URL:

https://ai-harmony.io/download

Full analysis: https://app.any.run/tasks/d8a6c218-d071-42df-904f-63e87f201f57
Verdict: Malicious activity
Analysis date: June 23, 2025, 21:17:03
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
arch-doc
nodejs
Indicators:
MD5:

04B76C5FED70B6228AE2E48EEB906E42

SHA1:

8B237F599D793DB0F84F47DAF44674DB14758A2D

SHA256:

3963168C6D90A733BA51A79734FE2402BF958E7017433B98FD1EFA74C3E7CC84

SSDEEP:

3:N8AZLMt:2AZC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Harmony Setup v1.7.exe (PID: 7480)

    • The process creates files with name similar to system file names

      • Harmony Setup v1.7.exe (PID: 7480)

    • Drops 7-zip archiver for unpacking

      • Harmony Setup v1.7.exe (PID: 7480)

    • Executable content was dropped or overwritten

      • Harmony Setup v1.7.exe (PID: 7480)
      • Inst.exe (PID: 1508)

    • Reads security settings of Internet Explorer

      • Harmony Setup v1.7.exe (PID: 7480)
      • Inst.exe (PID: 1508)

    • Process drops legitimate windows executable

      • Harmony Setup v1.7.exe (PID: 7480)
      • Inst.exe (PID: 1508)

    • Creates a software uninstall entry

      • Harmony Setup v1.7.exe (PID: 7480)

    • There is functionality for taking screenshot (YARA)

      • Harmony Setup v1.7.exe (PID: 7480)
      • Inst.exe (PID: 8176)

    • Starts CMD.EXE for commands execution

      • Inst.exe (PID: 1508)
      • Inst.exe (PID: 7340)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 7884)
      • cmd.exe (PID: 7372)
      • cmd.exe (PID: 6376)
      • cmd.exe (PID: 6640)
      • cmd.exe (PID: 3944)
      • cmd.exe (PID: 7516)
      • cmd.exe (PID: 7844)
      • cmd.exe (PID: 8112)

    • Uses WMIC.EXE to obtain a list of video controllers

      • cmd.exe (PID: 8044)
      • cmd.exe (PID: 592)
      • cmd.exe (PID: 4576)
      • cmd.exe (PID: 7280)

    • Application launched itself

      • Inst.exe (PID: 1508)
      • Inst.exe (PID: 7340)

    • Process drops python dynamic module

      • Inst.exe (PID: 1508)

    • The process drops C-runtime libraries

      • Inst.exe (PID: 1508)

    • Accesses video controller name via WMI (SCRIPT)

      • WMIC.exe (PID: 4888)
      • WMIC.exe (PID: 8060)
      • WMIC.exe (PID: 3840)
      • WMIC.exe (PID: 7772)

    • Reads the date of Windows installation

      • Inst.exe (PID: 1508)

  • INFO

    • Application launched itself

      • msedge.exe (PID: 3888)

    • Checks supported languages

      • identity_helper.exe (PID: 7404)
      • Harmony Setup v1.7.exe (PID: 7480)
      • Inst.exe (PID: 1508)
      • Inst.exe (PID: 8176)
      • Inst.exe (PID: 4916)
      • Inst.exe (PID: 1712)
      • Inst.exe (PID: 4512)
      • Inst.exe (PID: 7340)
      • Inst.exe (PID: 7452)
      • Inst.exe (PID: 8136)
      • Inst.exe (PID: 7536)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 3888)

    • Reads the computer name

      • identity_helper.exe (PID: 7404)
      • Harmony Setup v1.7.exe (PID: 7480)
      • Inst.exe (PID: 1508)
      • Inst.exe (PID: 8176)
      • Inst.exe (PID: 4916)
      • Inst.exe (PID: 7452)
      • Inst.exe (PID: 8136)
      • Inst.exe (PID: 7340)

    • Reads Environment values

      • identity_helper.exe (PID: 7404)
      • Inst.exe (PID: 1508)
      • Inst.exe (PID: 7340)

    • The sample compiled with english language support

      • msedge.exe (PID: 3888)
      • Harmony Setup v1.7.exe (PID: 7480)
      • Inst.exe (PID: 1508)

