analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

downloadEdge.aspx

Full analysis: https://app.any.run/tasks/35ac4282-aae6-43e9-999e-8621a6f8255b
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: December 06, 2019, 16:11:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

1D065827894AF28CA6D740A8604C99F5

SHA1:

46C8A37890E984226C590AD3857EDFE1FF433858

SHA256:

3F0CF2E08607F9D77BC9C043729E14FAD6D5D4676F2746D848AA9AC6F326E385

SSDEEP:

49152:Z6+ONgzWvqBtqSKgPQNkQmO0RrePFbe+Utczjjcym7IChVOV:Z6RgSvq+SJ8POrCFb7acXjcym7IuV2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • MicrosoftEdgeUpdate.exe (PID: 1248)
      • MicrosoftEdgeUpdate.exe (PID: 3800)
      • MicrosoftEdgeUpdate.exe (PID: 3820)
      • MicrosoftEdgeUpdate.exe (PID: 952)
      • setup.exe (PID: 2844)
      • setup.exe (PID: 408)
      • MicrosoftEdgeUpdate.exe (PID: 2848)
      • MicrosoftEdgeUpdate.exe (PID: 2176)
      • MicrosoftEdgeUpdateOnDemand.exe (PID: 2832)
      • MicrosoftEdgeUpdate.exe (PID: 2540)
      • MicrosoftEdgeUpdate.exe (PID: 3060)
    • Loads dropped or rewritten executable

      • MicrosoftEdgeUpdate.exe (PID: 1248)
      • MicrosoftEdgeUpdate.exe (PID: 3800)
      • MicrosoftEdgeUpdate.exe (PID: 952)
      • MicrosoftEdgeUpdate.exe (PID: 3820)
      • MicrosoftEdgeUpdate.exe (PID: 2848)
      • MicrosoftEdgeUpdate.exe (PID: 2176)
      • MicrosoftEdgeUpdate.exe (PID: 2540)
      • MicrosoftEdgeUpdate.exe (PID: 3060)
      • msedge.exe (PID: 3976)
    • Loads the Task Scheduler COM API

      • MicrosoftEdgeUpdate.exe (PID: 1248)
    • Changes the autorun value in the registry

      • MicrosoftEdgeUpdate.exe (PID: 1248)
  • SUSPICIOUS

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 1248)
    • Creates COM task schedule object

      • MicrosoftEdgeUpdate.exe (PID: 3800)
    • Executed via COM

      • MicrosoftEdgeUpdate.exe (PID: 2848)
      • MicrosoftEdgeUpdateOnDemand.exe (PID: 2832)
      • MicrosoftEdgeUpdate.exe (PID: 3060)
    • Application launched itself

      • setup.exe (PID: 408)
      • MicrosoftEdgeUpdate.exe (PID: 2848)
      • msedge.exe (PID: 3976)
    • Executable content was dropped or overwritten

      • MicrosoftEdge_X86_80.0.354.0.exe (PID: 3084)
      • downloadEdge.aspx.exe (PID: 2772)
      • setup.exe (PID: 408)
      • MicrosoftEdgeUpdate.exe (PID: 1248)
    • Creates a software uninstall entry

      • setup.exe (PID: 408)
    • Modifies the open verb of a shell class

      • setup.exe (PID: 408)
    • Creates files in the user directory

      • setup.exe (PID: 408)
    • Reads Internet Cache Settings

      • msedge.exe (PID: 3976)
  • INFO

    • Reads the hosts file

      • msedge.exe (PID: 2288)
      • msedge.exe (PID: 3976)
    • Dropped object may contain Bitcoin addresses

      • msedge.exe (PID: 3976)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:11:12 03:24:41+01:00
PEType: PE32
LinkerVersion: 14.16
CodeSize: 95744
InitializedDataSize: 1664512
UninitializedDataSize: -
EntryPoint: 0x5751
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.3.117.15
ProductVersionNumber: 1.3.117.15
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Microsoft Edge Update Setup
FileVersion: 1.3.117.15
InternalName: Microsoft Edge Update Setup
LegalCopyright: Copyright Microsoft Corporation
OriginalFileName: MicrosoftEdgeUpdateSetup.exe
ProductName: Microsoft Edge Update
ProductVersion: 1.3.117.15
UpstreamVersion: 1.3.99.0
LanguageId: en

