File name:

facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe

Full analysis: https://app.any.run/tasks/60f01474-03ef-4829-9a93-82c58866c90a
Verdict: Malicious activity
Analysis date: March 07, 2024, 14:28:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

E87AA8DCB2F95EF40221C106579E0B5D

SHA1:

E54497D919D9245969FA4A83E27DB3C5EC931C4C

SHA256:

4D1ADF3F837C4B92D49A5892F58E6E1F6566E6A7BD648B117232FFD8341124C2

SSDEEP:

49152:WI2P/g85GkowefWaLbd6FP/+DQiFrDGP/qQqFMCqDChtRss:d/LLyWtFCP/8qDChAs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe (PID: 3656)
      • facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe (PID: 2280)

    • Connects to the CnC server

      • facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe (PID: 3656)
      • facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe (PID: 2280)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe (PID: 3656)
      • facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe (PID: 2280)

    • Reads the Internet Settings

      • facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe (PID: 3656)
      • sipnotify.exe (PID: 1440)
      • facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe (PID: 2280)

    • Reads security settings of Internet Explorer

      • facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe (PID: 3656)
      • facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe (PID: 2280)

    • Non-standard symbols in registry

      • WINWORD.EXE (PID: 2588)
      • WINWORD.EXE (PID: 1820)
      • WINWORD.EXE (PID: 3468)

    • The process executes via Task Scheduler

      • sipnotify.exe (PID: 1440)
      • ctfmon.exe (PID: 1612)

    • Reads settings of System Certificates

      • sipnotify.exe (PID: 1440)

  • INFO

    • Checks supported languages

      • hcs.exe (PID: 3772)
      • facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe (PID: 3656)
      • hcs.exe (PID: 2852)
      • hcs.exe (PID: 3660)
      • facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe (PID: 1540)
      • facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe (PID: 316)
      • IMEKLMG.EXE (PID: 1516)
      • IMEKLMG.EXE (PID: 2056)
      • facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe (PID: 2280)
      • wmpnscfg.exe (PID: 2368)
      • wmpnscfg.exe (PID: 2412)
      • hcs.exe (PID: 2508)
      • hcs.exe (PID: 2520)
      • wmpnscfg.exe (PID: 2692)
      • hcs.exe (PID: 2528)

    • Reads the computer name

      • facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe (PID: 3656)
      • hcs.exe (PID: 3772)
      • hcs.exe (PID: 3660)
      • IMEKLMG.EXE (PID: 1516)
      • IMEKLMG.EXE (PID: 2056)
      • facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe (PID: 2280)
      • wmpnscfg.exe (PID: 2368)
      • wmpnscfg.exe (PID: 2412)
      • hcs.exe (PID: 2508)
      • hcs.exe (PID: 2520)
      • wmpnscfg.exe (PID: 2692)

    • Creates files in the program directory

      • facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe (PID: 3656)

    • Manual execution by a user

      • msedge.exe (PID: 4008)
      • facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe (PID: 1540)
      • facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe (PID: 316)
      • WINWORD.EXE (PID: 2588)
      • WINWORD.EXE (PID: 3468)
      • msedge.exe (PID: 2980)
      • IMEKLMG.EXE (PID: 1516)
      • IMEKLMG.EXE (PID: 2056)
      • WINWORD.EXE (PID: 1820)
      • wmpnscfg.exe (PID: 2368)
      • wmpnscfg.exe (PID: 2412)
      • wmpnscfg.exe (PID: 2692)
      • mmc.exe (PID: 2808)
      • mmc.exe (PID: 2924)
      • facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe (PID: 2280)

    • Application launched itself

      • msedge.exe (PID: 4008)
      • msedge.exe (PID: 2980)

    • Process checks whether UAC notifications are on

      • IMEKLMG.EXE (PID: 2056)
      • IMEKLMG.EXE (PID: 1516)

    • Reads security settings of Internet Explorer

      • sipnotify.exe (PID: 1440)

