: 4040)
      • MicrosoftEdgeUpdate.exe (PID: 7944)
      • MicrosoftEdge_X64_138.0.3351.95.exe (PID: 9716)
      • setup.exe (PID: 9756)
      • setup.exe (PID: 9736)
      • WerFault.exe (PID: 1612)

    • Checks proxy server information

      • BingWallpaperInstaller.exe (PID: 8032)
      • MicrosoftEdgeUpdate.exe (PID: 7352)
      • MicrosoftEdgeUpdate.exe (PID: 7944)
      • WerFault.exe (PID: 1612)
      • MicrosoftEdgeUpdate.exe (PID: 7592)
      • slui.exe (PID: 9132)

    • Launching a file from a Registry key

      • BingWallpaperInstaller.exe (PID: 8032)
      • MicrosoftEdgeUpdate.exe (PID: 4040)
      • DefaultSetup.exe (PID: 6876)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 7352)
      • identity_helper.exe (PID: 7556)
      • MicrosoftEdgeUpdate.exe (PID: 7592)

    • Reads Microsoft Office registry keys

      • firefox.exe (PID: 7412)

    • Reads security settings of Internet Explorer

      • WerFault.exe (PID: 1612)

    • Manual execution by a user

      • BingWallpaper.exe (PID: 3740)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
242
Monitored processes
90
Malicious processes
6
Suspicious processes
4

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs bingwallpaperinstaller.exe bingwallpaper.exe 8d246b86-d2a7-4925-9dfe-041192717a31.exe defaultsetup.exe firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs microsoftedgeupdate.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs firefox.exe no specs firefox.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs msedge.exe no specs slui.exe msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs microsoftedge_x64_138.0.3351.95.exe setup.exe setup.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs firefox.exe no specs firefox.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs firefox.exe no specs chrome.exe no specs microsoftedgeupdate.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs bingwallpaper.exe no specs werfault.exe UIAutomationCrossBitnessHook32 Class no specs chrome.exe no specs firefox.exe no specs firefox.exe no specs msedge.exe no specs firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
512"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4064 -prefsLen 31139 -prefMapHandle 4068 -prefMapSize 273043 -jsInitHandle 4072 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 4036 -initialChannelId {c5b0895c-7cfe-4bdc-88d5-72d0dd3be59e} -parentPid 7412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
856"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3560,i,2884649006895992059,12660296273568826140,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
984"C:\Program Files\Google\Chrome\Application\chrome.exe" --disk-cache-dir=null --disk-cache-size=1 --media-cache-size=1 --disable-gpu-shader-disk-cache --disable-background-networking --disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction,OptimizationHints "https://www.microsoft.com/es-es/download/details.aspx?id=105522"C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1136"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5520 -prefsLen 39348 -prefMapHandle 5548 -prefMapSize 273043 -jsInitHandle 4980 -jsInitLen 247456 -parentBuildID 20250227124745 -ipcHandle 2324 -initialChannelId {3197eb1d-0331-44b0-9c10-c9fa082c8922} -parentPid 7412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7412" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
1612C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4884 -s 3420C:\Windows\SysWOW64\WerFault.exe
BingWallpaper.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1644"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250227124745 -prefsHandle 1980 -prefsLen 36520 -prefMapHandle 1984 -prefMapSize 273043 -ipcHandle 2060 -initialChannelId {f47f0974-e1e0-47f0-b608-766cce2ddfb4} -parentPid 7412 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7412" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpuC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\crypt32.dll
1976C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{60A90A2F-858D-42AF-8929-82BE9D99E8A1}C:\Windows\SysWOW64\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\combase.dll
2348"C:\Users\admin\AppData\Local\Temp\8d246b86-d2a7-4925-9dfe-041192717a31.exe" /silent /installC:\Users\admin\AppData\Local\Temp\8d246b86-d2a7-4925-9dfe-041192717a31.exe
BingWallpaper.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update Setup
Exit code:
0
Version:
1.3.195.61
Modules
Images
c:\users\admin\appdata\local\temp\8d246b86-d2a7-4925-9dfe-041192717a31.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2464"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3100,i,16343279007676015501,1405838993896362113,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=3148 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2504"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=5164,i,9784493672100749037,12961856502984213151,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
48 948
Read events
47 229
Write events
1 645
Delete events
74