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 12-Nov-2019 02:24:41
Detected languages:
  • Afrikaans - South Africa
  • Albanian - Albania
  • Arabic - Saudi Arabia
  • Armenian - Armenia
  • Azeri - Azerbaijan (Latin)
  • Basque - Spain
  • Belarusian - Belarus
  • Bulgarian - Bulgaria
  • Catalan - Spain
  • Chinese - PRC
  • Chinese - Taiwan
  • Croatian - Croatia
  • Czech - Czech Republic
  • Danish - Denmark
  • Dutch - Netherlands
  • English - United Kingdom
  • English - United States
  • Estonian - Estonia
  • F.Y.R.O. Macedonia - F.Y.R.O. Macedonia
  • Farsi - Iran
  • Finnish - Finland
  • French - Canada
  • French - France
  • Galician - Spain
  • Georgian - Georgia
  • German - Germany
  • Greek - Greece
  • Gujarati - India
  • Hebrew - Israel
  • Hindi - India
  • Hungarian - Hungary
  • Icelandic - Iceland
  • Indonesian - Indonesia (Bahasa)
  • Italian - Italy
  • Japanese - Japan
  • Kannada - India (Kannada script)
  • Kazakh - Kazakstan
  • Konkani - India
  • Korean - Korea
  • Kyrgyz - Kyrgyzstan
  • Latvian - Latvia
  • Lithuanian - Lithuania
  • Malay - Malaysia
  • Marathi - India
  • Mongolian (Cyrillic) - Mongolia
  • Norwegian - Norway (Bokmal)
  • Norwegian - Norway (Nynorsk)
  • Polish - Poland
  • Portuguese - Brazil
  • Portuguese - Portugal
  • Punjabi - India (Gurmukhi script)
  • Romanian - Romania
  • Russian - Russia
  • Serbian - Serbia (Latin)
  • Slovak - Slovakia
  • Slovenian - Slovenia
  • Spanish - Mexico
  • Spanish - Spain (International sort)
  • Swahili - Kenya
  • Swedish - Sweden
  • Tamil - India
  • Tatar - Tatarstan
  • Telugu - India (Telugu script)
  • Thai - Thailand
  • Turkish - Turkey
  • Ukrainian - Ukraine
  • Urdu - Pakistan
  • Uzbek - Uzbekistan (Latin)
  • Vietnamese - Viet Nam
Debug artifacts:
  • mi_exe_stub.pdb
CompanyName: Microsoft Corporation
FileDescription: Microsoft Edge Update Setup
FileVersion: 1.3.117.15
InternalName: Microsoft Edge Update Setup
LegalCopyright: Copyright Microsoft Corporation
OriginalFilename: MicrosoftEdgeUpdateSetup.exe
ProductName: Microsoft Edge Update
ProductVersion: 1.3.117.15
UpstreamVersion: 1.3.99.0
LanguageId: en

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000118

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 12-Nov-2019 02:24:41
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0001744F
0x00017600
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.66831
.rdata
0x00019000
0x00007568
0x00007600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.24882
.data
0x00021000
0x00001400
0x00000A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.24743
.rsrc
0x00023000
0x0018D108
0x0018D200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.9846
.reloc
0x001B1000
0x00001270
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.34218

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.20417
1166
Latin 1 / Western European
UNKNOWN
RT_MANIFEST
2
4.13669
1384
Latin 1 / Western European
English - United States
RT_ICON
3
3.91985
744
Latin 1 / Western European
English - United States
RT_ICON
4
4.83772
2216
Latin 1 / Western European
English - United States
RT_ICON
5
3.68656
1640
Latin 1 / Western European
English - United States
RT_ICON
6
4.50268
3752
Latin 1 / Western European
English - United States
RT_ICON
101
2.86669
90
Latin 1 / Western European
English - United States
RT_GROUP_ICON
102
7.99989
1578310
Latin 1 / Western European
UNKNOWN
B
1223
3.73035
380
Latin 1 / Western European
UNKNOWN
RT_STRING

