URL:

chrome.xznwx.cn

Full analysis: https://app.any.run/tasks/53db4453-fdff-43a0-bab7-b9541d1f788e
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: July 22, 2024, 00:51:13
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
Indicators:
MD5:

82D23E3F0490DB9FF0B65AD16C4FF447

SHA1:

436562D3E6D8D770199D6C701AA511138F0CB9BC

SHA256:

6141D2E3B4F9167CE3DCA674B8FB7597E3D0D2FC5214B5D43BE8F6578ACBA82B

SSDEEP:

3:XwGLn:Xn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • mini_installer.exe (PID: 6636)
      • setup.exe (PID: 4612)

    • Steals credentials from Web Browsers

      • JiSu.exe (PID: 8064)

    • Actions looks like stealing of personal data

      • JiSu.exe (PID: 8064)
      • JiSu.exe (PID: 8024)
      • JiSu.exe (PID: 5400)
      • JiSu.exe (PID: 3536)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • cookie_exporter.exe (PID: 7336)
      • setup.exe (PID: 6776)
      • JiSu.exe (PID: 8064)
      • JiSu.exe (PID: 6592)
      • JiSu.exe (PID: 796)
      • JiSu.exe (PID: 7764)
      • JiSu.exe (PID: 6636)
      • JiSu.exe (PID: 5940)

    • Creates file in the systems drive root

      • msedge.exe (PID: 6928)

    • Executable content was dropped or overwritten

      • mini_installer.exe (PID: 6636)
      • setup.exe (PID: 4612)

    • Application launched itself

      • setup.exe (PID: 4612)
      • setup.exe (PID: 6776)
      • JiSu.exe (PID: 8064)

    • Searches for installed software

      • setup.exe (PID: 4612)

    • Creates a software uninstall entry

      • setup.exe (PID: 4612)

    • Reads the date of Windows installation

      • setup.exe (PID: 6776)

    • Reads Mozilla Firefox installation path

      • JiSu.exe (PID: 8064)

    • Loads DLL from Mozilla Firefox

      • JiSu.exe (PID: 3536)

  • INFO

    • Reads the computer name

      • identity_helper.exe (PID: 6864)
      • cookie_exporter.exe (PID: 7336)
      • Setup.exe (PID: 5344)
      • mini_installer.exe (PID: 6636)
      • setup.exe (PID: 4612)
      • setup.exe (PID: 6776)
      • JiSu.exe (PID: 8064)
      • JiSu.exe (PID: 8156)
      • JiSu.exe (PID: 7216)
      • JiSu.exe (PID: 8024)
      • JiSu.exe (PID: 5400)
      • JiSu.exe (PID: 3536)
      • JiSu.exe (PID: 4360)
      • JiSu.exe (PID: 6592)
      • JiSu.exe (PID: 796)
      • JiSu.exe (PID: 7764)
      • JiSu.exe (PID: 6636)
      • JiSu.exe (PID: 5940)

    • Checks supported languages

      • cookie_exporter.exe (PID: 7336)
      • mini_installer.exe (PID: 6636)
      • Setup.exe (PID: 5344)
      • identity_helper.exe (PID: 6864)
      • setup.exe (PID: 4612)
      • setup.exe (PID: 4948)
      • setup.exe (PID: 6776)
      • setup.exe (PID: 5132)
      • JiSu.exe (PID: 1020)
      • JiSu.exe (PID: 8064)
      • JiSu.exe (PID: 1960)
      • JiSu.exe (PID: 7216)
      • JiSu.exe (PID: 8156)
      • JiSu.exe (PID: 6228)
      • JiSu.exe (PID: 7604)
      • JiSu.exe (PID: 3688)
      • JiSu.exe (PID: 5404)
      • JiSu.exe (PID: 3792)
      • JiSu.exe (PID: 684)
      • JiSu.exe (PID: 5728)
      • JiSu.exe (PID: 3024)
      • JiSu.exe (PID: 7428)
      • JiSu.exe (PID: 3552)
      • JiSu.exe (PID: 1964)
      • JiSu.exe (PID: 1940)
      • JiSu.exe (PID: 5044)
      • JiSu.exe (PID: 6160)
      • JiSu.exe (PID: 8024)
      • JiSu.exe (PID: 6636)
      • JiSu.exe (PID: 5400)
      • JiSu.exe (PID: 7832)
      • JiSu.exe (PID: 3536)
      • JiSu.exe (PID: 6492)
      • JiSu.exe (PID: 8160)
      • JiSu.exe (PID: 912)
      • JiSu.exe (PID: 4360)
      • JiSu.exe (PID: 7764)
      • JiSu.exe (PID: 7468)
      • JiSu.exe (PID: 796)
      • JiSu.exe (PID: 3400)
      • JiSu.exe (PID: 6704)
      • JiSu.exe (PID: 6592)
      • JiSu.exe (PID: 6872)
      • JiSu.exe (PID: 6636)
      • JiSu.exe (PID: 5124)
      • JiSu.exe (PID: 796)
      • JiSu.exe (PID: 5940)

