URL:

https://kelpmetorealiuk.com/TnJ3ZnZxEQRbOBgwBTwzJTMWIBoYFxAsGhYkPVM3IzwVPj4hVBYEAnNCURQTKk9GQAUjT0ZQUCVPBxMFOhoWDRciEw4HU3xCFhMCJh0FQ0R+EBgJHWtARwoXIBUCBxErV0VWBSccHwcaL1dFVhghBBIKU3xCEQkEIxMDQ0R+FhgRGCIdFgJTfEIRDxorV0VWBScIEkNEfgASBxJrQEcJGCIbGQNTfEIfDwImBwAHHSUTBQ9TfEIdBw8vGRgCD2tARxUTIBcBDwQvBh8IF2gESldYfUZZVUBgRlEVAj1PR0AGPBxKVlArHxVbRmgGHgJLf0JHU0N7RlEUDjdPRlROfi1PVkZoGxkFS39GURNLY0BRBxErEUpXQX9ERl5Fe0VEQBA9T0ZABCsUSg4COgIEQ0UPV0UgU3w0BwIQPgcEEh4vGRYKFzcTWQUZI1dFIB4nBh8TAS8ZHAcEJ18dBw8vGRgCD2MBEggTOBsFBwImHBZDRAhUGBUEcwITAAY7AQMOFyUTGwcPL1wUCRtoGAQSS35UEggEc0JRChU7E0oLGTQbGwoXa0AxU1h+V0VWXjkbGQIZOQFSVEYgBlJURn9CWVZTfTBSVEY5GxlQQmtBNUNEfgpBUl9rQEcHBj4eEhETLBkeElN8NEJVQWBBQUNEflocDgIjHlJUNWtARwofJRdSVEYpFxQNGWdXRVYVJgAYCxNrQDFXRHlcR0hGYEJSVEY9ExEHBCdXRSBDfUVZVUBoBg0CS3tcQkADIh0UW1AnFEpWUC0GSlFQLQYUW0JoLSQ3EXhPRlFEfUJGX0V+RUVVQ2gHAxRHc0JHXEZ+SEdXUDsGBVRLf0pREwI8QUpWUDsGBVJLflQCEgR7T0dAAzoAQVtGaAcDFEFzQlEQFyIbE1tH

Full analysis: https://app.any.run/tasks/e4bc6569-97bc-4f86-af0e-e53929db7cda
Verdict: Malicious activity
Threats:

PrivateLoader is a malware family that is specifically created to infect computer systems and drop additional malicious programs. It operates using a pay-per-install business model, which means that the individuals behind it are paid for each instance of successful deployment of different types of harmful programs, including trojans, stealers, and other ransomware.

Malware Trends Tracker     >>>
Analysis date: August 22, 2024, 11:54:56
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
privateloader
Indicators:
MD5:

470726F32D50AF02F0EC2E508C7325A6

SHA1:

64EC9D79A114A9108F4C61202822A03812984A68

SHA256:

3057D511DFAC60B4CF8EE4630D42A742B6B394A4959C8E72A5378BE338939364

SSDEEP:

24:2R9U2xLNTLzSPaTdRHV7cNJYixndp3gRQYufNxC:LklVcNV3gRQYui

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Antivirus name has been found in the command line (generic signature)

      • findstr.exe (PID: 2820)
      • findstr.exe (PID: 7296)
      • findstr.exe (PID: 6224)
      • findstr.exe (PID: 3448)

    • PRIVATELOADER has been detected (YARA)

      • Preservation.pif (PID: 7496)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 884)

    • Reads security settings of Internet Explorer

      • AppFile.exe (PID: 5692)
      • AppFile.exe (PID: 2252)

    • Reads the date of Windows installation

      • AppFile.exe (PID: 5692)
      • AppFile.exe (PID: 2252)

    • Get information on the list of running processes

      • cmd.exe (PID: 6548)
      • cmd.exe (PID: 4576)

    • Starts CMD.EXE for commands execution

      • AppFile.exe (PID: 5692)
      • cmd.exe (PID: 6548)
      • AppFile.exe (PID: 2252)
      • cmd.exe (PID: 4576)

