URL:

https://www.malwarebytes.com/mb-home

Full analysis: https://app.any.run/tasks/669403b7-d862-4d60-b035-fb5726e912e5
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 12, 2026, 19:54:54
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
screenconnect
rmm-tool
stealer
loader
Indicators:
MD5:

34DBCB21E36FF1382AA0954B937585CD

SHA1:

9C25C2C8F258ADC71DEDDE49FA4A21E53F2A25A7

SHA256:

5C3A1E6068B3E232203D7D12CD2CC6180B2D22C8FC9A8765A892A55E2D6FD1A1

SSDEEP:

3:N8DSLHXZzyff9:2OLHJGfF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes settings of System certificates

      • MBAMInstallerService.exe (PID: 5716)

    • Actions looks like stealing of personal data

      • MBAMService.exe (PID: 7432)

  • SUSPICIOUS

    • The process verifies whether the antivirus software is installed

      • MBAMInstallerService.exe (PID: 5716)
      • MBSetup.exe (PID: 7648)
      • MBVpnTunnelService.exe (PID: 1760)
      • MBAMService.exe (PID: 1520)
      • drvinst.exe (PID: 8292)
      • MBAMService.exe (PID: 7432)
      • Malwarebytes.exe (PID: 5660)

    • Searches for installed software

      • MBSetup.exe (PID: 7648)
      • MBAMInstallerService.exe (PID: 5716)
      • Malwarebytes.exe (PID: 5660)

    • Reads the BIOS version

      • MBSetup.exe (PID: 7648)
      • MBAMService.exe (PID: 7432)

    • Creates files in the driver directory

      • MBSetup.exe (PID: 7648)
      • MBAMInstallerService.exe (PID: 5716)
      • MBVpnTunnelService.exe (PID: 1760)
      • MBAMService.exe (PID: 1520)
      • MBAMService.exe (PID: 7432)

    • Executes as Windows Service

      • MBAMInstallerService.exe (PID: 5716)
      • MBAMService.exe (PID: 7432)

    • Executable content was dropped or overwritten

      • MBSetup.exe (PID: 7648)
      • MBAMInstallerService.exe (PID: 5716)
      • MBAMService.exe (PID: 1520)
      • MBVpnTunnelService.exe (PID: 1760)
      • MBAMService.exe (PID: 7432)

    • Drops a system driver (possible attempt to evade defenses)

      • MBAMInstallerService.exe (PID: 5716)
      • drvinst.exe (PID: 8292)
      • MBAMService.exe (PID: 1520)
      • MBVpnTunnelService.exe (PID: 1760)
      • MBAMService.exe (PID: 7432)

    • The process creates files with name similar to system file names

      • MBAMInstallerService.exe (PID: 5716)

    • Changes Internet Explorer settings (feature browser emulation)

      • MBAMInstallerService.exe (PID: 5716)
      • MBAMService.exe (PID: 7432)

    • Adds/modifies Windows certificates

      • MBAMInstallerService.exe (PID: 5716)

    • Drops 7-zip archiver for unpacking

      • MBAMInstallerService.exe (PID: 5716)

    • The process drops C-runtime libraries

      • MBAMInstallerService.exe (PID: 5716)

    • Creates or modifies Windows services

      • MBAMService.exe (PID: 1520)
      • MBAMService.exe (PID: 7432)

    • Creates/Modifies COM task schedule object

      • MBAMService.exe (PID: 7432)

  • INFO

    • Reads Environment values

      • identity_helper.exe (PID: 9188)
      • MBAMService.exe (PID: 7432)

    • Reads the computer name

      • identity_helper.exe (PID: 9188)
      • MBAMInstallerService.exe (PID: 5716)
      • MBSetup.exe (PID: 7648)
      • MBVpnTunnelService.exe (PID: 1760)
      • drvinst.exe (PID: 8292)
      • MBAMService.exe (PID: 1520)
      • MBAMService.exe (PID: 7432)
      • Malwarebytes.exe (PID: 5660)

    • Checks supported languages

      • identity_helper.exe (PID: 9188)
      • MBAMInstallerService.exe (PID: 5716)
      • MBSetup.exe (PID: 7648)
      • MBVpnTunnelService.exe (PID: 1760)
      • drvinst.exe (PID: 8292)
      • MBAMService.exe (PID: 1520)
      • MBAMService.exe (PID: 7432)
      • Malwarebytes.exe (PID: 5660)

    • Application launched itself

      • msedge.exe (PID: 7256)

    • The sample compiled with english language support

      • msedge.exe (PID: 6852)
      • msedge.exe (PID: 7256)
      • MBSetup.exe (PID: 7648)
      • MBAMInstallerService.exe (PID: 5716)
      • drvinst.exe (PID: 8292)
      • MBVpnTunnelService.exe (PID: 1760)
      • MBAMService.exe (PID: 7432)
      • MBAMService.exe (PID: 1520)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 7256)
      • msedge.exe (PID: 6852)

    • Launching a file from the Downloads directory

      • msedge.exe (PID: 7256)

    • Creates files in the program directory

      • MBAMInstallerService.exe (PID: 5716)
      • MBSetup.exe (PID: 7648)
      • MBVpnTunnelService.exe (PID: 1760)
      • MBAMService.exe (PID: 7432)
      • Malwarebytes.exe (PID: 5660)

    • Create files in a temporary directory

      • MBSetup.exe (PID: 7648)

    • Reads the machine GUID from the registry

      • MBSetup.exe (PID: 7648)
      • MBAMInstallerService.exe (PID: 5716)
      • drvinst.exe (PID: 8292)
      • MBAMService.exe (PID: 7432)

    • The sample compiled with spanish language support

      • MBAMInstallerService.exe (PID: 5716)

    • Reads security settings of Internet Explorer

      • MBAMService.exe (PID: 7432)

    • Reads the time zone

      • MBAMService.exe (PID: 7432)

    • Reads CPU info

      • MBAMService.exe (PID: 7432)

    • CONNECTWISE has been detected

      • MBAMService.exe (PID: 7432)

    • Creates a software uninstall entry

      • MBAMInstallerService.exe (PID: 5716)

    • Creates files or folders in the user directory

      • Malwarebytes.exe (PID: 5660)

    • Process checks computer location settings

      • Malwarebytes.exe (PID: 5660)

    • Process checks whether UAC notifications are on

      • Malwarebytes.exe (PID: 5660)

    • There is functionality for taking screenshot (YARA)

      • Malwarebytes.exe (PID: 5660)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
209
Monitored processes
55
Malicious processes
3
Suspicious processes
3

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs mbsetup.exe no specs mbsetup.exe msedge.exe no specs mbaminstallerservice.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs mbvpntunnelservice.exe conhost.exe no specs drvinst.exe no specs mbamservice.exe mbamservice.exe msedge.exe no specs malwarebytes.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1080"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=8684,i,13575040374800807207,17619427512290478256,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1488"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --field-trial-handle=4540,i,13575040374800807207,17619427512290478256,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=8812 /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1520"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /ProtectedC:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
MBAMInstallerService.exe
User:
SYSTEM
Company:
Malwarebytes
Integrity Level:
SYSTEM
Description:
Malwarebytes Service
Exit code:
0
Version:
3.2.0.1485
Modules
Images
c:\program files\malwarebytes\anti-malware\mbamservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\bcrypt.dll
1600"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=6452,i,13575040374800807207,17619427512290478256,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=7336 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1676"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=6208,i,13575040374800807207,17619427512290478256,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=8144 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1760"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtunC:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe
MBAMInstallerService.exe
User:
SYSTEM
Company:
Malwarebytes
Integrity Level:
SYSTEM
Description:
MBVpnTunnelService.exe
Exit code:
0
Version:
5.0.0.101
Modules
Images
c:\program files\malwarebytes\anti-malware\mbvpntunnelservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
2284"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --disable-quic --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=5192,i,13575040374800807207,17619427512290478256,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2352"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=6080,i,13575040374800807207,17619427512290478256,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2640"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=5584,i,13575040374800807207,17619427512290478256,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=8960 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2784"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=2348,i,13575040374800807207,17619427512290478256,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
147 997
Read events
147 010
Write events
975
Delete events
12

