URL:

https://oneclient.sfx.ms/Win/Installers/24.126.0623.0001/amd64/OneDriveSetup.exe

Full analysis: https://app.any.run/tasks/099dd787-7070-40fa-b256-c34f2f75dfe8
Verdict: Malicious activity
Analysis date: July 24, 2024, 01:21:28
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MD5:

CB7EEDE7CECEE7B46C945193D7BDD57A

SHA1:

4486C953B73C1DE8D6DF4E39F3835FEA079C6D7D

SHA256:

3696E2EC70AC0AABB7E9F87B5343F071DC5EC792A3A2F4E85741EFC3779C1852

SSDEEP:

3:N8CjCu5g3XrSTkLdTr+SFh4A:2CGCg3XZL5+ST4A

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • OneDriveSetup.exe (PID: 7276)
      • OneDriveSetup.exe (PID: 7124)

    • Drops the executable file immediately after the start

      • OneDriveSetup.exe (PID: 7276)
      • OneDriveSetup.exe (PID: 7124)

    • Scans artifacts that could help determine the target

      • OneDrive.exe (PID: 8156)
      • Microsoft.SharePoint.exe (PID: 2132)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • cookie_exporter.exe (PID: 7688)
      • OneDriveSetup.exe (PID: 1696)
      • OneDriveSetup.exe (PID: 7276)
      • Microsoft.SharePoint.exe (PID: 892)
      • OneDrive.exe (PID: 8156)
      • OneDriveSetup.exe (PID: 7272)
      • OneDriveSetup.exe (PID: 7124)
      • Microsoft.SharePoint.exe (PID: 2132)

    • Application launched itself

      • OneDriveSetup.exe (PID: 1696)
      • OneDriveSetup.exe (PID: 7272)

    • Checks Windows Trust Settings

      • OneDriveSetup.exe (PID: 1696)
      • OneDriveSetup.exe (PID: 7276)
      • Microsoft.SharePoint.exe (PID: 892)
      • OneDrive.exe (PID: 8156)
      • OneDriveSetup.exe (PID: 7272)
      • OneDriveSetup.exe (PID: 7124)
      • Microsoft.SharePoint.exe (PID: 2132)

    • Process drops legitimate windows executable

      • OneDriveSetup.exe (PID: 7276)
      • OneDriveSetup.exe (PID: 7124)

    • Reads the date of Windows installation

      • OneDriveSetup.exe (PID: 7276)
      • OneDriveSetup.exe (PID: 7124)
      • OneDrive.exe (PID: 8156)

    • The process drops C-runtime libraries

      • OneDriveSetup.exe (PID: 7276)
      • OneDriveSetup.exe (PID: 7124)

    • The process creates files with name similar to system file names

      • OneDriveSetup.exe (PID: 7276)
      • OneDriveSetup.exe (PID: 7124)

    • Creates/Modifies COM task schedule object

      • OneDriveSetup.exe (PID: 7276)
      • OneDrive.exe (PID: 8156)
      • OneDrive.exe (PID: 7632)
      • OneDriveSetup.exe (PID: 7124)

    • Changes Internet Explorer settings (feature browser emulation)

      • OneDriveSetup.exe (PID: 7276)
      • OneDrive.exe (PID: 8156)
      • OneDrive.exe (PID: 7632)
      • OneDriveSetup.exe (PID: 7124)

    • Creates a software uninstall entry

      • OneDriveSetup.exe (PID: 7276)
      • OneDriveSetup.exe (PID: 7124)

    • Executable content was dropped or overwritten

      • OneDriveSetup.exe (PID: 7276)
      • OneDriveSetup.exe (PID: 7124)

  • INFO

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 6916)

    • Reads Microsoft Office registry keys

      • msedge.exe (PID: 6916)
      • OneDrive.exe (PID: 3276)
      • Microsoft.SharePoint.exe (PID: 892)
      • OneDrive.exe (PID: 8156)
      • OneDrive.exe (PID: 7632)
      • OneDrive.exe (PID: 504)
      • Microsoft.SharePoint.exe (PID: 2132)

    • Drops the executable file immediately after the start

      • msedge.exe (PID: 6916)

    • Application launched itself

      • msedge.exe (PID: 6916)

    • The process uses the downloaded file

      • msedge.exe (PID: 7808)
      • msedge.exe (PID: 6916)
      • OneDriveSetup.exe (PID: 7276)
      • OneDriveSetup.exe (PID: 7124)
      • msedge.exe (PID: 7428)