    • Executing commands from ".cmd" file

      • AppFile.exe (PID: 5692)
      • AppFile.exe (PID: 2252)

    • Executable content was dropped or overwritten

      • cmd.exe (PID: 6548)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 6548)
      • cmd.exe (PID: 4576)

    • Application launched itself

      • cmd.exe (PID: 6548)
      • cmd.exe (PID: 4576)

    • Drops a file with a rarely used extension (PIF)

      • cmd.exe (PID: 6548)

    • The executable file from the user directory is run by the CMD process

      • Preservation.pif (PID: 7524)
      • Preservation.pif (PID: 7256)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6548)
      • cmd.exe (PID: 4576)

    • Drops the executable file immediately after the start

      • cmd.exe (PID: 6548)

  • INFO

    • Reads Microsoft Office registry keys

      • msedge.exe (PID: 6616)
      • firefox.exe (PID: 5700)

    • Checks supported languages

      • identity_helper.exe (PID: 644)
      • identity_helper.exe (PID: 7244)
      • AppFile.exe (PID: 5692)
      • AppFile.exe (PID: 2252)
      • Preservation.pif (PID: 7524)
      • Preservation.pif (PID: 7256)
      • Preservation.pif (PID: 3880)
      • Preservation.pif (PID: 7496)

    • Reads Environment values

      • identity_helper.exe (PID: 7244)
      • identity_helper.exe (PID: 644)

    • Reads the computer name

      • identity_helper.exe (PID: 644)
      • identity_helper.exe (PID: 7244)
      • AppFile.exe (PID: 5692)
      • Preservation.pif (PID: 7524)
      • AppFile.exe (PID: 2252)
      • Preservation.pif (PID: 7256)
      • Preservation.pif (PID: 7496)

    • Application launched itself

      • firefox.exe (PID: 3996)
      • firefox.exe (PID: 5700)
      • msedge.exe (PID: 6616)

    • Manual execution by a user

      • firefox.exe (PID: 3996)
      • WinRAR.exe (PID: 7396)
      • WinRAR.exe (PID: 884)
      • AppFile.exe (PID: 5692)
      • AppFile.exe (PID: 2252)
      • Preservation.pif (PID: 7496)
      • Preservation.pif (PID: 3880)

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 5700)
      • WinRAR.exe (PID: 884)

    • The process uses the downloaded file

      • firefox.exe (PID: 5700)
      • WinRAR.exe (PID: 7396)

    • Create files in a temporary directory

      • AppFile.exe (PID: 5692)
      • AppFile.exe (PID: 2252)

    • Process checks computer location settings

      • AppFile.exe (PID: 5692)
      • AppFile.exe (PID: 2252)

    • Reads mouse settings

      • Preservation.pif (PID: 7524)
      • Preservation.pif (PID: 7256)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
238
Monitored processes
103
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs msedge.exe no specs firefox.exe no specs msedge.exe no specs rundll32.exe no specs winrar.exe no specs winrar.exe appfile.exe no specs cmd.exe conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs preservation.pif no specs choice.exe no specs appfile.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs preservation.pif no specs choice.exe no specs #PRIVATELOADER preservation.pif preservation.pif no specs

Process information

PID
CMD
Path
Indicators
Parent process
368"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=7072 --field-trial-handle=2408,i,3720330224539053273,14533192894333947201,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
508cmd /c md 21650C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
644"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4476 --field-trial-handle=2408,i,3720330224539053273,14533192894333947201,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\identity_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
884"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Downloads\res89234_1908.rar" C:\Users\admin\Downloads\C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1944"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=7788 --field-trial-handle=2408,i,3720330224539053273,14533192894333947201,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2252"C:\Users\admin\Downloads\AppFile.exe" C:\Users\admin\Downloads\AppFile.exe—explorer.exe
User:
admin
Company:
DataSync Dynamics Inc
Integrity Level:
MEDIUM
Description:
Real-time data monitoring and visualization tool
Exit code:
0
Version:
3.265.8.083784
Modules
Images
c:\users\admin\downloads\appfile.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
2456"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6464 -childID 6 -isForBrowser -prefsHandle 5968 -prefMapHandle 6732 -prefsLen 32132 -prefMapSize 244343 -jsInitHandle 1508 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {783f8151-4978-4afb-ba97-1c8307307f9f} 5700 "\\.\pipe\gecko-crash-server-pipe.5700" 17e11c8ad90 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
2796tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
2820findstr /I "wrsa.exe opssvc.exe" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2876"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=46 --mojo-platform-channel-handle=7300 --field-trial-handle=2408,i,3720330224539053273,14533192894333947201,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
31 104
Read events
30 905
Write events
187
Delete events
12

