URL:

programy.net.pl

Full analysis: https://app.any.run/tasks/3bb9f4ed-a6e0-4e26-8ff9-6caa80685104
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 19, 2024, 15:31:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

9A63F82A8E6D30AE44F789879FC38E46

SHA1:

C20C79D448D5C1E2EAE1C0817D67598DBEB6A06D

SHA256:

3718E997B1074039C2A538609129A0EF566460A481322E776C6F3F4F54F5BF2D

SSDEEP:

3:oKcLSJ:oKcLSJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Steals credentials from Web Browsers

      • ccsetup622.exe (PID: 3684)
      • taskhost.exe (PID: 2900)
      • CCleaner.exe (PID: 3372)
      • CCleaner.exe (PID: 4092)

    • Actions looks like stealing of personal data

      • ccsetup622.exe (PID: 3684)
      • CCleaner.exe (PID: 3372)
      • CCleaner.exe (PID: 4092)

    • Drops the executable file immediately after the start

      • ccsetup622.exe (PID: 3684)
      • CCUpdate.exe (PID: 2164)
      • CCleaner.exe (PID: 4092)
      • CCleaner.exe (PID: 1384)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • ccsetup622.exe (PID: 3684)

    • Executable content was dropped or overwritten

      • ccsetup622.exe (PID: 3684)
      • CCUpdate.exe (PID: 2164)
      • CCleaner.exe (PID: 4092)
      • CCleaner.exe (PID: 1384)

    • Searches for installed software

      • ccsetup622.exe (PID: 3684)
      • CCleaner.exe (PID: 3372)
      • CCleaner.exe (PID: 4092)

    • The process creates files with name similar to system file names

      • ccsetup622.exe (PID: 3684)

    • Reads settings of System Certificates

      • ccsetup622.exe (PID: 3684)
      • CCUpdate.exe (PID: 2164)
      • CCleaner.exe (PID: 3372)
      • CCUpdate.exe (PID: 3152)
      • CCleaner.exe (PID: 4092)

    • Reads Internet Explorer settings

      • ccsetup622.exe (PID: 3684)
      • CCleaner.exe (PID: 4092)

    • Reads the date of Windows installation

      • ccsetup622.exe (PID: 3684)
      • CCleaner.exe (PID: 4092)

    • Non-standard symbols in registry

      • ccsetup622.exe (PID: 3684)

    • Executes as Windows Service

      • taskhost.exe (PID: 2900)
      • CCleanerPerformanceOptimizerService.exe (PID: 3964)
      • taskhost.exe (PID: 1504)
      • taskhost.exe (PID: 2564)
      • taskhost.exe (PID: 1748)
      • taskhost.exe (PID: 2804)
      • taskhost.exe (PID: 3712)
      • taskhost.exe (PID: 3900)

    • Reads the Internet Settings

      • taskhost.exe (PID: 2900)
      • ccsetup622.exe (PID: 3684)
      • CCleaner.exe (PID: 4092)

    • Reads security settings of Internet Explorer

      • ccsetup622.exe (PID: 3684)
      • CCleaner.exe (PID: 4092)
      • wa_3rd_party_host_32.exe (PID: 3712)

    • Reads Microsoft Outlook installation path

      • ccsetup622.exe (PID: 3684)
      • CCleaner.exe (PID: 4092)

    • Checks Windows Trust Settings

      • ccsetup622.exe (PID: 3684)
      • wa_3rd_party_host_32.exe (PID: 3712)
      • CCleaner.exe (PID: 4092)

    • Reads browser cookies

      • ccsetup622.exe (PID: 3684)

    • Creates a software uninstall entry

      • ccsetup622.exe (PID: 3684)

    • Application launched itself

      • CCUpdate.exe (PID: 2164)

    • Checks for Java to be installed

      • CCleaner.exe (PID: 4092)

    • Process requests binary or script from the Internet

      • CCUpdate.exe (PID: 2164)

    • The process verifies whether the antivirus software is installed

      • CCleaner.exe (PID: 4092)

    • Starts CMD.EXE for commands execution

      • CCleaner.exe (PID: 4092)

    • The process executes via Task Scheduler

      • CCleaner.exe (PID: 1384)

  • INFO

    • Drops the executable file immediately after the start

      • msedge.exe (PID: 3416)

    • Application launched itself

      • msedge.exe (PID: 3416)

    • Checks supported languages

      • wmpnscfg.exe (PID: 3932)
      • ccsetup622.exe (PID: 3684)
      • CCleaner.exe (PID: 3372)
      • CCUpdate.exe (PID: 2164)
      • CCUpdate.exe (PID: 3152)
      • CCleaner.exe (PID: 4092)
      • wa_3rd_party_host_32.exe (PID: 3712)
      • pwsh.exe (PID: 2440)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3932)
      • CCleaner.exe (PID: 2204)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 3416)

    • The process uses the downloaded file

      • msedge.exe (PID: 3416)
      • msedge.exe (PID: 2460)