Modification events

(PID) Process:(984) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(984) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(984) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(984) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(984) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(8032) BingWallpaperInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\BingWallpaperInstaller_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(8032) BingWallpaperInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\BingWallpaperInstaller_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(8032) BingWallpaperInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\BingWallpaperInstaller_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(8032) BingWallpaperInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\BingWallpaperInstaller_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(8032) BingWallpaperInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\BingWallpaperInstaller_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
Executable files
207
Suspicious files
597
Text files
176
Unknown types
219

Dropped files

PID
Process
Filename
Type
984chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\ClientCertificates\LOG.old~RF18d56c.TMP —
MD5:—
SHA256:—
984chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\ClientCertificates\LOG.old —
MD5:—
SHA256:—
984chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF18d57b.TMP —
MD5:—
SHA256:—
984chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
984chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old~RF18d57b.TMP —
MD5:—
SHA256:—
984chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old —
MD5:—
SHA256:—
984chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RF18d57b.TMP —
MD5:—
SHA256:—
984chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
984chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB\LOG.old~RF18d57b.TMP —
MD5:—
SHA256:—
984chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
86
TCP/UDP connections
347
DNS requests
408
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5032
chrome.exe
GET
200
216.58.206.78:80
http://clients2.google.com/time/1/current?cup2key=8:x5hIrZqRmNvh_jHK8YITUuCKmy1KhDVi-4qb849FXW4&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
984
chrome.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.216.77.41:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
8040
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
984
chrome.exe
GET
200
23.216.77.41:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1864
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8032
BingWallpaperInstaller.exe
GET
200
130.213.251.75:80
http://g.ceipmsn.com/8SE/44?MI=8a745b9c357341789357d866885d16bc&LV=1.1.416.0&OS=6.2.9200.0&TE=40&TV=isW011%7Cpkbwi%7Ctmen-us%7Cci9612c3b8-7b3f-471e-981d-4ab9f4ee4b80%7Cts1753390478648%7Crt2%7CevInstallationStarted%7Cpt9
unknown
—
—
unknown
8032
BingWallpaperInstaller.exe
GET
200
130.213.251.75:80
http://g.ceipmsn.com/8SE/44?MI=8a745b9c357341789357d866885d16bc&LV=1.1.416.0&OS=6.2.9200.0&TE=40&TV=isW011%7Cpkbwi%7Ctmen-us%7Cci9612c3b8-7b3f-471e-981d-4ab9f4ee4b80%7Cts1753390478003%7Crt1%7CevInstallerLaunched%7Cpt9
unknown
—
—
unknown
8032
BingWallpaperInstaller.exe
GET
200
130.213.251.75:80
http://g.ceipmsn.com/8SE/44?MI=8a745b9c357341789357d866885d16bc&LV=1.1.416.0&OS=6.2.9200.0&TE=40&TV=pcW011%7Cpkbwi%7Ctmen-us%7Crt1%7Cat1%7Cvr1.1.416.0%7Cpt2
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3836
RUXIMICS.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1268
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
5032
chrome.exe
216.58.206.42:443
safebrowsingohttpgateway.googleapis.com
GOOGLE
US
whitelisted
5032
chrome.exe
216.58.206.78:80
clients2.google.com
GOOGLE
US
whitelisted
5032
chrome.exe
142.250.102.84:443
accounts.google.com
GOOGLE
US
whitelisted
5032
chrome.exe
23.52.120.96:443
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5032
chrome.exe
151.101.65.91:443
rum.hlx.page
FASTLY
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
safebrowsingohttpgateway.googleapis.com
  • 216.58.206.42
  • 142.250.186.106
  • 142.250.186.138
  • 142.250.185.202
  • 172.217.18.10
  • 142.250.184.202
  • 142.250.186.42
  • 142.250.184.234
  • 216.58.206.74
  • 142.250.185.170
  • 142.250.186.74
  • 142.250.185.234
  • 142.250.185.74
  • 172.217.23.106
  • 142.250.186.170
  • 142.250.185.106
whitelisted
clients2.google.com
  • 216.58.206.78
whitelisted
www.microsoft.com
  • 23.52.120.96
  • 95.101.149.131
  • 23.35.229.160
whitelisted
accounts.google.com
  • 142.250.102.84
whitelisted
cdn-dynmedia-1.microsoft.com
  • 23.36.162.222
  • 23.36.162.220
whitelisted
web.vortex.data.microsoft.com
  • —
whitelisted
img-prod-cms-rt-microsoft-com.akamaized.net
  • 184.24.77.23
  • 184.24.77.17
whitelisted
rum.hlx.page
  • 151.101.65.91
  • 151.101.129.91
  • 151.101.193.91
  • 151.101.1.91
unknown
c.s-microsoft.com
  • 23.213.165.249
whitelisted

