File name:

MicrosoftEdgeSetup.exe

Full analysis: https://app.any.run/tasks/6ceb1f32-20bf-4c8d-9ddc-e7746a01489e
Verdict: Malicious activity
Analysis date: February 26, 2024, 20:12:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

0DA2E79D6C868ADA1023DAD85697C9B3

SHA1:

58A780EA7880A5F35EB5DEF89DD328E4F76EFF4A

SHA256:

41D2389C9459A42417B1779AA06A836BDBEF6B49B3841C3C42539DD9E44F9FF4

SSDEEP:

49152:NFQFb45fwm2xLfFyfTQZf0Au1ZuzdTBVMQEpVuOvWrbDtuv+jGngFli/GofVZP+V:N84Bwm2xzFYTQZMAosXuQEpVGTjGgDko

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • MicrosoftEdgeSetup.exe (PID: 3240)
      • MicrosoftEdgeUpdateSetup.exe (PID: 3848)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • MicrosoftEdgeSetup.exe (PID: 3240)
      • MicrosoftEdgeUpdateSetup.exe (PID: 3848)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeSetup.exe (PID: 3240)
      • MicrosoftEdgeUpdate.exe (PID: 3864)
      • MicrosoftEdgeUpdateSetup.exe (PID: 3848)
      • MicrosoftEdgeUpdate.exe (PID: 1876)

    • Process drops legitimate windows executable

      • MicrosoftEdgeSetup.exe (PID: 3240)
      • MicrosoftEdgeUpdate.exe (PID: 1876)
      • MicrosoftEdgeUpdateSetup.exe (PID: 3848)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 1876)

    • Disables SEHOP

      • MicrosoftEdgeUpdate.exe (PID: 1876)

    • Creates a software uninstall entry

      • MicrosoftEdgeUpdate.exe (PID: 1876)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdate.exe (PID: 120)

    • Reads the Internet Settings

      • MicrosoftEdgeUpdate.exe (PID: 1836)

    • Executes as Windows Service

      • MicrosoftEdgeUpdate.exe (PID: 3940)

    • Reads settings of System Certificates

      • MicrosoftEdgeUpdate.exe (PID: 1836)

    • Reads security settings of Internet Explorer

      • MicrosoftEdgeUpdate.exe (PID: 1836)

    • Checks Windows Trust Settings

      • MicrosoftEdgeUpdate.exe (PID: 1836)

  • INFO

    • Checks supported languages

      • MicrosoftEdgeSetup.exe (PID: 3240)
      • MicrosoftEdgeUpdate.exe (PID: 3864)
      • MicrosoftEdgeUpdateSetup.exe (PID: 3848)
      • MicrosoftEdgeUpdate.exe (PID: 3304)
      • MicrosoftEdgeUpdate.exe (PID: 120)
      • MicrosoftEdgeUpdate.exe (PID: 1836)
      • MicrosoftEdgeUpdate.exe (PID: 2856)
      • MicrosoftEdgeUpdate.exe (PID: 3940)
      • wmpnscfg.exe (PID: 3072)
      • MicrosoftEdgeUpdate.exe (PID: 1876)

    • Create files in a temporary directory

      • MicrosoftEdgeUpdate.exe (PID: 3864)
      • MicrosoftEdgeSetup.exe (PID: 3240)
      • MicrosoftEdgeUpdate.exe (PID: 1836)

    • Reads the computer name

      • MicrosoftEdgeUpdate.exe (PID: 3864)
      • MicrosoftEdgeUpdate.exe (PID: 3304)
      • MicrosoftEdgeUpdate.exe (PID: 120)
      • MicrosoftEdgeUpdate.exe (PID: 1836)
      • MicrosoftEdgeUpdate.exe (PID: 2856)
      • wmpnscfg.exe (PID: 3072)
      • MicrosoftEdgeUpdate.exe (PID: 3940)
      • MicrosoftEdgeUpdate.exe (PID: 1876)

    • Reads the machine GUID from the registry

      • MicrosoftEdgeUpdate.exe (PID: 3864)