    • Reads the computer name

      • cookie_exporter.exe (PID: 7688)
      • TextInputHost.exe (PID: 7624)
      • OneDriveSetup.exe (PID: 1696)
      • identity_helper.exe (PID: 6304)
      • OneDrive.exe (PID: 3276)
      • OneDriveSetup.exe (PID: 7276)
      • Microsoft.SharePoint.exe (PID: 892)
      • OneDrive.exe (PID: 8156)
      • OneDrive.exe (PID: 7632)
      • OneDriveSetup.exe (PID: 7272)
      • OneDriveSetup.exe (PID: 7124)
      • OneDriveSetup.exe (PID: 7164)
      • OneDrive.exe (PID: 504)
      • Microsoft.SharePoint.exe (PID: 2132)

    • Reads Environment values

      • cookie_exporter.exe (PID: 7688)
      • identity_helper.exe (PID: 6304)
      • OneDrive.exe (PID: 3276)
      • Microsoft.SharePoint.exe (PID: 892)
      • OneDrive.exe (PID: 8156)
      • OneDrive.exe (PID: 7632)
      • Microsoft.SharePoint.exe (PID: 2132)
      • OneDrive.exe (PID: 504)

    • Checks supported languages

      • OneDriveSetup.exe (PID: 1696)
      • TextInputHost.exe (PID: 7624)
      • OneDriveSetup.exe (PID: 7276)
      • identity_helper.exe (PID: 6304)
      • cookie_exporter.exe (PID: 7688)
      • Microsoft.SharePoint.exe (PID: 892)
      • OneDrive.exe (PID: 8156)
      • OneDrive.exe (PID: 7632)
      • OneDrive.exe (PID: 3276)
      • FileSyncConfig.exe (PID: 1952)
      • OneDriveSetup.exe (PID: 7272)
      • OneDriveSetup.exe (PID: 7124)
      • OneDriveSetup.exe (PID: 7164)
      • OneDrive.exe (PID: 504)
      • FileSyncConfig.exe (PID: 6476)
      • Microsoft.SharePoint.exe (PID: 2132)

    • Reads the software policy settings

      • slui.exe (PID: 7532)
      • OneDriveSetup.exe (PID: 1696)
      • OneDriveSetup.exe (PID: 7276)
      • Microsoft.SharePoint.exe (PID: 892)
      • OneDrive.exe (PID: 8156)
      • OneDriveSetup.exe (PID: 7272)
      • OneDriveSetup.exe (PID: 7124)
      • Microsoft.SharePoint.exe (PID: 2132)

    • Checks proxy server information

      • slui.exe (PID: 7532)
      • cookie_exporter.exe (PID: 7688)
      • Microsoft.SharePoint.exe (PID: 892)
      • OneDrive.exe (PID: 8156)
      • Microsoft.SharePoint.exe (PID: 2132)

    • Creates files or folders in the user directory

      • OneDriveSetup.exe (PID: 1696)
      • OneDriveSetup.exe (PID: 7276)
      • FileSyncConfig.exe (PID: 1952)
      • OneDrive.exe (PID: 3276)
      • OneDrive.exe (PID: 8156)
      • OneDrive.exe (PID: 7632)
      • OneDriveSetup.exe (PID: 7272)
      • Microsoft.SharePoint.exe (PID: 892)
      • OneDriveSetup.exe (PID: 7124)
      • OneDriveSetup.exe (PID: 7164)
      • FileSyncConfig.exe (PID: 6476)
      • Microsoft.SharePoint.exe (PID: 2132)
      • OneDrive.exe (PID: 504)

    • Reads the machine GUID from the registry

      • OneDriveSetup.exe (PID: 7276)
      • OneDriveSetup.exe (PID: 1696)
      • FileSyncConfig.exe (PID: 1952)
      • OneDrive.exe (PID: 3276)
      • Microsoft.SharePoint.exe (PID: 892)
      • OneDrive.exe (PID: 8156)
      • OneDrive.exe (PID: 7632)
      • OneDriveSetup.exe (PID: 7272)
      • OneDriveSetup.exe (PID: 7124)
      • OneDriveSetup.exe (PID: 7164)
      • OneDrive.exe (PID: 504)
      • FileSyncConfig.exe (PID: 6476)
      • Microsoft.SharePoint.exe (PID: 2132)