Threats

PID
Process
Class
Message
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
8304
svchost.exe
Misc activity
ET INFO Packed Executable Download
—
—
Misc activity
ET INFO Packed Executable Download
—
—
Potentially Bad Traffic
ET INFO Possible Firefox Plugin install
—
—
Potentially Bad Traffic
ET INFO Possible Chrome Plugin install
—
—
Potentially Bad Traffic
ET INFO Possible Firefox Plugin install
—
—
Potentially Bad Traffic
ET INFO Possible Firefox Plugin install
—
—
Potentially Bad Traffic
ET INFO Possible Firefox Plugin install
Process
Message
BingWallpaper.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
BingWallpaper.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
DefaultSetup.exe
HttpGetRequest
DefaultSetup.exe
/8SE/44?MI=8a745b9c357341789357d866885d16bc&LV=2.0.3.1&OS=10.0.19045.1&TE=23&TV=isW011%7CpkBrowserDefMgr%7Crt1%7Ctmen-us%7ChdMF136.0.0.0,1%7CsdMF136.0.0.0,1%7CseMF136.0.0.0,1%7ChpMF136.0.0.0,1%7Ccd2025-07-24%7Cct20:54:51:351
DefaultSetup.exe
HttpGetRequest Success. Received query response status code 200.
DefaultSetup.exe
HttpPostRequest
DefaultSetup.exe
{"name":"Microsoft.ApplicationInsights.Event","time":"2025-07-24T20:54:51Z","iKey":"9116d88d-13b2-4182-8498-4530aac1b83f","tags":{"ai.user.id":"","ai.session.id":"","ai.device.os":"PC","ai.device.osVersion":"10.0.19045.1","ai.cloud.roleInstance":"DefaultSetup","ai.internal.sdkVersion":"Rest API"},"data":{"baseType":"EventData","baseData":{"name":"MFComplete","properties":{"MachineId":"8a745b9c357341789357d866885d16bc","Package":"BrowserDefMgr","PartnerCode":"W011","Market":"en-us","BrowserVersion":"MF136.0.0.0","SetDHP_Action":"true","SetDHP_Result":"true","SetDSP_Action":"true","SetDSP_Result":"true","ExtensionBlocked":"false","PingData":"&TE=23&TV=isW011|pkBrowserDefMgr|rt1|tmen-us|hdMF136.0.0.0,1|sdMF136.0.0.0,1|seMF136.0.0.0,1|hpMF136.0.0.0,1|cd2025-07-24|ct20:54:51:351"}}}}
DefaultSetup.exe
HttpPostRequest Success. Received query response status code 200.
DefaultSetup.exe
Received 1 response(s)
DefaultSetup.exe
Status = 0
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.microsoft.com/es-es/download/details.aspx?id=105522