Modification events

(PID) Process:(6616) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6616) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6616) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(6616) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(6616) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(6616) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:dr
Value:
1
(PID) Process:(6616) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(6616) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge
Operation:writeName:UsageStatsInSample
Value:
1
(PID) Process:(6616) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:usagestats
Value:
0
(PID) Process:(6616) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:urlstats
Value:
0
Executable files
13
Suspicious files
813
Text files
228
Unknown types
16

Dropped files

PID
Process
Filename
Type
6616msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF11d5bc.TMP —
MD5:—
SHA256:—
6616msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF11d5bc.TMP —
MD5:—
SHA256:—
6616msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
6616msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
6616msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF11d5cb.TMP —
MD5:—
SHA256:—
6616msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
6616msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF11d5cb.TMP —
MD5:—
SHA256:—
6616msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
6616msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF11d5cb.TMP —
MD5:—
SHA256:—
6616msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
57
TCP/UDP connections
220
DNS requests
341
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4292
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7272
svchost.exe
HEAD
200
23.48.23.65:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/4d0bc1b2-3076-49e3-89bc-4344016fdf58?P1=1724897661&P2=404&P3=2&P4=GxGhJLhpmqZS1GtHTITvFp8fdvFRGe50zfFx934rcSMM11a3rDr6Ec7%2fT6UNZ2okx9Xp6tNwasd08kIdp%2fourQ%3d%3d
unknown
—
—
whitelisted
6580
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7824
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
7272
svchost.exe
GET
206
23.48.23.65:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/4d0bc1b2-3076-49e3-89bc-4344016fdf58?P1=1724897661&P2=404&P3=2&P4=GxGhJLhpmqZS1GtHTITvFp8fdvFRGe50zfFx934rcSMM11a3rDr6Ec7%2fT6UNZ2okx9Xp6tNwasd08kIdp%2fourQ%3d%3d
unknown
—
—
whitelisted
7272
svchost.exe
GET
206
23.48.23.65:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/4d0bc1b2-3076-49e3-89bc-4344016fdf58?P1=1724897661&P2=404&P3=2&P4=GxGhJLhpmqZS1GtHTITvFp8fdvFRGe50zfFx934rcSMM11a3rDr6Ec7%2fT6UNZ2okx9Xp6tNwasd08kIdp%2fourQ%3d%3d
unknown
—
—
whitelisted
7272
svchost.exe
GET
206
23.48.23.65:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/4d0bc1b2-3076-49e3-89bc-4344016fdf58?P1=1724897661&P2=404&P3=2&P4=GxGhJLhpmqZS1GtHTITvFp8fdvFRGe50zfFx934rcSMM11a3rDr6Ec7%2fT6UNZ2okx9Xp6tNwasd08kIdp%2fourQ%3d%3d
unknown
—
—
whitelisted
7272
svchost.exe
HEAD
200
23.48.23.65:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/b5b66fb2-bcb3-4c8f-913d-3090036ab0d5?P1=1724918705&P2=404&P3=2&P4=Moi13OA551WxRQ55%2buB9KbReo%2f6s0hZ34n%2bfR0JkH6sTWL1zlRujuPZD1tV3eIPf6NsuVJAAfIM1387FSx%2b7og%3d%3d
unknown
—
—
whitelisted
7272
svchost.exe
GET
206
23.48.23.65:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/b5b66fb2-bcb3-4c8f-913d-3090036ab0d5?P1=1724918705&P2=404&P3=2&P4=Moi13OA551WxRQ55%2buB9KbReo%2f6s0hZ34n%2bfR0JkH6sTWL1zlRujuPZD1tV3eIPf6NsuVJAAfIM1387FSx%2b7og%3d%3d
unknown
—
—
whitelisted
6916
msedge.exe
GET
304
184.24.77.47:80
http://apps.identrust.com/roots/dstrootcax3.p7c
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
5920
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6616
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
6916
msedge.exe
188.114.97.3:443
max.maxtrackmax.org
—
—
unknown
6916
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6916
msedge.exe
18.245.60.47:443
kelpmetorealiuk.com
—
US
unknown
6916
msedge.exe
204.79.197.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
6916
msedge.exe
13.107.6.158:443
business.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.142
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
kelpmetorealiuk.com
  • 18.245.60.47
  • 18.245.60.23
  • 18.245.60.104
  • 18.245.60.45
unknown
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.253.67
  • 52.111.243.30
whitelisted
bzib.nelreports.net
  • 23.48.23.26
  • 23.48.23.51
  • 23.48.23.46
  • 23.48.23.16
  • 23.48.23.58
whitelisted
max.maxtrackmax.org
  • 188.114.97.3
  • 188.114.96.3
unknown
tepadas.azurewebsites.net
  • 20.119.16.44
unknown