    • Process checks computer location settings

      • OneDriveSetup.exe (PID: 7276)
      • OneDrive.exe (PID: 8156)
      • OneDriveSetup.exe (PID: 7124)
      • FileCoAuth.exe (PID: 2368)

    • Create files in a temporary directory

      • OneDriveSetup.exe (PID: 7276)
      • OneDriveSetup.exe (PID: 7124)
      • Microsoft.SharePoint.exe (PID: 892)
      • Microsoft.SharePoint.exe (PID: 2132)

    • Manual execution by a user

      • OneDrive.exe (PID: 8156)
      • OneDrive.exe (PID: 7632)
      • OneDriveSetup.exe (PID: 7272)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
233
Monitored processes
83
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs slui.exe msedge.exe no specs cookie_exporter.exe no specs textinputhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs onedrivesetup.exe no specs onedrivesetup.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs filesyncconfig.exe no specs onedrive.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs microsoft.sharepoint.exe msedge.exe no specs onedrive.exe onedrive.exe msedge.exe no specs msedge.exe no specs rundll32.exe no specs onedrivesetup.exe no specs onedrivesetup.exe msedge.exe no specs onedrivesetup.exe no specs msedge.exe no specs filesyncconfig.exe no specs onedrive.exe no specs microsoft.sharepoint.exe filecoauth.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
396"C:\Program Files\Internet Explorer\iexplore.exe" "https://oneclient.sfx.ms/Win/Installers/24.126.0623.0001/amd64/OneDriveSetup.exe"C:\Program Files\Internet Explorer\iexplore.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
504 /background /versionReinstalledUseForTraceOnlyC:\Users\admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe—OneDriveSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft OneDrive
Exit code:
2147943660
Version:
24.126.0623.0001
Modules
Images
c:\users\admin\appdata\local\microsoft\onedrive\onedrive.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
528"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6224 --field-trial-handle=2392,i,488935807235544229,647118143671935052,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
3221226029
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\identity_helper.exe
c:\windows\system32\ntdll.dll
712"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7192 --field-trial-handle=2392,i,488935807235544229,647118143671935052,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
892/silentConfigC:\Users\admin\AppData\Local\Microsoft\OneDrive\24.126.0623.0001\Microsoft.SharePoint.exe
OneDriveSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft SharePoint
Exit code:
0
Version:
24.126.0623.0001
Modules
Images
c:\users\admin\appdata\local\microsoft\onedrive\24.126.0623.0001\microsoft.sharepoint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1272"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4216 --field-trial-handle=2392,i,488935807235544229,647118143671935052,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1696"C:\Users\admin\Downloads\OneDriveSetup.exe" C:\Users\admin\Downloads\OneDriveSetup.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft OneDrive (64 bit) Setup
Exit code:
0
Version:
24.126.0623.0001
Modules
Images
c:\users\admin\downloads\onedrivesetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\wer.dll
c:\windows\system32\gdi32full.dll
1772"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --mojo-platform-channel-handle=4624 --field-trial-handle=2392,i,488935807235544229,647118143671935052,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1816"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=8052 --field-trial-handle=2392,i,488935807235544229,647118143671935052,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1952"C:\Users\admin\AppData\Local\Microsoft\OneDrive\24.126.0623.0001\FileSyncConfig.exe" C:\Users\admin\AppData\Local\Microsoft\OneDrive\24.126.0623.0001\FileSyncConfig.exe—OneDriveSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft OneDrive Configuration Application
Exit code:
0
Version:
24.126.0623.0001
Modules
Images
c:\users\admin\appdata\local\microsoft\onedrive\24.126.0623.0001\filesyncconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
69 912
Read events
67 859
Write events
832
Delete events
1 221

Modification events

(PID) Process:(396) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\UrlBlock
Operation:writeName:L1WatermarkLowPart
Value:
0
(PID) Process:(396) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\UrlBlock
Operation:writeName:L1WatermarkHighPart
Value:
0
(PID) Process:(396) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\UrlBlock
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
0
(PID) Process:(396) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\UrlBlock
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
0
(PID) Process:(396) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\UrlBlock
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(396) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\UrlBlock
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31120743
(PID) Process:(396) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(396) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(396) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(396) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
Executable files
513
Suspicious files
950
Text files
1 497
Unknown types
12