    • Reads the software policy settings

      • sipnotify.exe (PID: 1440)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (37.4)
.scr | Windows screen saver (34.5)
.exe | Win32 Executable (generic) (11.9)
.exe | Win16/32 Executable Delphi generic (5.4)
.exe | Generic Win/DOS Executable (5.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 838144
InitializedDataSize: 688128
UninitializedDataSize: -
EntryPoint: 0xcd78c
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 7.7.0.0
ProductVersionNumber: 7.7.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName:
FileDescription:
FileVersion: 7.7.0.0
InternalName: -
LegalCopyright:
LegalTrademarks: -
OriginalFileName: apc_host.exe
ProductName:
ProductVersion: 7.7
Comments: No Comments
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
126
Monitored processes
39
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start facturacion_masmovil-y3jpc2dvbjg3qgdtywlslmnvbsazodq1mjmgcm9uywxkaw5obze=.exe hcs.exe no specs hcs.exe no specs hcs.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs facturacion_masmovil-y3jpc2dvbjg3qgdtywlslmnvbsazodq1mjmgcm9uywxkaw5obze=.exe no specs facturacion_masmovil-y3jpc2dvbjg3qgdtywlslmnvbsazodq1mjmgcm9uywxkaw5obze=.exe no specs winword.exe no specs winword.exe no specs winword.exe no specs PhotoViewer.dll no specs msedge.exe msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs ctfmon.exe no specs sipnotify.exe imeklmg.exe no specs imeklmg.exe no specs facturacion_masmovil-y3jpc2dvbjg3qgdtywlslmnvbsazodq1mjmgcm9uywxkaw5obze=.exe wmpnscfg.exe no specs wmpnscfg.exe no specs hcs.exe no specs hcs.exe no specs hcs.exe no specs wmpnscfg.exe no specs mmc.exe no specs mmc.exe

Process information

PID
CMD
Path
Indicators
Parent process
316"C:\Users\admin\Desktop\facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe" C:\Users\admin\Desktop\facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe—explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
7.7.0.0
Modules
Images
c:\users\admin\desktop\facturacion_masmovil-y3jpc2dvbjg3qgdtywlslmnvbsazodq1mjmgcm9uywxkaw5obze=.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
324C:\Windows\system32\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
696"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1292 --field-trial-handle=1372,i,14069826342618214474,4969605523250964659,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
696"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1560 --field-trial-handle=1296,i,6384851604599786345,9950999924354749454,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1440C:\Windows\system32\sipnotify.exe -LogonOrUnlockC:\Windows\System32\sipnotify.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
sipnotify
Exit code:
0
Version:
6.1.7602.20480 (win7sp1_ldr_escrow.191010-1716)
Modules
Images
c:\windows\system32\sipnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1516"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /JPN /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
1540"C:\Users\admin\Desktop\facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe" C:\Users\admin\Desktop\companyword.rtfC:\Users\admin\Desktop\facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe—explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
7.7.0.0
Modules
Images
c:\users\admin\desktop\facturacion_masmovil-y3jpc2dvbjg3qgdtywlslmnvbsazodq1mjmgcm9uywxkaw5obze=.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1572"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2156 --field-trial-handle=1372,i,14069826342618214474,4969605523250964659,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1612C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1696"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd8,0x6bbcf598,0x6bbcf5a8,0x6bbcf5b4C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
31 838
Read events
30 361
Write events
516
Delete events
961

Modification events

(PID) Process:(3656) facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3656) facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3656) facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3656) facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(4008) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(4008) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(4008) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(4008) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(4008) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(4008) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:dr
Value:
1
Executable files
16
Suspicious files
122
Text files
149
Unknown types
128