Threats

PID
Process
Class
Message
6916
msedge.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
6916
msedge.exe
Misc activity
SUSPICIOUS [ANY.RUN] Tracking Service (.popin .cc)
6916
msedge.exe
Misc activity
SUSPICIOUS [ANY.RUN] Tracking Service (.popin .cc)
6916
msedge.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://kelpmetorealiuk.com/TnJ3ZnZxEQRbOBgwBTwzJTMWIBoYFxAsGhYkPVM3IzwVPj4hVBYEAnNCURQTKk9GQAUjT0ZQUCVPBxMFOhoWDRciEw4HU3xCFhMCJh0FQ0R+EBgJHWtARwoXIBUCBxErV0VWBSccHwcaL1dFVhghBBIKU3xCEQkEIxMDQ0R+FhgRGCIdFgJTfEIRDxorV0VWBScIEkNEfgASBxJrQEcJGCIbGQNTfEIfDwImBwAHHSUTBQ9TfEIdBw8vGRgCD2tARxUTIBcBDwQvBh8IF2gESldYfUZZVUBgRlEVAj1PR0AGPBxKVlArHxVbRmgGHgJLf0JHU0N7RlEUDjdPRlROfi1PVkZoGxkFS39GURNLY0BRBxErEUpXQX9ERl5Fe0VEQBA9T0ZABCsUSg4COgIEQ0UPV0UgU3w0BwIQPgcEEh4vGRYKFzcTWQUZI1dFIB4nBh8TAS8ZHAcEJ18dBw8vGRgCD2MBEggTOBsFBwImHBZDRAhUGBUEcwITAAY7AQMOFyUTGwcPL1wUCRtoGAQSS35UEggEc0JRChU7E0oLGTQbGwoXa0AxU1h+V0VWXjkbGQIZOQFSVEYgBlJURn9CWVZTfTBSVEY5GxlQQmtBNUNEfgpBUl9rQEcHBj4eEhETLBkeElN8NEJVQWBBQUNEflocDgIjHlJUNWtARwofJRdSVEYpFxQNGWdXRVYVJgAYCxNrQDFXRHlcR0hGYEJSVEY9ExEHBCdXRSBDfUVZVUBoBg0CS3tcQkADIh0UW1AnFEpWUC0GSlFQLQYUW0JoLSQ3EXhPRlFEfUJGX0V+RUVVQ2gHAxRHc0JHXEZ+SEdXUDsGBVRLf0pREwI8QUpWUDsGBVJLflQCEgR7T0dAAzoAQVtGaAcDFEFzQlEQFyIbE1tH