    • Checks proxy server information

      • cookie_exporter.exe (PID: 7336)
      • JiSu.exe (PID: 8064)
      • JiSu.exe (PID: 796)
      • JiSu.exe (PID: 7764)
      • JiSu.exe (PID: 6592)
      • JiSu.exe (PID: 6636)
      • JiSu.exe (PID: 5940)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 6928)
      • msedge.exe (PID: 4164)

    • Drops the executable file immediately after the start

      • msedge.exe (PID: 6928)
      • msedge.exe (PID: 4164)

    • The process uses the downloaded file

      • msedge.exe (PID: 6928)
      • msedge.exe (PID: 6536)
      • JiSu.exe (PID: 796)
      • JiSu.exe (PID: 7764)
      • JiSu.exe (PID: 6592)
      • JiSu.exe (PID: 6636)
      • JiSu.exe (PID: 5940)

    • Create files in a temporary directory

      • Setup.exe (PID: 5344)
      • mini_installer.exe (PID: 6636)
      • JiSu.exe (PID: 8064)
      • JiSu.exe (PID: 3536)

    • Reads the machine GUID from the registry

      • Setup.exe (PID: 5344)
      • JiSu.exe (PID: 8064)

    • Reads Microsoft Office registry keys

      • msedge.exe (PID: 6928)
      • setup.exe (PID: 4612)
      • JiSu.exe (PID: 8064)

    • Application launched itself

      • msedge.exe (PID: 6928)

    • Creates files or folders in the user directory

      • setup.exe (PID: 4612)
      • setup.exe (PID: 4948)
      • JiSu.exe (PID: 8064)
      • setup.exe (PID: 6776)
      • JiSu.exe (PID: 7216)
      • JiSu.exe (PID: 796)
      • JiSu.exe (PID: 7764)
      • JiSu.exe (PID: 6636)
      • JiSu.exe (PID: 5940)
      • JiSu.exe (PID: 6592)