Imports

ADVAPI32.dll
KERNEL32.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
VERSION.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
87
Monitored processes
48
Malicious processes
11
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start drop and start downloadedge.aspx.exe microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe microsoftedge_x86_80.0.354.0.exe setup.exe setup.exe no specs msedge.exe msedge.exe no specs microsoftedgeupdate.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs microsoftedgeupdateondemand.exe no specs msedge.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdate.exe msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2772"C:\Users\admin\Desktop\downloadEdge.aspx.exe" C:\Users\admin\Desktop\downloadEdge.aspx.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update Setup
Exit code:
0
Version:
1.3.117.15
Modules
Images
c:\users\admin\desktop\downloadedge.aspx.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1248C:\Users\admin\AppData\Local\Temp\EUA7E3.tmp\MicrosoftEdgeUpdate.exe /installsource taggedmi /install "appguid={65C35B14-6C1D-4122-AC46-7148CC9D6497}&appname=Microsoft%20Edge%20Canary&needsadmin=false&usagestats=0&lang=en"C:\Users\admin\AppData\Local\Temp\EUA7E3.tmp\MicrosoftEdgeUpdate.exe
downloadEdge.aspx.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.117.15
Modules
Images
c:\users\admin\appdata\local\temp\eua7e3.tmp\microsoftedgeupdate.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3800"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserverC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.117.15
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
952"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xMTcuMTUiIHNoZWxsX3ZlcnNpb249IjEuMy4xMTcuMTUiIGlzbWFjaGluZT0iMCIgc2Vzc2lvbmlkPSJ7RTJGOEVENjQtRTE5Ny00MDVGLTgyMkEtREI2MzM3MzcyNDRGfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezc3M0IyNDBDLTE1QjctNENDRi1BMEU5LUIyMjZCMjc4MTI3NX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMyIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4xLjc2MDEuMCIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4ODYiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjExNy4xNSIgbGFuZz0iZW4iIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBpbnN0YWxsX3RpbWVfbXM9IjE4NzUiLz48L2FwcD48L3JlcXVlc3Q-C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.117.15
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3820"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={65C35B14-6C1D-4122-AC46-7148CC9D6497}&appname=Microsoft%20Edge%20Canary&needsadmin=false&usagestats=0&lang=en" /installsource taggedmi /sessionid "{E2F8ED64-E197-405F-822A-DB633737244F}"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.117.15
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2848"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" -EmbeddingC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.117.15
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3084"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{BF034AB5-AF27-4A0E-822E-1905A7C98DA2}\MicrosoftEdge_X86_80.0.354.0.exe" --msedge-sxs --verbose-logging --do-not-launch-msedgeC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\Install\{BF034AB5-AF27-4A0E-822E-1905A7C98DA2}\MicrosoftEdge_X86_80.0.354.0.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Installer
Exit code:
0
Version:
80.0.354.0
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\install\{bf034ab5-af27-4a0e-822e-1905a7c98da2}\microsoftedge_x86_80.0.354.0.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
408"C:\Users\admin\AppData\Local\Temp\CR_A7333.tmp\setup.exe" --install-archive="C:\Users\admin\AppData\Local\Temp\CR_A7333.tmp\MSEDGE.PACKED.7Z" --msedge-sxs --verbose-logging --do-not-launch-msedgeC:\Users\admin\AppData\Local\Temp\CR_A7333.tmp\setup.exe
MicrosoftEdge_X86_80.0.354.0.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Installer
Exit code:
0
Version:
80.0.354.0
Modules
Images
c:\users\admin\appdata\local\temp\cr_a7333.tmp\setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
2844C:\Users\admin\AppData\Local\Temp\CR_A7333.tmp\setup.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge SxS\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel=canary --annotation=chromium-version=80.0.3978.0 --annotation=exe=C:\Users\admin\AppData\Local\Temp\CR_A7333.tmp\setup.exe --annotation=plat=Win32 --annotation=prod=Edge --annotation=ver=80.0.354.0 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x4d1930,0x4d1940,0x4d194cC:\Users\admin\AppData\Local\Temp\CR_A7333.tmp\setup.exesetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Installer
Exit code:
0
Version:
80.0.354.0
Modules
Images
c:\users\admin\appdata\local\temp\cr_a7333.tmp\setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
3976"C:\Users\admin\AppData\Local\Microsoft\Edge SxS\Application\msedge.exe"C:\Users\admin\AppData\Local\Microsoft\Edge SxS\Application\msedge.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
80.0.354.0
Modules
Images
c:\users\admin\appdata\local\microsoft\edge sxs\application\msedge.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\microsoft\edge sxs\application\80.0.354.0\msedge_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
6 163
Read events
2 207
Write events
3 934
Delete events
22