    • Creates files in the program directory

      • MicrosoftEdgeUpdateSetup.exe (PID: 3848)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 1836)

    • Checks proxy server information

      • MicrosoftEdgeUpdate.exe (PID: 1836)

    • Reads the software policy settings

      • MicrosoftEdgeUpdate.exe (PID: 1836)
      • MicrosoftEdgeUpdate.exe (PID: 3940)

    • Creates files or folders in the user directory

      • MicrosoftEdgeUpdate.exe (PID: 1836)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3072)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:01:27 19:04:38+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.31
CodeSize: 108032
InitializedDataSize: 1497088
UninitializedDataSize: -
EntryPoint: 0x7d20
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.3.183.29
ProductVersionNumber: 1.3.183.29
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Microsoft Edge Update Setup
FileVersion: 1.3.183.29
InternalName: Microsoft Edge Update Setup
LegalCopyright: Copyright Microsoft Corporation
OriginalFileName: MicrosoftEdgeUpdateSetup.exe
ProductName: Microsoft Edge Update
ProductVersion: 1.3.183.29
UpstreamVersion: 1.3.99.0
LanguageId: en
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
10
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start microsoftedgesetup.exe microsoftedgeupdate.exe no specs microsoftedgeupdatesetup.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
120"C:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserverC:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.183.29
Modules
Images
c:\program files\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1836"C:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODMuMjkiIHNoZWxsX3ZlcnNpb249IjEuMy4xODMuMjkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RjdCQzM4Q0UtM0RDNC00OTAwLTg1RDQtMkQ4ODc2QzU3RTcxfSIgdXNlcmlkPSJ7NEQ1RjZBQTEtOEYyNS00RDZBLUI1MzAtMjI1NjhFOEM0RkNCfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezIxMTI2MEI3LUI1NTAtNERGQi05RjMwLTI2NTMxNEU4MUYyNH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI0IiBwaHlzbWVtb3J5PSIzIiBkaXNrX3R5cGU9IjAiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjYuMS43NjAxLjI0NTQ2IiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing4NiIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREVMTCIgcHJvZHVjdF9uYW1lPSJERUxMIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTc1LjI5IiBuZXh0dmVyc2lvbj0iMS4zLjE4My4yOSIgbGFuZz0icHQtYnIiIGJyYW5kPSJNMTAwIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTU3MTY2MjEwOTMiIGluc3RhbGxfdGltZV9tcz0iNjg3Ii8-PC9hcHA-PC9yZXF1ZXN0PgC:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.183.29
Modules
Images
c:\program files\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1876"C:\Program Files\Microsoft\Temp\EUF9F0.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&lang=pt-br&brand=M100" /installelevatedC:\Program Files\Microsoft\Temp\EUF9F0.tmp\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdateSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.183.29
Modules
Images
c:\program files\microsoft\temp\euf9f0.tmp\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2856"C:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&lang=pt-br&brand=M100" /installsource taggedmi /sessionid "{F7BC38CE-3DC4-4900-85D4-2D8876C57E71}"C:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.183.29
Modules
Images
c:\program files\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3072"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3240"C:\Users\admin\AppData\Local\Temp\MicrosoftEdgeSetup.exe" C:\Users\admin\AppData\Local\Temp\MicrosoftEdgeSetup.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update Setup
Exit code:
0
Version:
1.3.183.29
Modules
Images
c:\users\admin\appdata\local\temp\microsoftedgesetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
3304"C:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvcC:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.183.29
Modules
Images
c:\program files\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3848"C:\Users\admin\AppData\Local\Temp\EUF637.tmp\MicrosoftEdgeUpdateSetup.exe" /installsource taggedmi /install "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&lang=pt-br&brand=M100" /installelevated /nomitagC:\Users\admin\AppData\Local\Temp\EUF637.tmp\MicrosoftEdgeUpdateSetup.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update Setup
Exit code:
0
Version:
1.3.183.29
Modules
Images
c:\users\admin\appdata\local\temp\euf637.tmp\microsoftedgeupdatesetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
3864C:\Users\admin\AppData\Local\Temp\EUF637.tmp\MicrosoftEdgeUpdate.exe /installsource taggedmi /install "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&lang=pt-br&brand=M100"C:\Users\admin\AppData\Local\Temp\EUF637.tmp\MicrosoftEdgeUpdate.exe—MicrosoftEdgeSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.183.29
Modules
Images
c:\users\admin\appdata\local\temp\euf637.tmp\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3940"C:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svcC:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.183.29
Modules
Images
c:\program files\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
14 675
Read events
12 863
Write events
1 710
Delete events
102