    • Process checks computer location settings

      • JiSu.exe (PID: 8064)
      • setup.exe (PID: 6776)
      • JiSu.exe (PID: 6228)
      • JiSu.exe (PID: 1020)
      • JiSu.exe (PID: 5728)
      • JiSu.exe (PID: 6160)
      • JiSu.exe (PID: 7832)
      • JiSu.exe (PID: 8160)
      • JiSu.exe (PID: 912)
      • JiSu.exe (PID: 7468)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
235
Monitored processes
93
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs cookie_exporter.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs setup.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs mini_installer.exe setup.exe setup.exe no specs msedge.exe no specs setup.exe no specs setup.exe no specs jisu.exe jisu.exe no specs jisu.exe no specs jisu.exe jisu.exe no specs jisu.exe no specs jisu.exe no specs jisu.exe no specs jisu.exe no specs jisu.exe no specs jisu.exe no specs jisu.exe no specs jisu.exe no specs jisu.exe no specs jisu.exe no specs jisu.exe no specs jisu.exe no specs jisu.exe no specs jisu.exe no specs jisu.exe no specs jisu.exe no specs jisu.exe jisu.exe no specs jisu.exe jisu.exe no specs jisu.exe jisu.exe no specs jisu.exe no specs jisu.exe no specs jisu.exe no specs jisu.exe no specs jisu.exe no specs jisu.exe no specs jisu.exe no specs jisu.exe no specs jisu.exe no specs jisu.exe no specs jisu.exe no specs jisu.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
684"C:\Users\admin\AppData\Local\JiSu\Application\JiSu.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=4256 --field-trial-handle=1984,i,14366959211995079557,13720204079524318409,262144 /prefetch:8C:\Users\admin\AppData\Local\JiSu\Application\JiSu.exe—JiSu.exe
User:
admin
Company:
Source Spacetime
Integrity Level:
LOW
Description:
极速浏览器
Exit code:
0
Version:
118.3.1.7
Modules
Images
c:\users\admin\appdata\local\jisu\application\jisu.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\jisu\application\118.3.1.7\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
796"C:\Users\admin\AppData\Local\JiSu\Application\JiSu.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3336 --field-trial-handle=1984,i,14366959211995079557,13720204079524318409,262144 /prefetch:8C:\Users\admin\AppData\Local\JiSu\Application\JiSu.exe—JiSu.exe
User:
admin
Company:
Source Spacetime
Integrity Level:
MEDIUM
Description:
极速浏览器
Exit code:
0
Version:
118.3.1.7
Modules
Images
c:\users\admin\appdata\local\jisu\application\jisu.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\jisu\application\118.3.1.7\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
796"C:\Users\admin\AppData\Local\JiSu\Application\JiSu.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=6152 --field-trial-handle=1984,i,14366959211995079557,13720204079524318409,262144 /prefetch:8C:\Users\admin\AppData\Local\JiSu\Application\JiSu.exe—JiSu.exe
User:
admin
Company:
Source Spacetime
Integrity Level:
LOW
Description:
极速浏览器
Exit code:
0
Version:
118.3.1.7
Modules
Images
c:\users\admin\appdata\local\jisu\application\jisu.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\jisu\application\118.3.1.7\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
912"C:\Users\admin\AppData\Local\JiSu\Application\JiSu.exe" --type=renderer --file-url-path-alias="/gen=C:\Users\admin\AppData\Local\JiSu\Application\gen" --disable-gpu-compositing --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=4268 --field-trial-handle=1984,i,14366959211995079557,13720204079524318409,262144 /prefetch:1C:\Users\admin\AppData\Local\JiSu\Application\JiSu.exe—JiSu.exe
User:
admin
Company:
Source Spacetime
Integrity Level:
LOW
Description:
极速浏览器
Version:
118.3.1.7
Modules
Images
c:\users\admin\appdata\local\jisu\application\jisu.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\jisu\application\118.3.1.7\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1020"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5732 --field-trial-handle=2420,i,9803541194855493231,6246670055831981944,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1020"C:\Users\admin\AppData\Local\JiSu\Application\JiSu.exe" --type=renderer --first-renderer-process --file-url-path-alias="/gen=C:\Users\admin\AppData\Local\JiSu\Application\gen" --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3064 --field-trial-handle=1984,i,14366959211995079557,13720204079524318409,262144 /prefetch:1C:\Users\admin\AppData\Local\JiSu\Application\JiSu.exe—JiSu.exe
User:
admin
Company:
Source Spacetime
Integrity Level:
LOW
Description:
极速浏览器
Version:
118.3.1.7
Modules
Images
c:\users\admin\appdata\local\jisu\application\jisu.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\jisu\application\118.3.1.7\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1164"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3856 --field-trial-handle=2420,i,9803541194855493231,6246670055831981944,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1928"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.3636 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=6608 --field-trial-handle=2420,i,9803541194855493231,6246670055831981944,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1940"C:\Users\admin\AppData\Local\JiSu\Application\JiSu.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-GB --service-sandbox-type=service --mojo-platform-channel-handle=5616 --field-trial-handle=1984,i,14366959211995079557,13720204079524318409,262144 /prefetch:8C:\Users\admin\AppData\Local\JiSu\Application\JiSu.exe—JiSu.exe
User:
admin
Company:
Source Spacetime
Integrity Level:
LOW
Description:
极速浏览器
Exit code:
0
Version:
118.3.1.7
Modules
Images
c:\users\admin\appdata\local\jisu\application\jisu.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\jisu\application\118.3.1.7\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1960C:\Users\admin\AppData\Local\JiSu\Application\JiSu.exe --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\JiSu\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\JiSu\User Data\Crashpad" --url=https://sync.yuanshikong.net/browser/c/crash --annotation=plat=Win64 --annotation=prod=极速浏览器 --annotation=ver=118.3.1.7-devel "--attachment=C:\Users\admin\AppData\Local\JiSu\User Data\browexe_shell.log" --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ffdb4b41770,0x7ffdb4b4177c,0x7ffdb4b41788C:\Users\admin\AppData\Local\JiSu\Application\JiSu.exe—JiSu.exe
User:
admin
Company:
Source Spacetime
Integrity Level:
MEDIUM
Description:
极速浏览器
Version:
118.3.1.7
Modules
Images
c:\users\admin\appdata\local\jisu\application\jisu.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\jisu\application\118.3.1.7\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\shcore.dll
c:\windows\system32\combase.dll
Total events
43 658
Read events
43 382
Write events
264
Delete events
12

Modification events

(PID) Process:(2648) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\UrlBlock
Operation:writeName:L1WatermarkLowPart
Value:
0
(PID) Process:(2648) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\UrlBlock
Operation:writeName:L1WatermarkHighPart
Value:
0
(PID) Process:(2648) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\UrlBlock
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
0
(PID) Process:(2648) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\UrlBlock
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
0
(PID) Process:(2648) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\UrlBlock
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(2648) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\UrlBlock
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31120337
(PID) Process:(2648) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2648) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2648) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2648) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
Executable files
10
Suspicious files
271
Text files
585
Unknown types
23