Dropped files

PID
Process
Filename
Type
4008msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF18f16f.TMP —
MD5:—
SHA256:—
4008msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
3656facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exeC:\ProgramData\Anyplace Control Support\libspeexdsp.dllexecutable
MD5:9A8608BB0B654C650743221914D87AC2
SHA256:F15B0408096EAFC700FE069B716FFA921854B4E95BED33AD08524A59CC8AD57B
3656facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exeC:\ProgramData\Anyplace Control Support\apcErrorsLog.txttext
MD5:C2E002E5ECC610FFEE08EE218519FDC4
SHA256:B42DA5709E736F674DE7EC762C0F7B3FC976A873D8A0A7EDE7490F4920A12C47
3656facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exeC:\ProgramData\Anyplace Control Support\hcs.exeexecutable
MD5:AC5933067B2C38299AE1443331A61511
SHA256:8C305BB4C07FAC5C88AD1906E6195DD8176F7B6E5014E8FB3E081A45161CF72A
4008msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF18f18f.TMP —
MD5:—
SHA256:—
4008msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
4008msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF18f19e.TMP —
MD5:—
SHA256:—
3656facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exeC:\ProgramData\Anyplace Control Support\libspeex.dllexecutable
MD5:E10DB82C997A756A01B6F954E86B83E0
SHA256:65A9BBD5B3B9161C0DD61A9E185E391CFA68F31171E1A5FCFAD20BCC9EB09480
4008msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Variationsbinary
MD5:961E3604F228B0D10541EBF921500C86
SHA256:F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
57
DNS requests
103
Threats
20

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1440
sipnotify.exe
HEAD
200
23.14.16.102:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133542955559060000
unknown
—
—
unknown
—
—
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?95067de5d0068fe5
unknown
—
—
unknown
1400
svchost.exe
GET
200
92.122.89.124:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
binary
814 b
unknown
1400
svchost.exe
GET
200
184.25.50.10:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
binary
1.01 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3656
facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe
216.158.90.159:443
anyplace-gateway.work
WEBNX
US
unknown
2364
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4008
msedge.exe
239.255.255.250:1900
—
—
—
unknown
2364
msedge.exe
204.79.197.203:443
ntp.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2364
msedge.exe
13.107.21.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
2364
msedge.exe
23.201.29.35:443
assets.msn.com
Akamai International B.V.
US
unknown

DNS requests

Domain
IP
Reputation
anyplace-gateway.work
  • 216.158.90.159
unknown
ntp.msn.com
  • 204.79.197.203
whitelisted
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
  • 13.107.22.239
  • 131.253.33.239
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
assets.msn.com
  • 23.201.29.35
  • 23.201.29.11
  • 23.201.29.58
  • 23.201.29.59
  • 23.201.29.65
  • 23.201.29.51
  • 23.201.29.18
  • 23.201.29.10
  • 23.201.29.75
whitelisted
img-s-msn-com.akamaized.net
  • 184.25.50.57
  • 184.25.50.74
whitelisted
sb.scorecardresearch.com
  • 18.245.60.76
  • 18.245.60.53
  • 18.245.60.72
  • 18.245.60.107
shared
th.bing.com
  • 92.122.215.74
  • 92.122.215.72
  • 92.122.215.95
  • 92.122.215.98
  • 92.122.215.65
  • 92.122.215.56
  • 92.122.215.55
  • 92.122.215.75
  • 92.122.215.58
  • 2.20.142.138
  • 2.20.142.128
  • 92.122.215.99
  • 2.20.142.129
whitelisted
api.msn.com
  • 204.79.197.203
whitelisted
c.bing.com
  • 13.107.21.200
  • 204.79.197.200
whitelisted

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .work TLD
3656
facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe
Misc activity
ET INFO Anyplace Remote Access Initial Connection Attempt (005)
3656
facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe
Misc activity
ET INFO Anyplace Remote Access Initial Connection Attempt (005)
3656
facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe
Misc activity
ET INFO Anyplace Remote Access Checkin (051)
3656
facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe
Misc activity
ET INFO Anyplace Remote Access Checkin (051)
3656
facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe
Misc activity
ET INFO Anyplace Remote Access Initial Connection Attempt (005)
3656
facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe
Misc activity
ET INFO Anyplace Remote Access Initial Connection Attempt (005)
3656
facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe
Misc activity
ET INFO Anyplace Remote Access Initial Connection Attempt (005)
3656
facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe
Misc activity
ET INFO Anyplace Remote Access Initial Connection Attempt (005)
3656
facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe
Misc activity
ET INFO Anyplace Remote Access Initial Connection Attempt (005)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
facturacion_masmovil-Y3Jpc2dvbjg3QGdtYWlsLmNvbSAzODQ1MjMgcm9uYWxkaW5obzE=.exe