    • Creates files in the program directory

      • Harmony Setup v1.7.exe (PID: 7480)

    • Create files in a temporary directory

      • Harmony Setup v1.7.exe (PID: 7480)
      • Inst.exe (PID: 1508)
      • Inst.exe (PID: 7340)

    • Creates files or folders in the user directory

      • Harmony Setup v1.7.exe (PID: 7480)
      • Inst.exe (PID: 1508)
      • Inst.exe (PID: 4916)
      • Inst.exe (PID: 7340)
      • Inst.exe (PID: 8136)

    • Manual execution by a user

      • Inst.exe (PID: 6828)
      • Inst.exe (PID: 1508)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 4888)
      • WMIC.exe (PID: 8060)
      • WMIC.exe (PID: 7772)
      • WMIC.exe (PID: 3840)

    • Reads product name

      • Inst.exe (PID: 1508)
      • Inst.exe (PID: 7340)

    • Reads CPU info

      • Inst.exe (PID: 1508)
      • Inst.exe (PID: 7340)

    • Process checks computer location settings

      • Inst.exe (PID: 1508)
      • Inst.exe (PID: 1712)
      • Inst.exe (PID: 4512)
      • Inst.exe (PID: 7340)
      • Inst.exe (PID: 7536)

    • Checks proxy server information

      • Inst.exe (PID: 1508)
      • Inst.exe (PID: 7340)
      • slui.exe (PID: 3760)

    • Reads the machine GUID from the registry

      • Inst.exe (PID: 1508)
      • Inst.exe (PID: 7340)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 5008)
      • powershell.exe (PID: 1812)

    • Reads Windows Product ID

      • powershell.exe (PID: 6960)
      • powershell.exe (PID: 6504)

    • Node.js compiler has been detected

      • Inst.exe (PID: 1508)
      • Inst.exe (PID: 8176)
      • Inst.exe (PID: 1712)
      • Inst.exe (PID: 4916)

    • Reads the software policy settings

      • slui.exe (PID: 3760)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
236
Monitored processes
86
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs harmony setup v1.7.exe no specs harmony setup v1.7.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs inst.exe no specs inst.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs wmic.exe no specs inst.exe no specs inst.exe inst.exe no specs inst.exe no specs inst.exe no specs inst.exe no specs inst.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs powershell.exe no specs inst.exe no specs powershell.exe no specs inst.exe no specs inst.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs slui.exe msedge.exe no specs msedge.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs msedge.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
416"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=5780,i,18219527042375089015,9491941757678956708,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
592C:\WINDOWS\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"C:\Windows\System32\cmd.exe—Inst.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
640"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3556,i,18219527042375089015,9491941757678956708,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1200\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1508"C:\Program Files\Inst\Inst.exe" C:\Program Files\Inst\Inst.exe
explorer.exe
User:
admin
Company:
GitHub, Inc.
Integrity Level:
HIGH
Description:
This modern solution was created following the highest standards of cybersecurity.
Version:
3.1.26
Modules
Images
c:\program files\inst\inst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\dbghelp.dll
1512powershell.exe -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1512\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1652"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2416,i,18219527042375089015,9491941757678956708,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1712"C:\Program Files\Inst\Inst.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Roaming\Inst" --app-path="C:\Program Files\Inst\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1888,i,15991079478980652020,2126992604883896652,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:1C:\Program Files\Inst\Inst.exe—Inst.exe
User:
admin
Company:
GitHub, Inc.
Integrity Level:
HIGH
Description:
This modern solution was created following the highest standards of cybersecurity.
Version:
3.1.26
Modules
Images
c:\program files\inst\inst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1812powershell -Command "(Get-CimInstance Win32_OperatingSystem).ConvertToDateTime((Get-CimInstance Win32_OperatingSystem).InstallDate)"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
Total events
46 321
Read events
46 230
Write events
37
Delete events
54