Modification events

(PID) Process:(7648) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Malwarebytes
Operation:writeName:id
Value:
b417b1735d14414882650d2d80ec9810
(PID) Process:(7648) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Malwarebytes
Operation:writeName:id
Value:
b417b1735d14414882650d2d80ec9810
(PID) Process:(7648) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\mbamtestkey
Operation:delete keyName:(default)
Value:
(PID) Process:(7648) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMInstallerService\Parameters
Operation:writeName:UserName
Value:
admin
(PID) Process:(7648) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMInstallerService\Parameters
Operation:writeName:ProductCode
Value:
MBAM-C
(PID) Process:(7648) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMInstallerService\Parameters
Operation:writeName:ProductBuild
Value:
consumer
(PID) Process:(7648) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMInstallerService\Parameters
Operation:writeName:ProgramDirectory
Value:
C:\Program Files\Malwarebytes\Anti-Malware
(PID) Process:(7648) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMInstallerService\Parameters
Operation:writeName:LocalAppDataDir
Value:
C:\Users\admin\AppData\Local
(PID) Process:(7648) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMInstallerService\Parameters
Operation:writeName:Channel
Value:
release
(PID) Process:(7648) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMInstallerService\Parameters
Operation:writeName:Installer
Value:
C:\Users\admin\Downloads\MBSetup.exe
Executable files
1 298
Suspicious files
739
Text files
427
Unknown types
0

Dropped files

PID
Process
Filename
Type
7256msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old~RF1e561d.TMP —
MD5:—
SHA256:—
7256msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old —
MD5:—
SHA256:—
7256msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF1e561d.TMP —
MD5:—
SHA256:—
7256msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF1e562c.TMP —
MD5:—
SHA256:—
7256msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
7256msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
7256msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF1e563c.TMP —
MD5:—
SHA256:—
7256msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF1e563c.TMP —
MD5:—
SHA256:—
7256msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old —
MD5:—
SHA256:—
7256msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF1e565b.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
676
TCP/UDP connections
196
DNS requests
227
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6852
msedge.exe
GET
200
150.171.27.11:443
https://edge.microsoft.com/serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.19045&devicefamily=desktop&installdate=1661339457&clientversion=133.0.3065.92&experimentationmode=2&scpguard=0&scpfull=0&scpver=0
unknown
text
295 b
whitelisted
6852
msedge.exe
GET
200
150.171.28.11:80
http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:Uw_IIw2HhI9p9eJwR8H_mH9ZgoEPrgdZqC73lN2eNf0&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
6852
msedge.exe
GET
200
192.0.66.233:443
https://www.malwarebytes.com/mb-home
unknown
html
947 Kb
unknown
6852
msedge.exe
GET
200
104.18.23.222:443
https://copilot.microsoft.com/c/api/user/eligibility
unknown
text
25 b
whitelisted
6852
msedge.exe
GET
200
13.107.246.44:443
https://api.edgeoffer.microsoft.com/edgeoffer/pb/experiments?appId=edge-extensions&country=US
unknown
binary
82 b
whitelisted
6852
msedge.exe
GET
200
192.0.66.233:443
https://www.malwarebytes.com/wp-content/uploads/sites/2/2025/12/HP-Hero-Mobile-Plants-ThreatBlocked-96.png
unknown
—
—
unknown
6852
msedge.exe
GET
200
192.0.66.233:443
https://www.malwarebytes.com/wp-content/uploads/sites/2/eb-style/frontend/frontend-382231.min.css?ver=1772826611
unknown
text
5.54 Kb
unknown
6852
msedge.exe
GET
200
192.0.66.233:443
https://www.malwarebytes.com/_static/??-eJyNjEEKgDAMBD9kDQVRPIhv0RpDoKbFRvp9S7148OBt2dlZyNG4IIqiEP1FLAkIgy4nobJQjhCv1bMDl17EPGV7sLQFNPBxk5F8UNg4aZX3swxMSb8NwWx2v1A15mOyw2B7a/uxuwE7zUQD
unknown
text
174 Kb
unknown
6852
msedge.exe
GET
200
192.0.66.233:443
https://www.malwarebytes.com/wp-content/uploads/sites/2/eb-style/eb-style-382231.min.css?ver=18d0bde6ed
unknown
text
27.4 Kb
unknown
6852
msedge.exe
GET
200
192.0.66.233:443
https://www.malwarebytes.com/_static/??-eJydj0EKwjAQRS9kOgSkxYV4lnRmkNB0Evqnire3CrpyoW4/7z34dG2Bq7maUyvrORtoSqLGGsZSeQJJhhP8Vl5LSHJJGyCjW8fAjv6JoCXW5Us/tKV+apQsvzWycVlFQQlQB23qG0N75Lo5P1+d5mMchtjH2B/2d+cubkc=
unknown
text
22.7 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
7736
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6608
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6768
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
6852
msedge.exe
52.123.243.94:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6852
msedge.exe
150.171.28.11:80
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6852
msedge.exe
150.171.27.11:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6852
msedge.exe
192.0.66.233:443
www.malwarebytes.com
AUTOMATTIC
US
whitelisted
6852
msedge.exe
104.18.23.222:443
copilot.microsoft.com
CLOUDFLARENET
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
  • 51.104.136.2
whitelisted
google.com
  • 192.178.204.138
  • 192.178.204.113
  • 192.178.204.102
  • 192.178.204.101
  • 192.178.204.100
  • 192.178.204.139
whitelisted
edge.microsoft.com
  • 150.171.28.11
  • 150.171.27.11
whitelisted
config.edge.skype.com
  • 52.123.243.94
  • 52.123.224.72
  • 52.123.243.91
  • 52.123.243.66
whitelisted
www.malwarebytes.com
  • 192.0.66.233
whitelisted
api.edgeoffer.microsoft.com
  • 13.107.246.44
  • 13.107.213.44
whitelisted
copilot.microsoft.com
  • 104.18.23.222
  • 104.18.22.222
whitelisted
www.bing.com
  • 2.16.204.143
  • 2.16.204.155
  • 2.16.204.152
  • 2.16.204.144
  • 2.16.204.158
  • 2.16.204.142
  • 2.16.204.148
  • 2.16.204.145
  • 2.16.204.156
  • 2.16.241.205
  • 2.16.241.218
  • 2.16.241.207
  • 2.16.241.222
  • 2.16.241.201
  • 2.16.204.136
  • 2.16.204.141
  • 2.16.204.151
  • 2.16.204.160
  • 2.16.204.161
  • 2.16.204.134
  • 2.16.204.139
  • 2.16.204.149
  • 2.16.204.147
  • 2.16.204.150
whitelisted
stats.wp.com
  • 192.0.76.3
whitelisted
web-service.malwarebytes.com
  • 192.0.66.185
unknown

Threats

PID
Process
Class
Message
6852
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] An application monitoring request to newrelic .com
6852
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] An application monitoring request to newrelic .com
7736
svchost.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
6852
msedge.exe
Potentially Bad Traffic
ET INFO PE EXE or DLL Windows file download HTTP
7648
MBSetup.exe
Potentially Bad Traffic
ET INFO PE EXE or DLL Windows file download HTTP
7648
MBSetup.exe
Misc activity
ET INFO EXE - Served Attached HTTP
7648
MBSetup.exe
Potentially Bad Traffic
ET INFO Executable served from Amazon S3
7648
MBSetup.exe
Misc activity
ET INFO Packed Executable Download
Process
Message
Malwarebytes.exe
Profiler was prevented from loading notification profiler due to app settings. Process ID (decimal): 5660. Message ID: [0x2509].
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.malwarebytes.com/mb-home