Modification events

(PID) Process:(1876) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate
Operation:delete valueName:eulaaccepted
Value:
(PID) Process:(1876) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
Operation:writeName:PendingFileRenameOperations
Value:
\??\C:\Users\admin\AppData\Local\Temp\MicrosoftEdgeUpdate.exe.old17fd2c
(PID) Process:(1876) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:path
Value:
C:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
(PID) Process:(1876) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:UninstallCmdLine
Value:
"C:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /uninstall
(PID) Process:(1876) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:pv
Value:
1.3.183.29
(PID) Process:(1876) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:name
Value:
Microsoft Edge Update
(PID) Process:(1876) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:pv
Value:
1.3.183.29
(PID) Process:(1876) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe
Operation:writeName:DisableExceptionChainValidation
Value:
0
(PID) Process:(3304) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}
Operation:delete keyName:(default)
Value:
(PID) Process:(3304) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe
Operation:delete keyName:(default)
Value:
Executable files
303
Suspicious files
3
Text files
5
Unknown types
3

Dropped files

PID
Process
Filename
Type
3240MicrosoftEdgeSetup.exeC:\Users\admin\AppData\Local\Temp\EUF637.tmp\MicrosoftEdgeUpdateOnDemand.exeexecutable
MD5:4F2444F5851817D9CC2DBE7E128FCBD8
SHA256:14C8378C2FEAB0FE9C5E856053A0ACD4DD43C49AE697A0F46CB72A5B9592F946
3240MicrosoftEdgeSetup.exeC:\Users\admin\AppData\Local\Temp\EUF637.tmp\MicrosoftEdgeUpdateBroker.exeexecutable
MD5:463EFC8B6744820141CE06C2407B3DE3
SHA256:4B117AAC83171FF6054822E68A0D479A07A5E54092E7784C1F4D868E690601C8
3240MicrosoftEdgeSetup.exeC:\Users\admin\AppData\Local\Temp\EUF637.tmp\MicrosoftEdgeUpdateComRegisterShell64.exeexecutable
MD5:8483203FA78F61D54085573CFAF8E78C
SHA256:DA4FB1A332BF98D57D212AA86563A3F87789FA6CD024E48200A76C1E6A770AE7
3240MicrosoftEdgeSetup.exeC:\Users\admin\AppData\Local\Temp\EUF637.tmp\psmachine_arm64.dllexecutable
MD5:FBF4E4BEFF26197D22EBE3DC838D68E8
SHA256:5B5A66C0D3DE121DCC41477A5A8F6022D635209FB531B1106D98C118F64C5BCD
3240MicrosoftEdgeSetup.exeC:\Users\admin\AppData\Local\Temp\EUF637.tmp\psuser.dllexecutable
MD5:E4288FC82951444A39CF990B79247AFC
SHA256:D6C5BA8A159A9CDEA839C4DC5D3617CB6FB179B9921505FA466FFE7193EE1184
3240MicrosoftEdgeSetup.exeC:\Users\admin\AppData\Local\Temp\EUF637.tmp\psuser_64.dllexecutable
MD5:9ACE0BCF0FB4B890AB8F74EB0E247C3B
SHA256:F9D782790FB64EFE54FA885FC40D530530090CB97F95DF9C1DC2ECDCB787BB12
3240MicrosoftEdgeSetup.exeC:\Users\admin\AppData\Local\Temp\EUF637.tmp\psuser_arm64.dllexecutable
MD5:C35B00A8C62ADB591E49EABA60BB50DF
SHA256:36DE42A7F01FB0D2E37ECF728500D2B44E112C37622FF5B9CEE9F8E2A6A3E976