Modification events

(PID) Process:(3888) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3888) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3888) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(3888) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(3888) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3888) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(3888) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
8CAEA804DA962F00
(PID) Process:(3888) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\459518
Operation:writeName:WindowTabManagerFileMappingId
Value:
{72B7B8A8-81D9-4C13-99A2-755DF4800896}
(PID) Process:(3888) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\459518
Operation:writeName:WindowTabManagerFileMappingId
Value:
{B7021187-E83F-4D88-96C5-12022F1D49BC}
(PID) Process:(3888) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\459518
Operation:writeName:WindowTabManagerFileMappingId
Value:
{06FDD338-EB50-48F6-BB2A-73B51821A8EA}
Executable files
52
Suspicious files
325
Text files
199
Unknown types
176

Dropped files

PID
Process
Filename
Type
3888msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old~RF17666a.TMP —
MD5:—
SHA256:—
3888msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old —
MD5:—
SHA256:—
3888msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF17667a.TMP —
MD5:—
SHA256:—
3888msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
3888msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF17667a.TMP —
MD5:—
SHA256:—
3888msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
3888msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF17668a.TMP —
MD5:—
SHA256:—
3888msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old —
MD5:—
SHA256:—
3888msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF176699.TMP —
MD5:—
SHA256:—
3888msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF176699.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
30
TCP/UDP connections
106
DNS requests
90
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
436
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6748
msedge.exe
GET
200
150.171.28.11:80
http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:Zzrn1d0NBXWE773m8c0d5rK0YtMrNQ4v0Ie4uHqrd-Y&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
184.25.50.10:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6492
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6492
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5328
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6656
svchost.exe
HEAD
200
208.89.74.23:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1751124272&P2=404&P3=2&P4=gjS9q4BYMpKqf6a7OCFxsyKMJNk3v1R8qjJTr4nynFDkK1eQ4ph%2bQEdNGfTTsnoYli4cXBisSeJ5N6FriGZDFg%3d%3d
unknown
—
—
whitelisted
6656
svchost.exe
GET
206
208.89.74.23:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1751124272&P2=404&P3=2&P4=gjS9q4BYMpKqf6a7OCFxsyKMJNk3v1R8qjJTr4nynFDkK1eQ4ph%2bQEdNGfTTsnoYli4cXBisSeJ5N6FriGZDFg%3d%3d
unknown
—
—
whitelisted
6656
svchost.exe
GET
206
208.89.74.23:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1751124272&P2=404&P3=2&P4=gjS9q4BYMpKqf6a7OCFxsyKMJNk3v1R8qjJTr4nynFDkK1eQ4ph%2bQEdNGfTTsnoYli4cXBisSeJ5N6FriGZDFg%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2468
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6748
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6748
msedge.exe
150.171.28.11:80
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6748
msedge.exe
95.182.97.78:443
ai-harmony.io
Solucions Valencianes i Noves Tecnologies SL
ES
unknown
6748
msedge.exe
150.171.27.11:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6748
msedge.exe
2.23.227.211:443
copilot.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
google.com
  • 216.58.212.142
whitelisted
edge.microsoft.com
  • 150.171.28.11
  • 150.171.27.11
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
ai-harmony.io
  • 95.182.97.78
unknown
copilot.microsoft.com
  • 2.23.227.211
  • 2.23.227.199
whitelisted
fonts.googleapis.com
  • 172.217.18.106
whitelisted
fonts.gstatic.com
  • 142.250.186.163
whitelisted
www.bing.com
  • 2.16.241.218
  • 2.16.241.201
  • 2.23.227.208
  • 2.23.227.215
  • 92.123.104.67
  • 92.123.104.47
  • 92.123.104.65
  • 92.123.104.59
  • 92.123.104.52
  • 92.123.104.32
  • 92.123.104.34
  • 92.123.104.33
  • 92.123.104.21
whitelisted
cdn.jsdelivr.net
  • 151.101.129.229
  • 151.101.65.229
  • 151.101.1.229
  • 151.101.193.229
whitelisted

Threats

PID
Process
Class
Message
6748
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
6748
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
6748
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
6748
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
4916
Inst.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
4916
Inst.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
4916
Inst.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
4916
Inst.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
4916
Inst.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
4916
Inst.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://ai-harmony.io/download