Modification events

(PID) Process:(1248) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\ClientState\{65C35B14-6C1D-4122-AC46-7148CC9D6497}
Operation:writeName:consentcommunicated
Value:
0
(PID) Process:(1248) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\ClientState\{65C35B14-6C1D-4122-AC46-7148CC9D6497}
Operation:writeName:usagestats
Value:
0
(PID) Process:(1248) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\ClientState\{65C35B14-6C1D-4122-AC46-7148CC9D6497}
Operation:writeName:urlstats
Value:
0
(PID) Process:(1248) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate
Operation:writeName:path
Value:
C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
(PID) Process:(1248) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate
Operation:writeName:UninstallCmdLine
Value:
"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /uninstall
(PID) Process:(1248) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:pv
Value:
1.3.117.15
(PID) Process:(1248) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:name
Value:
Microsoft Edge Update
(PID) Process:(1248) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:pv
Value:
1.3.117.15
(PID) Process:(1248) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Microsoft Edge Update
Value:
C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.117.15\MicrosoftEdgeUpdateCore.exe
(PID) Process:(1248) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate
Operation:writeName:IsMSIHelperRegistered
Value:
0
Executable files
223
Suspicious files
227
Text files
214
Unknown types
23

Dropped files

PID
Process
Filename
Type
2772downloadEdge.aspx.exeC:\Users\admin\AppData\Local\Temp\EUA7E3.tmp\MicrosoftEdgeUpdateOnDemand.exeexecutable
MD5:5F447A5C5CC3F861F8D680B58A9C18D9
SHA256:6B07496E21331F2CE59C4139F7CD6CAB158C84C176DDDB05C79BC797FCDB4E80
2772downloadEdge.aspx.exeC:\Users\admin\AppData\Local\Temp\EUA7E3.tmp\msedgeupdateres_ar.dllexecutable
MD5:6C0255082CD75DAC9F0FDA4607ED8BA1
SHA256:F62B656E28A70B93581104E20EBF83A4F382D9E2DF9F790CE10D2185CBBA115B
2772downloadEdge.aspx.exeC:\Users\admin\AppData\Local\Temp\EUA7E3.tmp\MicrosoftEdgeUpdate.exe
MD5:52A3903F10AED2D499E18ED25C061579
SHA256:700E67636D3B7D1882D17BE38DF83726FD47535C4A995AFD449F033D1EBB423B
2772downloadEdge.aspx.exeC:\Users\admin\AppData\Local\Temp\EUA7E3.tmp\psmachine_arm64.dllexecutable
MD5:2701F2BBFF8EC278BD3BE39CD6D30CF8
SHA256:3FADC71E31C97107F2A18E09E44F88A9B76D8FFB53CA0E9299701FF899921FFF
2772downloadEdge.aspx.exeC:\Users\admin\AppData\Local\Temp\EUA7E3.tmp\msedgeupdateres_ca.dllexecutable
MD5:F6B76DC99FD70D8A1D91D2B2D68DCFBA
SHA256:F30B878BDE946AD0A57F0DD6370D75A8AB7F1739283636978CC820B2E8FCE968
2772downloadEdge.aspx.exeC:\Users\admin\AppData\Local\Temp\EUA7E3.tmp\msedgeupdateres_am.dllexecutable
MD5:5BF45BC6C487CB8E1D6D2EF0402B5D44