3240MicrosoftEdgeSetup.exeC:\Users\admin\AppData\Local\Temp\EUF637.tmp\psmachine_64.dllexecutable
MD5:F1CB9FD16C08277F1832FEBE10460B70
SHA256:147D847E4F763C2653A09443574A927DFEF20CCBB10AB9922D0D51E8D7429414
3240MicrosoftEdgeSetup.exeC:\Users\admin\AppData\Local\Temp\EUF637.tmp\msedgeupdate.dllexecutable
MD5:E6A7D817C22618083CBD7ECC46FA16CA
SHA256:94366612B363AC3E175368CC11AA58FCAFADC4D9E324C801F696F8A86BCDDB39
3240MicrosoftEdgeSetup.exeC:\Users\admin\AppData\Local\Temp\EUF637.tmp\psmachine.dllexecutable
MD5:D3F78A2BF33F7050C9565E71CF20740E
SHA256:291AD18A34F2F190D08DBDC11F34BAE398D950D22EDA83D5BB1418E1C7E433CF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
12
DNS requests
7
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
856
svchost.exe
HEAD
200
23.36.163.22:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/d87a3bbd-7fe5-4ec3-b806-293cca78b363?P1=1709583174&P2=404&P3=2&P4=U65ScrrFsBBHdk3QzQl7vSxVw9nXUvBcGdfcQllxGydAKuQ1Qi2BSwItZKHny8pCcNILBJqXAi1CAdwbMCfg7Q%3d%3d
unknown
—
—
unknown
1080
svchost.exe
GET
200
23.48.23.34:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?1b8fee253118cbef
unknown
compressed
65.2 Kb
unknown
856
svchost.exe
GET
—
23.36.163.22:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/d87a3bbd-7fe5-4ec3-b806-293cca78b363?P1=1709583174&P2=404&P3=2&P4=U65ScrrFsBBHdk3QzQl7vSxVw9nXUvBcGdfcQllxGydAKuQ1Qi2BSwItZKHny8pCcNILBJqXAi1CAdwbMCfg7Q%3d%3d
unknown
—
—
unknown
1836
MicrosoftEdgeUpdate.exe
GET
304
184.24.77.194:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a65c765d39622c71
unknown
—
—
unknown
1836
MicrosoftEdgeUpdate.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1836
MicrosoftEdgeUpdate.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3940
MicrosoftEdgeUpdate.exe
23.102.129.60:443
msedge.api.cdp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1836
MicrosoftEdgeUpdate.exe
104.208.16.91:443
self.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1836
MicrosoftEdgeUpdate.exe
184.24.77.194:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
1836
MicrosoftEdgeUpdate.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
856
svchost.exe
23.36.163.22:80
msedge.f.tlu.dl.delivery.mp.microsoft.com
Akamai International B.V.
DE
unknown
3724
svchost.exe
239.255.255.250:1900
—
—
—
unknown

DNS requests

Domain
IP
Reputation
config.edge.skype.com
  • 13.107.42.16
whitelisted
msedge.api.cdp.microsoft.com
  • 23.102.129.60
whitelisted
self.events.data.microsoft.com
  • 104.208.16.91
whitelisted
ctldl.windowsupdate.com
  • 184.24.77.194
  • 184.24.77.206
  • 184.24.77.201
  • 184.24.77.208
  • 184.24.77.173
  • 184.24.77.193
  • 184.24.77.197
  • 184.24.77.203
  • 184.24.77.207
  • 23.48.23.34
  • 23.48.23.18
  • 23.48.23.7
  • 23.48.23.8
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
msedge.f.tlu.dl.delivery.mp.microsoft.com
  • 23.36.163.22
  • 23.36.163.26
whitelisted

Threats

PID
Process
Class
Message
856
svchost.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MicrosoftEdgeSetup.exe