File name:

loader.exe

Full analysis: https://app.any.run/tasks/c0e5c135-c43c-41cd-8d47-a38c63a22bd7
Verdict: Malicious activity
Analysis date: March 28, 2026, 18:53:48
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
anti-evasion
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 10 sections
MD5:

DE6AA626FDBC5FF2B6C06A8E03809E65

SHA1:

854DA15E5F971F738668A557D09045C68DD39273

SHA256:

47F82DC700224ECB3DE0FF2334AA40B0590046F819EF24DE7DA1A880754E7C84

SSDEEP:

98304:U6AZZkkQQfw6WwU1l7BNnz9fAQ6ZpFcbdCyPvIXuo2rARoPMCSieX3LGpauU0rDS:v6CyjXI/TaYLWDo9P7i8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • cmd.exe (PID: 2204)
      • net.exe (PID: 4504)

    • Scans artifacts that could help determine the target

      • msedgewebview2.exe (PID: 7924)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 3996)

    • Reads a specific registry key of the VM

      • loader.exe (PID: 4284)

  • SUSPICIOUS

    • Query current time using 'w32tm.exe'

      • cmd.exe (PID: 5864)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeWebview2Setup.exe (PID: 7512)
      • MicrosoftEdgeUpdate.exe (PID: 8188)

    • Silent install from TEMP directory

      • loader.exe (PID: 4284)

    • Reads the date of Windows installation

      • loader.exe (PID: 4284)

    • Executable content was dropped or overwritten

      • MicrosoftEdgeWebview2Setup.exe (PID: 7512)
      • MicrosoftEdge_X64_146.0.3856.84.exe (PID: 7848)
      • setup.exe (PID: 7424)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 8188)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5892)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5704)
      • MicrosoftEdgeUpdate.exe (PID: 4656)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5748)

    • Disables SEHOP

      • MicrosoftEdgeUpdate.exe (PID: 8188)

    • Application launched itself

      • MicrosoftEdgeUpdate.exe (PID: 4776)
      • msedgewebview2.exe (PID: 7924)
      • msedgewebview2.exe (PID: 7608)

    • Executes as Windows Service

      • MicrosoftEdgeUpdate.exe (PID: 4776)

    • Searches for installed software

      • setup.exe (PID: 7424)

    • Starts POWERSHELL.EXE for commands execution

      • loader.exe (PID: 4284)

    • The process hide an interactive prompt from the user

      • loader.exe (PID: 4284)

    • The process bypasses the loading of PowerShell profile settings

      • loader.exe (PID: 4284)

    • The process checks if it is being run in the virtual environment

      • loader.exe (PID: 4284)

  • INFO

    • Checks supported languages

      • loader.exe (PID: 4284)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7512)
      • MicrosoftEdgeUpdate.exe (PID: 8188)
      • MicrosoftEdgeUpdate.exe (PID: 2940)
      • MicrosoftEdgeUpdate.exe (PID: 4656)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5892)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5704)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5748)
      • MicrosoftEdgeUpdate.exe (PID: 2988)
      • MicrosoftEdgeUpdate.exe (PID: 4932)
      • MicrosoftEdgeUpdate.exe (PID: 4776)
      • MicrosoftEdgeUpdate.exe (PID: 2220)
      • setup.exe (PID: 7424)
      • MicrosoftEdge_X64_146.0.3856.84.exe (PID: 7848)
      • msedgewebview2.exe (PID: 7924)
      • msedgewebview2.exe (PID: 7364)
      • msedgewebview2.exe (PID: 2832)
      • msedgewebview2.exe (PID: 3136)
      • msedgewebview2.exe (PID: 8000)
      • msedgewebview2.exe (PID: 736)
      • MicrosoftEdgeUpdate.exe (PID: 8120)
      • msedgewebview2.exe (PID: 2132)
      • msedgewebview2.exe (PID: 4212)
      • msedgewebview2.exe (PID: 7608)
      • msedgewebview2.exe (PID: 684)
      • msedgewebview2.exe (PID: 3100)
      • msedgewebview2.exe (PID: 6652)

    • The sample compiled with english language support

      • loader.exe (PID: 4284)
      • MicrosoftEdgeWebview2Setup.exe (PID: 7512)
      • MicrosoftEdgeUpdate.exe (PID: 8188)
      • MicrosoftEdge_X64_146.0.3856.84.exe (PID: 7848)
      • setup.exe (PID: 7424)

    • Reads the computer name

      • loader.exe (PID: 4284)
      • MicrosoftEdgeUpdate.exe (PID: 8188)
      • MicrosoftEdgeUpdate.exe (PID: 2940)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5748)
      • MicrosoftEdgeUpdate.exe (PID: 4656)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5892)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5704)
      • MicrosoftEdgeUpdate.exe (PID: 2988)
      • MicrosoftEdgeUpdate.exe (PID: 4932)
      • MicrosoftEdgeUpdate.exe (PID: 4776)
      • MicrosoftEdgeUpdate.exe (PID: 2220)
      • MicrosoftEdge_X64_146.0.3856.84.exe (PID: 7848)
      • setup.exe (PID: 7424)
      • MicrosoftEdgeUpdate.exe (PID: 8120)
      • msedgewebview2.exe (PID: 7924)
      • msedgewebview2.exe (PID: 3136)
      • msedgewebview2.exe (PID: 7364)
      • msedgewebview2.exe (PID: 7608)
      • msedgewebview2.exe (PID: 684)
      • msedgewebview2.exe (PID: 4212)

    • Reads the machine GUID from the registry

      • loader.exe (PID: 4284)
      • msedgewebview2.exe (PID: 7924)
      • msedgewebview2.exe (PID: 7608)

    • Creates files or folders in the user directory

      • loader.exe (PID: 4284)
      • msedgewebview2.exe (PID: 2832)
      • msedgewebview2.exe (PID: 7924)
      • msedgewebview2.exe (PID: 3136)
      • msedgewebview2.exe (PID: 2132)
      • msedgewebview2.exe (PID: 7608)
      • msedgewebview2.exe (PID: 684)

    • Reads security settings of Internet Explorer

      • loader.exe (PID: 4284)
      • MicrosoftEdgeUpdate.exe (PID: 8188)
      • msedgewebview2.exe (PID: 7924)
      • msedgewebview2.exe (PID: 7608)

    • Create files in a temporary directory

      • loader.exe (PID: 4284)
      • MicrosoftEdgeUpdate.exe (PID: 8188)
      • msedgewebview2.exe (PID: 7608)
      • msedgewebview2.exe (PID: 7924)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 2220)
      • MicrosoftEdgeUpdate.exe (PID: 2988)
      • MicrosoftEdgeUpdate.exe (PID: 8120)
      • msedgewebview2.exe (PID: 7924)
      • msedgewebview2.exe (PID: 7608)

    • Creates a software uninstall entry

      • setup.exe (PID: 7424)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2026:03:27 16:08:47+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.44
CodeSize: 4206080
InitializedDataSize: 2622976
UninitializedDataSize: -
EntryPoint: 0x8c95a6
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: -
FileDescription: Loader
FileVersion: 1.0.0.0
InternalName: loader.exe
LegalCopyright: Copyright (C) 2025
OriginalFileName: loader.exe
ProductName: Loader
ProductVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
175
Monitored processes
37
Malicious processes
2
Suspicious processes
3