SHA256:40EE0B3BBE411C16F583E5DF6561885BF06BB11AA5B0E11A2017BDDCEAD9FB57
2772downloadEdge.aspx.exeC:\Users\admin\AppData\Local\Temp\EUA7E3.tmp\msedgeupdateres_bn.dllexecutable
MD5:3A417F83AB64F5F8E5E29A16B2CDA4DC
SHA256:1179B602D48D14D0A93F8E222435E88EB3EB36269D9BEA316CA8A31DFA0B6ED1
2772downloadEdge.aspx.exeC:\Users\admin\AppData\Local\Temp\EUA7E3.tmp\MicrosoftEdgeUpdateCore.exeexecutable
MD5:F570E24462DB9E5B0104411906F0CD32
SHA256:07A6DD46FA95EC5DFF148207AAB60CD3BBB0AB26FC4F49359A76C97DB8A0F570
2772downloadEdge.aspx.exeC:\Users\admin\AppData\Local\Temp\EUA7E3.tmp\MicrosoftEdgeComRegisterShellARM64.exeexecutable
MD5:8D815B4CF132E418C0EC68BFECAF5901
SHA256:7B8A29A2E8875DA720FEE828BC3A0D667041B08C713004CC0CA3B5FA0AF27763
2772downloadEdge.aspx.exeC:\Users\admin\AppData\Local\Temp\EUA7E3.tmp\psuser_64.dllexecutable
MD5:F7F85D119911B114A6F15EDB187441DE
SHA256:D4547917DA72BED87A5030F80072E07566FA7A0FC3220CE99656BF3F06A65701
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
61
DNS requests
50
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
HEAD
200
2.16.186.113:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/1a8ee0c7-5752-42ff-a0fb-08985b96973e?P1=1575721809&P2=402&P3=2&P4=Rl8P2TA8HEJ2yzWTt4xAqpTnU1RtGxhxU7K74UkrRxueOHlL%2feWK%2fDUfpVfHvnXOuTz3GdIlF2hwZitYEwwLSQ%3d%3d
unknown
whitelisted
3976
msedge.exe
GET
200
104.18.24.243:80
http://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPC1vZt9qvn7bzY3Iidtbhla4mKQQUWIif1tycSCK3FD7%2FhIjo5oX%2F%2Bn0CE3sACtnwdNPmOm%2BiK5UAAAAK2fA%3D
US
der
1.79 Kb
whitelisted
GET
200
205.185.216.10:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/7ed2eac3-6f6d-416b-a31e-64cca5f1c892?P1=1575735089&P2=402&P3=2&P4=E9zADzQaOKpb0UIeZKJOu6JNzWbd1iFAGfNcSiBX9cs%2fTBBCE4QEXUGKfTI00sPGQ66d21TKGZNNl7SHQmLJ8g%3d%3d
US
executable
68.7 Mb
whitelisted
3976
msedge.exe
GET
200
72.21.91.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D
US
der
1.47 Kb
whitelisted
HEAD
200
205.185.216.10:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/7ed2eac3-6f6d-416b-a31e-64cca5f1c892?P1=1575735089&P2=402&P3=2&P4=E9zADzQaOKpb0UIeZKJOu6JNzWbd1iFAGfNcSiBX9cs%2fTBBCE4QEXUGKfTI00sPGQ66d21TKGZNNl7SHQmLJ8g%3d%3d
US
whitelisted
2288
msedge.exe
GET
302
172.217.18.174:80
http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvMGE4QUFXWXVoTjZIYmd5UGkxTnFncUIzQQ/8019.1202.0.0_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx
US
html
535 b
whitelisted
2288
msedge.exe
GET
200
185.180.12.140:80
http://r1---sn-n02xgoxufvg3-8pxe.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvMGE4QUFXWXVoTjZIYmd5UGkxTnFncUIzQQ/8019.1202.0.0_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx?cms_redirect=yes&mip=185.183.107.227&mm=28&mn=sn-n02xgoxufvg3-8pxe&ms=nvh&mt=1575648737&mv=m&mvi=0&pl=24&shardbypass=yes
AT
crx
1.23 Mb
whitelisted
GET
206
2.16.186.113:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9115fb61-c20a-4d55-81d0-ae52dafeb39e?P1=1575675790&P2=402&P3=2&P4=jJ3AG5pgQaajK4tvyfkhoIy%2ffY7DJsG%2b6J%2fdDbSiNxGKZQ0AUjHMYnSAPS2QfDfdsQw8cfnODcdePmQRRi4Muw%3d%3d
unknown
binary
3.54 Kb
whitelisted
GET
206
2.16.186.113:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/1a8ee0c7-5752-42ff-a0fb-08985b96973e?P1=1575721809&P2=402&P3=2&P4=Rl8P2TA8HEJ2yzWTt4xAqpTnU1RtGxhxU7K74UkrRxueOHlL%2feWK%2fDUfpVfHvnXOuTz3GdIlF2hwZitYEwwLSQ%3d%3d
unknown
binary
6.93 Kb
whitelisted
HEAD
200
2.16.186.113:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9115fb61-c20a-4d55-81d0-ae52dafeb39e?P1=1575675790&P2=402&P3=2&P4=jJ3AG5pgQaajK4tvyfkhoIy%2ffY7DJsG%2b6J%2fdDbSiNxGKZQ0AUjHMYnSAPS2QfDfdsQw8cfnODcdePmQRRi4Muw%3d%3d
unknown
binary
13.0 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
205.185.216.10:80
msedge.f.tlu.dl.delivery.mp.microsoft.com
Highwinds Network Group, Inc.
US
whitelisted
2848
MicrosoftEdgeUpdate.exe
40.67.252.175:443
msedge.api.cdp.microsoft.com
Microsoft Corporation
IE
unknown
3976
msedge.exe
104.18.24.243:80
ocsp.msocsp.com
Cloudflare Inc
US
shared
3976
msedge.exe
72.21.91.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3976
msedge.exe
65.52.226.14:443
nav.smartscreen.microsoft.com
Microsoft Corporation
IE
unknown
2176
MicrosoftEdgeUpdate.exe
52.114.128.9:443
self.events.data.microsoft.com
Microsoft Corporation
US
whitelisted
952
MicrosoftEdgeUpdate.exe
52.114.158.102:443
self.events.data.microsoft.com
Microsoft Corporation
US
unknown
2288
msedge.exe
13.107.3.128:443
config.edge.skype.com
Microsoft Corporation
US
whitelisted
3976
msedge.exe
52.114.128.9:443
self.events.data.microsoft.com
Microsoft Corporation
US
whitelisted
2288
msedge.exe
204.79.197.203:443
ntp.msn.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
self.events.data.microsoft.com
  • 52.114.158.102
  • 52.114.128.9
whitelisted
msedge.api.cdp.microsoft.com
  • 40.67.252.175
whitelisted
msedge.f.tlu.dl.delivery.mp.microsoft.com
  • 205.185.216.10
  • 205.185.216.42
whitelisted
nav.smartscreen.microsoft.com
  • 65.52.226.14
  • 137.135.251.63
whitelisted
ocsp.digicert.com
  • 72.21.91.29
whitelisted
ocsp.msocsp.com
  • 104.18.24.243
  • 104.18.25.243
whitelisted
europe.smartscreen-prod.microsoft.com
  • 137.117.243.30
  • 65.52.226.14
whitelisted
ntp.msn.com
  • 204.79.197.203
whitelisted
config.edge.skype.com
  • 13.107.3.128
whitelisted
clients2.google.com
  • 172.217.22.78
whitelisted

Threats

PID
Process
Class
Message
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
Process
Message
MicrosoftEdgeUpdate.exe
2019-12-06 16:13:38.015 T#3296 <E> [MATSDK] HTTP request WI-2 failed after 183 ms, events were rejected by the server (403) and will be all dropped