    • Reads the computer name

      • ccsetup622.exe (PID: 3684)
      • wmpnscfg.exe (PID: 3932)
      • CCleaner.exe (PID: 3372)
      • CCUpdate.exe (PID: 2164)
      • CCUpdate.exe (PID: 3152)
      • CCleaner.exe (PID: 4092)
      • wa_3rd_party_host_32.exe (PID: 3712)

    • Create files in a temporary directory

      • ccsetup622.exe (PID: 3684)
      • wa_3rd_party_host_32.exe (PID: 3712)
      • CCleaner.exe (PID: 4092)

    • Reads Environment values

      • ccsetup622.exe (PID: 3684)
      • CCleaner.exe (PID: 3372)
      • CCleaner.exe (PID: 4092)

    • Reads the machine GUID from the registry

      • ccsetup622.exe (PID: 3684)
      • CCUpdate.exe (PID: 2164)
      • CCleaner.exe (PID: 3372)
      • CCUpdate.exe (PID: 3152)
      • CCleaner.exe (PID: 4092)
      • wa_3rd_party_host_32.exe (PID: 3712)

    • Reads the software policy settings

      • ccsetup622.exe (PID: 3684)
      • CCUpdate.exe (PID: 2164)
      • CCleaner.exe (PID: 3372)
      • CCUpdate.exe (PID: 3152)
      • CCleaner.exe (PID: 4092)

    • Reads product name

      • ccsetup622.exe (PID: 3684)
      • CCleaner.exe (PID: 4092)

    • Reads CPU info

      • ccsetup622.exe (PID: 3684)
      • CCleaner.exe (PID: 3372)
      • CCleaner.exe (PID: 4092)

    • Creates files or folders in the user directory

      • ccsetup622.exe (PID: 3684)
      • taskhost.exe (PID: 2900)
      • CCleaner.exe (PID: 4092)

    • Checks proxy server information

      • ccsetup622.exe (PID: 3684)
      • CCleaner.exe (PID: 4092)

    • Creates files in the program directory

      • ccsetup622.exe (PID: 3684)
      • CCleaner.exe (PID: 3372)
      • CCUpdate.exe (PID: 2164)
      • CCleaner.exe (PID: 4092)

    • Reads Microsoft Office registry keys

      • CCleaner.exe (PID: 4092)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
112
Monitored processes
58
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs wmpnscfg.exe no specs msedge.exe no specs ccsetup622.exe no specs ccsetup622.exe taskhost.exe ccleaner.exe ccupdate.exe ccupdate.exe ccleaner.exe unsecapp.exe no specs wa_3rd_party_host_32.exe no specs cmd.exe no specs pwsh.exe cmd.exe no specs pwsh.exe cmd.exe no specs pwsh.exe ccleanerperformanceoptimizerservice.exe taskhost.exe ccleaner.exe no specs ccleaner.exe taskhost.exe taskhost.exe taskhost.exe taskhost.exe taskhost.exe

Process information

PID
CMD
Path
Indicators
Parent process
532"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --first-renderer-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2292 --field-trial-handle=1296,i,113448334757838697,10950086191428604020,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
884"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1628 --field-trial-handle=1296,i,113448334757838697,10950086191428604020,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
956"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3796 --field-trial-handle=1296,i,113448334757838697,10950086191428604020,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
980"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1440 --field-trial-handle=1296,i,113448334757838697,10950086191428604020,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1072"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd8,0x6bcdf598,0x6bcdf5a8,0x6bcdf5b4C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1352"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3280 --field-trial-handle=1296,i,113448334757838697,10950086191428604020,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1384"C:\Program Files\CCleaner\CCleaner.exe" /uacC:\Program Files\CCleaner\CCleaner.exe
taskeng.exe
User:
admin
Company:
Piriform Software Ltd
Integrity Level:
HIGH
Description:
CCleaner
Version:
6.22.0.10977
Modules
Images
c:\program files\ccleaner\ccleaner.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\nsi.dll
c:\windows\system32\advapi32.dll
1432"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4328 --field-trial-handle=1296,i,113448334757838697,10950086191428604020,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1504"taskhost.exe"C:\Windows\System32\taskhost.exe
services.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1560"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2384 --field-trial-handle=1296,i,113448334757838697,10950086191428604020,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
267 627
Read events
266 641
Write events
636
Delete events
350

Modification events

(PID) Process:(3416) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3416) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3416) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(3416) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(3416) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3416) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:dr
Value:
1
(PID) Process:(3416) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(3416) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1302019708-1500728564-335382590-1000
Value:
391B7E0F0B752F00
(PID) Process:(3416) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\FirstNotDefault
Operation:delete valueName:S-1-5-21-1302019708-1500728564-335382590-1000
Value:
(PID) Process:(3416) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge
Operation:writeName:UsageStatsInSample
Value:
1
Executable files
152
Suspicious files
198
Text files
143
Unknown types
70