Behavior graph

Click at the process to see the details
start loader.exe cmd.exe no specs conhost.exe no specs net.exe no specs net1.exe no specs cmd.exe no specs conhost.exe no specs w32tm.exe no specs microsoftedgewebview2setup.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe microsoftedge_x64_146.0.3856.84.exe setup.exe microsoftedgeupdate.exe msedgewebview2.exe msedgewebview2.exe no specs msedgewebview2.exe no specs msedgewebview2.exe msedgewebview2.exe no specs msedgewebview2.exe no specs msedgewebview2.exe msedgewebview2.exe no specs msedgewebview2.exe no specs msedgewebview2.exe msedgewebview2.exe no specs msedgewebview2.exe no specs powershell.exe no specs conhost.exe no specs loader.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
684"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\146.0.3856.84\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Roaming\1575709424\WebView2\EBWebView" --webview-exe-name=loader.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --startup-read-main-dll --metrics-shmem-handle=2188,i,344621292769564756,5462485657700754266,524288 --field-trial-handle=1880,i,9750651518203349302,466235942152685841,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --pseudonymization-salt-handle=1884,i,15095450478575830443,12544763218787128949,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2192 /prefetch:3C:\Program Files (x86)\Microsoft\EdgeWebView\Application\146.0.3856.84\msedgewebview2.exe
msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge WebView2
Version:
146.0.3856.84
Modules
Images
c:\program files (x86)\microsoft\edgewebview\application\146.0.3856.84\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edgewebview\application\146.0.3856.84\msedge_elf.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\shcore.dll
736"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\146.0.3856.84\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Roaming\1575709424\Overlays\EBWebView" --webview-exe-name=loader.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --enable-gpu-memory-buffer-video-frames --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--expose-gc --device-scale-factor=1 --num-raster-threads=4 --enable-zero-copy --enable-main-frame-before-activation --renderer-client-id=5 --ram-no-pressure-read-main-dll --metrics-shmem-handle=3696,i,4368903770718943615,1477743253174567281,2097152 --field-trial-handle=1860,i,2091841437629323981,5904895462700910336,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --pseudonymization-salt-handle=1864,i,10161438271313727731,4875596215123491350,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3708 /prefetch:1C:\Program Files (x86)\Microsoft\EdgeWebView\Application\146.0.3856.84\msedgewebview2.exe—msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge WebView2
Exit code:
0
Version:
146.0.3856.84
Modules
Images
c:\program files (x86)\microsoft\edgewebview\application\146.0.3856.84\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edgewebview\application\146.0.3856.84\msedge_elf.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\shcore.dll
2132"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\146.0.3856.84\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\admin\AppData\Roaming\1575709424\WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\admin\AppData\Roaming\1575709424\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=146.0.7680.166 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\146.0.3856.84\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=146.0.3856.84 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffe22b734d8,0x7ffe22b734e4,0x7ffe22b734f0C:\Program Files (x86)\Microsoft\EdgeWebView\Application\146.0.3856.84\msedgewebview2.exe—msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge WebView2
Version:
146.0.3856.84
Modules
Images
c:\program files (x86)\microsoft\edgewebview\application\146.0.3856.84\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edgewebview\application\146.0.3856.84\msedge_elf.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\shcore.dll
2204/c "net start w32time"C:\Windows\System32\cmd.exe—loader.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