Dropped files

PID
Process
Filename
Type
6928msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-669DAD06-1B10.pma —
MD5:—
SHA256:—
6928msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF429902.TMP —
MD5:—
SHA256:—
6928msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
6928msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF429902.TMP —
MD5:—
SHA256:—
6928msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
6928msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF429912.TMP —
MD5:—
SHA256:—
6928msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
6928msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF429941.TMP —
MD5:—
SHA256:—
6928msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
6928msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF429902.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
26
TCP/UDP connections
189
DNS requests
160
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6856
svchost.exe
GET
206
217.20.56.37:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/07b2b28d-48a0-4636-b791-6e6129c8a3da?P1=1721976499&P2=404&P3=2&P4=I85ezmwmyD9IGm%2bjOrY0Z1sMITPLfUmgW%2bL9E1i2cJrL5dZ78twPCHWHAY9SLNvT3GId284Q8lbxZGtnuMzdbQ%3d%3d
unknown
—
—
whitelisted
6856
svchost.exe
GET
206
217.20.56.37:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/07b2b28d-48a0-4636-b791-6e6129c8a3da?P1=1721976499&P2=404&P3=2&P4=I85ezmwmyD9IGm%2bjOrY0Z1sMITPLfUmgW%2bL9E1i2cJrL5dZ78twPCHWHAY9SLNvT3GId284Q8lbxZGtnuMzdbQ%3d%3d
unknown
—
—
whitelisted
6856
svchost.exe
HEAD
200
217.20.56.37:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/da421fd3-a679-418c-8790-7cfcec77ad0a?P1=1722030003&P2=404&P3=2&P4=GY9cSJWdfxacn1TeDsrxPk0rz2Hd2l6zHzeIzNmblnA1MKv2PfEWFS%2bC80RqgaHeKUcuwdYfRNlFn04bS7XFOQ%3d%3d
unknown
—
—
whitelisted
6928
msedge.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEEj8k7RgVZSNNqfJionWlBY%3D
unknown
—
—
whitelisted
6928
msedge.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D
unknown
—
—
whitelisted
6928
msedge.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCEE2rNC2AT5i6r3HFeJWEejI%3D
unknown
—
—
whitelisted
6856
svchost.exe
HEAD
200
217.20.56.37:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/6e6d05a2-47e8-42b8-85a0-e8b7ee48333a?P1=1722033603&P2=404&P3=2&P4=aczqdSG4iNgk9fBhmJTzUAtp5dAX9342oiQMTNTPamOiwxT6qjiNVpiuL9gnPox95AvaThuZGqiyh6s9qHqMjQ%3d%3d
unknown
—
—
whitelisted
6856
svchost.exe
GET
206
217.20.56.37:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/6e6d05a2-47e8-42b8-85a0-e8b7ee48333a?P1=1722033603&P2=404&P3=2&P4=aczqdSG4iNgk9fBhmJTzUAtp5dAX9342oiQMTNTPamOiwxT6qjiNVpiuL9gnPox95AvaThuZGqiyh6s9qHqMjQ%3d%3d
unknown
—
—
whitelisted
6856
svchost.exe
GET
206
217.20.56.37:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/6e6d05a2-47e8-42b8-85a0-e8b7ee48333a?P1=1722033603&P2=404&P3=2&P4=aczqdSG4iNgk9fBhmJTzUAtp5dAX9342oiQMTNTPamOiwxT6qjiNVpiuL9gnPox95AvaThuZGqiyh6s9qHqMjQ%3d%3d
unknown
—
—
whitelisted
6856
svchost.exe
GET
206
217.20.56.37:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/6e6d05a2-47e8-42b8-85a0-e8b7ee48333a?P1=1722033603&P2=404&P3=2&P4=aczqdSG4iNgk9fBhmJTzUAtp5dAX9342oiQMTNTPamOiwxT6qjiNVpiuL9gnPox95AvaThuZGqiyh6s9qHqMjQ%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4716
svchost.exe
40.126.32.72:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
5620
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7856
svchost.exe
4.209.33.156:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
7544
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
40.113.110.67:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6928
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
4164
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4164
msedge.exe
204.79.197.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
login.live.com
  • 40.126.32.72
  • 20.190.160.17
  • 40.126.32.76
  • 40.126.32.134
  • 40.126.32.136
  • 40.126.32.74
  • 20.190.160.22
  • 40.126.32.68
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
google.com
  • 172.217.18.14
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
chrome.xznwx.cn
  • 43.152.26.209
  • 43.152.28.41
  • 43.152.26.154
  • 43.152.26.151
  • 43.152.26.80
  • 101.33.11.219
  • 43.152.28.43
  • 43.152.29.72
  • 43.152.26.221
  • 43.152.29.63
  • 101.33.11.246
  • 43.152.26.58
  • 43.152.26.142
  • 43.152.137.72
  • 43.152.29.77
unknown
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.42
whitelisted
bzib.nelreports.net
  • 2.19.126.152
  • 2.19.126.145
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
chrome.xznwx.cn