Dropped files

PID
Process
Filename
Type
3416msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Local State —
MD5:—
SHA256:—
3416msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF1bd703.TMP —
MD5:—
SHA256:—
3416msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
3416msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF1bd713.TMP —
MD5:—
SHA256:—
3416msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
3416msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF1bd751.TMP —
MD5:—
SHA256:—
3416msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old —
MD5:—
SHA256:—
3416msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat —
MD5:A6EBC0D32A7B9304824D19DB63B4E37A
SHA256:E991057C2B1718A151C5FD06E1C153F57130D195454A1F94C8C4C20971697093
3416msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old~RF1bd6e4.TMP —
MD5:72265FBF816F9AAE473C0CEB421DE724
SHA256:C549BD4A176A3744A5D91391D311E28F0503BB69213E38835A1CB213038D938C
3416msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old —
MD5:2B5B565981E1565368EC9935843BD794
SHA256:E98D615C43993262B2C3058F9E445BA09A496ED4CEE663371CABD0600CBBF122
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
155
DNS requests
113
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3684
ccsetup622.exe
GET
304
217.20.57.43:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f2e925f2f2f4b55d
unknown
—
—
unknown
3684
ccsetup622.exe
GET
304
217.20.57.43:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2a63b0c01a34bf70
unknown
—
—
unknown
3684
ccsetup622.exe
GET
200
172.217.18.99:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIAjrICMzZli2TN25s%3D
unknown
—
—
unknown
3684
ccsetup622.exe
GET
200
172.217.18.99:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
—
—
unknown
2448
msedge.exe
GET
301
54.38.49.240:80
http://programy.net.pl/
unknown
—
—
unknown
3684
ccsetup622.exe
GET
200
172.217.18.99:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
—
—
unknown
3684
ccsetup622.exe
GET
200
172.217.18.99:80
http://ocsp.pki.goog/s/gts1d4/cNag_9NZQXw/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSMBFDqU0NJQdZdEGU3bkhj0FoRrQQUJeIYDrJXkZQq5dRdhpCD3lOzuJICEQCDWDmf4XmFvBJNZm86rLoj
unknown
—
—
unknown
3684
ccsetup622.exe
GET
200
172.217.18.99:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCcSoXi8aTt3gof4ejif2LL
unknown
—
—
unknown
3684
ccsetup622.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
—
—
unknown
2164
CCUpdate.exe
HEAD
200
23.54.81.195:80
http://emupdate.avcdn.net/files/emupdate/pong.txt
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
2448
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3416
msedge.exe
239.255.255.250:1900
—
—
—
unknown
2448
msedge.exe
13.107.21.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
2448
msedge.exe
54.38.49.240:80
programy.net.pl
OVH SAS
FR
unknown
2448
msedge.exe
54.38.49.240:443
programy.net.pl
OVH SAS
FR
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2448
msedge.exe
142.250.186.42:443
fonts.googleapis.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
programy.net.pl
  • 54.38.49.240
unknown
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
fonts.googleapis.com
  • 142.250.186.42
whitelisted
fonts.gstatic.com
  • 142.250.185.67
whitelisted
cdn.cookiehub.eu
  • 169.150.247.38
unknown
www.googletagmanager.com
  • 142.250.184.232
whitelisted
pagead2.googlesyndication.com
  • 172.217.18.2
whitelisted
www.google-analytics.com
  • 172.217.18.14
whitelisted
www.bing.com
  • 23.219.78.136
  • 23.219.78.144
  • 23.219.78.148
  • 23.219.78.135
  • 23.219.78.147
  • 23.219.78.146
whitelisted

Threats

PID
Process
Class
Message
1080
svchost.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
1080
svchost.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
1080
svchost.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
2164
CCUpdate.exe
Misc activity
ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI
2164
CCUpdate.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1080
svchost.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
1080
svchost.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
3152
CCUpdate.exe
Misc activity
ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI
1080
svchost.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
4092
CCleaner.exe
Misc activity
ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI
4 ETPRO signatures available at the full report
Process
Message
CCleaner.exe
Failed to open log file 'C:\Program Files\CCleaner'
CCleaner.exe
Failed to open log file 'C:\Program Files\CCleaner'
CCleaner.exe
OnLanguage - en
CCleaner.exe
[2024-04-19 15:33:21.311] [error ] [Burger ] [ 4092: 480] [14D981: 253] [23.4.4775.0] [BurgerReporter.cpp] [253] asw::standalone_svc::BurgerReporter::BurgerSwitch: Could not read property BURGER_SETTINGS_PANCAKE_HOSTNAME (0x00000003)
CCleaner.exe
[2024-04-19 15:33:21.311] [error ] [Burger ] [ 4092: 480] [14D981: 253] [23.4.4775.0] [BurgerReporter.cpp] [253] asw::standalone_svc::BurgerReporter::BurgerSwitch: Could not read property BURGER_SETTINGS_PANCAKE_HOSTNAME (0x00000003)
CCleaner.exe
OnLanguage - en
CCleaner.exe
OnLanguage - en
CCleaner.exe
OnLanguage - en
CCleaner.exe
at @4@22.loadTranslation
CCleaner.exe
at undefined
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
programy.net.pl