2220"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yMjUuNyIgc2hlbGxfdmVyc2lvbj0iMS4zLjIyNS43IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezFGRkI0QUE1LUQ0RDgtNEU5RC1CREQ4LUNGNEE2NEZCMDM2Mn0iIHVzZXJpZD0ie0ZEOTg0NzM5LUExMjItNERCMC1CRTVCLTQ2RTNFMDlEODRFNH0iIGluc3RhbGxzb3VyY2U9ImxpbWl0ZWQiIHJlcXVlc3RpZD0ie0QzODk1OTQ3LTdGMUUtNEEyNS1CRkJGLUE1NjIzRUU4QTE1OX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI2IiBwaHlzbWVtb3J5PSI2IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDUuNDA0NiIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJERUxMIiBwcm9kdWN0X25hbWU9IkRFTEwiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEzMy4wLjY5NDMuMTI3IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJHQ0VCIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMTcxNiIgaW5zdGFsbGRhdGU9IjYyNjUiIGluc3RhbGxkYXRldGltZT0iMTYyNjQ0MTUxNiIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMTQ5MjQ0ODQ1Mjc0MDAwMCIgZmlyc3RfZnJlX3NlZW5fdGltZT0iMTMzMDU4MjU0OTI5OTcyMDEwIiBmaXJzdF9mcmVfc2Vlbl92ZXJzaW9uPSIxMDQuMC4xMjkzLjYzIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMzIyODY5NCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTQ3MjEzMzYzMSIvPjwvYXBwPjwvcmVxdWVzdD4C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.225.7
Modules
Images
c:\program files (x86)\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
2812\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2832"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\146.0.3856.84\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\admin\AppData\Roaming\1575709424\Overlays\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\admin\AppData\Roaming\1575709424\Overlays\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=146.0.7680.166 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\146.0.3856.84\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=146.0.3856.84 --initial-client-data=0x184,0x188,0x18c,0x160,0x198,0x7ffe22b734d8,0x7ffe22b734e4,0x7ffe22b734f0C:\Program Files (x86)\Microsoft\EdgeWebView\Application\146.0.3856.84\msedgewebview2.exe—msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge WebView2
Exit code:
0
Version:
146.0.3856.84
Modules
Images
c:\program files (x86)\microsoft\edgewebview\application\146.0.3856.84\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edgewebview\application\146.0.3856.84\msedge_elf.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\shcore.dll
2940"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvcC:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.225.7
Modules
Images
c:\program files (x86)\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
2988"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yMjUuNyIgc2hlbGxfdmVyc2lvbj0iMS4zLjIyNS43IiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezFGRkI0QUE1LUQ0RDgtNEU5RC1CREQ4LUNGNEE2NEZCMDM2Mn0iIHVzZXJpZD0ie0ZEOTg0NzM5LUExMjItNERCMC1CRTVCLTQ2RTNFMDlEODRFNH0iIGluc3RhbGxzb3VyY2U9Im90aGVyaW5zdGFsbGNtZCIgcmVxdWVzdGlkPSJ7NjNFNDQ2M0YtRjBENy00RDFFLTlGRTEtRTZCRUE1MTkwMUVFfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjYiIHBoeXNtZW1vcnk9IjYiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS40MDQ2IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRFTEwiIHByb2R1Y3RfbmFtZT0iREVMTCIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS40MyIgbmV4dHZlcnNpb249IjEuMy4yMjUuNyIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTQ2NjAzOTg0MyIgaW5zdGFsbF90aW1lX21zPSI5MDciLz48L2FwcD48L3JlcXVlc3Q-C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.225.7
Modules
Images
c:\program files (x86)\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
3100"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\146.0.3856.84\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Roaming\1575709424\WebView2\EBWebView" --webview-exe-name=loader.exe --webview-exe-version=1.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --startup-read-main-dll --metrics-shmem-handle=2352,i,2938520775271656340,11172353330232529077,524288 --field-trial-handle=1880,i,9750651518203349302,466235942152685841,262144 --disable-features=UseChromeOSDirectVideoDecoder --variations-seed-version --pseudonymization-salt-handle=1884,i,15095450478575830443,12544763218787128949,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2364 /prefetch:8C:\Program Files (x86)\Microsoft\EdgeWebView\Application\146.0.3856.84\msedgewebview2.exe—msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge WebView2
Version:
146.0.3856.84
Modules
Images
c:\program files (x86)\microsoft\edgewebview\application\146.0.3856.84\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edgewebview\application\146.0.3856.84\msedge_elf.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\shcore.dll
Total events
35 451
Read events
31 962
Write events
3 362
Delete events
127

Modification events

(PID) Process:(2940) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe
Operation:delete keyName:(default)
Value:
(PID) Process:(2940) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe
Operation:writeName:AppID
Value:
{CECDDD22-2E72-4832-9606-A9B0E5E344B2}
(PID) Process:(2940) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}
Operation:writeName:LocalService
Value:
edgeupdate
(PID) Process:(2940) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}
Operation:writeName:ServiceParameters
Value:
/comsvc
(PID) Process:(2940) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\edgeupdate
Operation:writeName:EventMessageFile
Value:
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.225.7\msedgeupdate.dll
(PID) Process:(2940) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\ProgID
Operation:delete keyName:(default)
Value:
(PID) Process:(2940) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\VersionIndependentProgID
Operation:delete keyName:(default)
Value:
(PID) Process:(2940) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}
Operation:delete keyName:(default)
Value:
(PID) Process:(2940) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}
Operation:writeName:AppID
Value:
{CECDDD22-2E72-4832-9606-A9B0E5E344B2}
(PID) Process:(2940) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{A6B716CB-028B-404D-B72C-50E153DD68DA}
Operation:delete keyName:(default)
Value:
Executable files
207
Suspicious files
198
Text files
131
Unknown types
0

Dropped files

PID
Process
Filename
Type
7512MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EU6B0A.tmp\MicrosoftEdgeUpdateComRegisterShell64.exeexecutable
MD5:8A477309158449224B44DEEE0A0A006A
SHA256:771DE1F31B34AAAA43BCE903CA06F37241C5E5B6B2FB4E237556628AF5F19D3F
7512MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EU6B0A.tmp\MicrosoftEdgeUpdate.exeexecutable
MD5:352C33641CBBD193AF127D306CB960C8
SHA256:F56701783D22D0E17E126D09ACA62B1969259D4B7B00DEDD9A0001C6D1ABEAD2
7512MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EU6B0A.tmp\msedgeupdate.dllexecutable
MD5:C0C5EE3503D2C0E39A9DCC85C662781C
SHA256:F51E55956CEA63E78C59B0C3C708019588ADB3B3B0FE085A13EFBC282BC0FD3C
7512MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EU6B0A.tmp\msedgeupdateres_am.dllexecutable
MD5:CB90C765389E8ED1E7011D8648FD1BC4
SHA256:1C4FAD3EB62432269C1B2A711A0B0DAE61D7F625E355267379D552F3A61BCE71
7512MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EU6B0A.tmp\EdgeUpdate.datbinary
MD5:369BBC37CFF290ADB8963DC5E518B9B8
SHA256:3D7EC761BEF1B1AF418B909F1C81CE577C769722957713FDAFBC8131B0A0C7D3
7512MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EU6B0A.tmp\psmachine_arm64.dllexecutable
MD5:0A4B47818A713EA4DFDA2FA44C785713
SHA256:87D028F197DDB0E3B2840D693462F2C961D2317C06B72DF568C84F3EFD781FC8
7512MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EU6B0A.tmp\NOTICE.TXTtext
MD5:6DD5BF0743F2366A0BDD37E302783BCD
SHA256:91D3FC490565DED7621FF5198960E501B6DB857D5DD45AF2FE7C3ECD141145F5
7512MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EU6B0A.tmp\psuser_arm64.dllexecutable
MD5:6451A6A299DE5836906EF1A2C8A4D8F5
SHA256:1C36A208B195344336E3DA1563B1FEB32141D644C68CE9F24682647C0FA10FCF
7512MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EU6B0A.tmp\psuser_64.dllexecutable
MD5:C6E6E37E30A51F5B8BC096CD19F9FD28
SHA256:9F6F2C62B6D5EF1DAFC3D8966C29AE33AFE6F3C7B2175FF5F065B9C0AB55337D
7512MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EU6B0A.tmp\psmachine_64.dllexecutable
MD5:BF5BA3A9C83A255794BF48942325362D
SHA256:D5CD31F80773BE192F00B1EAE34671F11AB3260DE183F0A408218A70797AFAB9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
161
TCP/UDP connections
63
DNS requests
31
Threats
140

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4284
loader.exe
GET
301
88.221.169.205:443
https://go.microsoft.com/fwlink/p/?LinkId=2124703
unknown
—
—
whitelisted
4212
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4212
svchost.exe
GET
200
23.55.110.193:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5276
MoUsoCoreWorker.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2828
slui.exe
POST
500
48.192.1.64:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
text
512 b
whitelisted
2828
slui.exe
POST
500
48.192.1.64:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
text
512 b
whitelisted
4284
loader.exe
GET
200
57.128.183.93:443
https://loader.unbanned.gg/api/ssl/certificate
unknown
text
1.26 Kb
unknown
4284
loader.exe
GET
200
57.128.183.93:443
https://loader.unbanned.gg/api/ssl/certificate
unknown
text
1.26 Kb
unknown
4284
loader.exe
GET
301
23.52.181.212:443
https://go.microsoft.com/fwlink/p/?LinkId=2124703
unknown
—
—
—
4284
loader.exe
GET
200
199.232.210.172:443
https://msedge.sf.dl.delivery.mp.microsoft.com/filestreamingservice/files/7ff41be4-dbce-4efe-823f-c7d33a4e3c5e/MicrosoftEdgeWebview2Setup.exe
unknown
text
1.61 Mb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
—
—
2.16.241.218:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
—
—
48.192.1.64:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
4212
svchost.exe
23.55.110.193:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
4212
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
5276
MoUsoCoreWorker.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4212
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
www.bing.com
  • 2.16.241.218
  • 2.16.241.207
  • 2.16.241.205
whitelisted
activation-v2.sls.microsoft.com
  • 48.192.1.64
whitelisted
google.com
  • 142.251.141.142
whitelisted
crl.microsoft.com
  • 23.55.110.193
  • 23.55.110.211
  • 23.48.23.176
  • 23.48.23.194
  • 23.48.23.173
  • 23.48.23.141
  • 23.48.23.177
  • 23.48.23.180
  • 23.48.23.169
  • 23.48.23.167
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 88.221.169.152
  • 23.52.181.212
whitelisted
loader.unbanned.gg
  • 57.128.183.93
unknown
go.microsoft.com
  • 88.221.169.205
whitelisted
msedge.sf.dl.delivery.mp.microsoft.com
  • 199.232.210.172
  • 199.232.214.172
whitelisted
config.edge.skype.com
  • 52.123.243.222
  • 52.123.243.93
  • 52.123.243.205
  • 150.171.22.17
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
SUSPICIOUS [ANY.RUN] Win32/Generic User-Agent observed (loader)
4284
loader.exe
Potentially Bad Traffic
SUSPICIOUS [ANY.RUN] Win32/Generic User-Agent observed (loader)
—
—
Potentially Bad Traffic
SUSPICIOUS [ANY.RUN] Win32/Generic User-Agent observed (loader)
—
—
Misc activity
ET INFO Packed Executable Download
4284
loader.exe
Potentially Bad Traffic
SUSPICIOUS [ANY.RUN] Win32/Generic User-Agent observed (loader)
4284
loader.exe
Misc activity
ET INFO Packed Executable Download
2956
svchost.exe
Misc activity
ET INFO Packed Executable Download
—
—
A Network Trojan was detected
LOADER [ANY.RUN] Win32/Generic associated URI (/loader/version)
—
—
Potentially Bad Traffic
SUSPICIOUS [ANY.RUN] Win32/Generic User-Agent observed (loader)
4284
loader.exe
A Network Trojan was detected
LOADER [ANY.RUN] Win32/Generic associated URI (/loader/version)
Process
Message
loader.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
loader.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
loader.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
loader.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
msedgewebview2.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Roaming\1575709424\Overlays directory exists )
loader.exe
Warning: AddWebResourceRequestedFilter without SourceKind parameter is deprecated! It does not behave as expected for iframes.Please use AddWebResourceRequestedFilterWithRequestSourceKinds instead. For more information, please see https://go.microsoft.com/fwlink/?linkid=2286319
msedgewebview2.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Roaming\1575709424\WebView2 directory exists )
loader.exe
Warning: AddWebResourceRequestedFilter without SourceKind parameter is deprecated! It does not behave as expected for iframes.Please use AddWebResourceRequestedFilterWithRequestSourceKinds instead. For more information, please see https://go.microsoft.com/fwlink/?linkid=2286319
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
loader.exe