Dropped files

PID
Process
Filename
Type
6916msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RFe1568.TMP —
MD5:—
SHA256:—
6916msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RFe1568.TMP —
MD5:—
SHA256:—
6916msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
6916msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
6916msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RFe1568.TMP —
MD5:—
SHA256:—
6916msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
6916msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RFe1578.TMP —
MD5:—
SHA256:—
6916msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
6916msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RFe15d5.TMP —
MD5:—
SHA256:—
6916msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
36
TCP/UDP connections
176
DNS requests
179
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4028
msedge.exe
GET
304
184.24.77.69:80
http://apps.identrust.com/roots/dstrootcax3.p7c
unknown
—
—
malicious
7944
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
7908
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4656
svchost.exe
GET
206
2.16.10.182:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/07b2b28d-48a0-4636-b791-6e6129c8a3da?P1=1722299202&P2=404&P3=2&P4=BL2NdbeRNuJTm8925P%2bvUcmrJCFbvofQoZMgdN8onlfHBILOI5DxJiceJ7WmevSIcIjPLj%2fo3NBQRQJSWp1RKw%3d%3d
unknown
—
—
whitelisted
4656
svchost.exe
GET
206
2.16.10.182:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/07b2b28d-48a0-4636-b791-6e6129c8a3da?P1=1722299202&P2=404&P3=2&P4=BL2NdbeRNuJTm8925P%2bvUcmrJCFbvofQoZMgdN8onlfHBILOI5DxJiceJ7WmevSIcIjPLj%2fo3NBQRQJSWp1RKw%3d%3d
unknown
—
—
whitelisted
4028
msedge.exe
GET
304
69.192.161.44:80
http://x1.i.lencr.org/
unknown
—
—
whitelisted
4028
msedge.exe
GET
304
69.192.161.44:80
http://r3.i.lencr.org/
unknown
—
—
whitelisted
4656
svchost.exe
GET
206
2.16.10.182:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/07b2b28d-48a0-4636-b791-6e6129c8a3da?P1=1722299202&P2=404&P3=2&P4=BL2NdbeRNuJTm8925P%2bvUcmrJCFbvofQoZMgdN8onlfHBILOI5DxJiceJ7WmevSIcIjPLj%2fo3NBQRQJSWp1RKw%3d%3d
unknown
—
—
whitelisted
6916
msedge.exe
GET
200
23.53.41.90:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
4656
svchost.exe
GET
206
2.16.10.182:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/07b2b28d-48a0-4636-b791-6e6129c8a3da?P1=1722299202&P2=404&P3=2&P4=BL2NdbeRNuJTm8925P%2bvUcmrJCFbvofQoZMgdN8onlfHBILOI5DxJiceJ7WmevSIcIjPLj%2fo3NBQRQJSWp1RKw%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
6012
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3948
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3060
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
104.126.37.145:443
www.bing.com
Akamai International B.V.
DE
unknown
4204
svchost.exe
4.208.221.206:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3952
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
6916
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
4028
msedge.exe
52.123.240.5:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.184.206
whitelisted
oneclient.sfx.ms
  • 184.30.17.30
unknown
config.edge.skype.com
  • 52.123.240.5
  • 52.123.240.90
  • 52.123.240.109
  • 52.123.240.134
  • 52.123.240.102
  • 52.123.240.66
  • 52.123.240.106
  • 52.123.240.4
whitelisted
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.60
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
bzib.nelreports.net
  • 2.16.10.175
  • 2.16.10.182
whitelisted
edgeservices.bing.com
  • 104.126.37.123
  • 104.126.37.155
  • 104.126.37.153
  • 104.126.37.139
  • 104.126.37.170
  • 104.126.37.154
  • 104.126.37.137
  • 104.126.37.185
  • 104.126.37.162
whitelisted
www.bing.com
  • 104.126.37.123
  • 104.126.37.155
  • 104.126.37.153
  • 104.126.37.139
  • 104.126.37.170
  • 104.126.37.154
  • 104.126.37.137
  • 104.126.37.185
  • 104.126.37.162
  • 104.126.37.186
  • 104.126.37.179
  • 104.126.37.129
  • 104.126.37.177
  • 104.126.37.178
  • 104.126.37.130
  • 104.126.37.152
  • 104.126.37.161
  • 104.126.37.176
  • 104.126.37.160
  • 104.126.37.145
  • 104.126.37.131
  • 104.126.37.171
  • 104.126.37.163
whitelisted

Threats

PID
Process
Class
Message
4028
msedge.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
4028
msedge.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://oneclient.sfx.ms/Win/Installers/24.126.0623.0001/amd64/OneDriveSetup.exe