URL:

https://share.eu.internxt.com/d/sh/file/78818e7f-9839-47bd-a9a6-b6912e9ed4d7/8b2de6fd86893a8558482bdc8696e3531c84e4486b6e03ebf7351fa8860588d5

Full analysis: https://app.any.run/tasks/7157cad9-6c7f-4845-9971-33d37ed651c0
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: June 11, 2025, 19:55:21
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
generic
rat
asyncrat
remote
Indicators:
MD5:

14C93743416320243F22A4DF8196F8E9

SHA1:

F3927E32DB740085660AF7604C00886A08C63190

SHA256:

62730E6AA2BE06966263D807F520FF05D8972E9E99FC9FEFD56C7EFF71F9CCA6

SSDEEP:

3:N8ADAeMlY9IBKXSB93d16IBAH5U7KwRqQBRhTwHHDSEYdR6ddmn:2ADAeMlYq93d1j6UewEAhUHH7YdMMn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GENERIC has been found (auto)

      • .INFORMACION DIAN DETALLES.exe (PID: 1056)

    • Executing a file with an untrusted certificate

      • UltraInterfac32.exe (PID: 7052)

    • ASYNCRAT has been detected (SURICATA)

      • UltraInterfac32.exe (PID: 7052)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • .INFORMACION DIAN DETALLES.exe (PID: 1056)

    • Connects to unusual port

      • UltraInterfac32.exe (PID: 7052)

    • Contacting a server suspected of hosting an CnC

      • UltraInterfac32.exe (PID: 7052)

  • INFO

    • Application launched itself

      • msedge.exe (PID: 1296)

    • Launching a file from the Downloads directory

      • msedge.exe (PID: 1296)

    • Reads Environment values

      • identity_helper.exe (PID: 7480)

    • Checks supported languages

      • identity_helper.exe (PID: 7480)

    • Reads Microsoft Office registry keys

      • msedge.exe (PID: 1296)
      • OpenWith.exe (PID: 5780)

    • Reads the computer name

      • identity_helper.exe (PID: 7480)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2120)

    • The sample compiled with chinese language support

      • .INFORMACION DIAN DETALLES.exe (PID: 1056)

    • Reads security settings of Internet Explorer

      • OpenWith.exe (PID: 5780)

    • Manual execution by a user

      • .INFORMACION DIAN DETALLES.exe (PID: 1056)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
188
Monitored processes
48
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs winrar.exe msedge.exe no specs slui.exe rundll32.exe no specs openwith.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs #GENERIC .informacion dian detalles.exe #ASYNCRAT ultrainterfac32.exe msedge.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1028"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\admin\Downloads\Acta No2003265-9965 información exógena – DIAN.pdfC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—OpenWith.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1056"C:\Users\admin\Desktop\Acta información exógena – DIAN\.INFORMACION DIAN DETALLES.exe" C:\Users\admin\Desktop\Acta información exógena – DIAN\.INFORMACION DIAN DETALLES.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\acta información exógena – dian\.informacion dian detalles.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
1296"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://share.eu.internxt.com/d/sh/file/78818e7f-9839-47bd-a9a6-b6912e9ed4d7/8b2de6fd86893a8558482bdc8696e3531c84e4486b6e03ebf7351fa8860588d5"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1332"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=6204,i,10376271124342747657,14936850845175442998,262144 --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2120"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\Acta información exógena – DIAN.lzh"C:\Program Files\WinRAR\WinRAR.exe
msedge.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2348"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --field-trial-handle=7692,i,10376271124342747657,14936850845175442998,262144 --variations-seed-version --mojo-platform-channel-handle=7680 /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3740"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=8048,i,10376271124342747657,14936850845175442998,262144 --variations-seed-version --mojo-platform-channel-handle=8116 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3924"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --string-annotations --always-read-main-dll --field-trial-handle=7632,i,10376271124342747657,14936850845175442998,262144 --variations-seed-version --mojo-platform-channel-handle=7504 /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3964"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=2780,i,10376271124342747657,14936850845175442998,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
15 129
Read events
15 057
Write events
59
Delete events
13

Modification events

(PID) Process:(1296) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(1296) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(1296) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(1296) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(1296) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(1296) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(1296) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
11CD5A7AE7952F00
(PID) Process:(1296) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\459332
Operation:writeName:WindowTabManagerFileMappingId
Value:
{0532FA18-788D-443C-B783-D6C0229674DF}
(PID) Process:(1296) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\459332
Operation:writeName:WindowTabManagerFileMappingId
Value:
{066F4A1A-FF48-48BE-B1A2-510408724E83}
(PID) Process:(1296) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\459332
Operation:writeName:WindowTabManagerFileMappingId
Value:
{F8B46FF5-293B-4ED5-A1E5-46D51BC0A013}
Executable files
5
Suspicious files
276
Text files
64
Unknown types
38

Dropped files

PID
Process
Filename
Type
1296msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old~RF176457.TMP —
MD5:—
SHA256:—
1296msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old —
MD5:—
SHA256:—
1296msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF176467.TMP —
MD5:—
SHA256:—
1296msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
1296msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF176467.TMP —
MD5:—
SHA256:—
1296msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
1296msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF176486.TMP —
MD5:—
SHA256:—
1296msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
1296msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF176486.TMP —
MD5:—
SHA256:—
1296msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF1764a5.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
155
DNS requests
99
Threats
63

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6160
msedge.exe
GET
200
150.171.28.11:80
http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:rRPZ5DgdYnYTIXYO9PFsB02tNNMK2rWCGIEVvKsAGKg&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
3624
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2596
svchost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4708
svchost.exe
HEAD
200
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1750195134&P2=404&P3=2&P4=aiE1BHYRE53iLLKa3fUMvMiEiHdRIliYGLti3IH6N%2bWTGt5rjM70rx2p%2fnjQkKqDhgIMvMs5vd%2fX9XyzpGROBg%3d%3d
unknown
—
—
whitelisted
3624
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4708
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1750195134&P2=404&P3=2&P4=aiE1BHYRE53iLLKa3fUMvMiEiHdRIliYGLti3IH6N%2bWTGt5rjM70rx2p%2fnjQkKqDhgIMvMs5vd%2fX9XyzpGROBg%3d%3d
unknown
—
—
whitelisted
4708
svchost.exe
HEAD
200
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/4c4fdee0-d69c-42b7-bf5c-3ec046e9dfc9?P1=1750195135&P2=404&P3=2&P4=ODoO3d7qcNefAC%2byukAVSq99yf6iAoj4ao1saqqDChpfHqL4WNFUs0UJPnN6LWuDl9wTW6ZtzPiTDBixK6A5jQ%3d%3d
unknown
—
—
whitelisted
4708
svchost.exe
GET
200
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/4c4fdee0-d69c-42b7-bf5c-3ec046e9dfc9?P1=1750195135&P2=404&P3=2&P4=ODoO3d7qcNefAC%2byukAVSq99yf6iAoj4ao1saqqDChpfHqL4WNFUs0UJPnN6LWuDl9wTW6ZtzPiTDBixK6A5jQ%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2348
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6160
msedge.exe
150.171.28.11:80
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6160
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6160
msedge.exe
162.19.108.149:443
share.eu.internxt.com
OVH SAS
FR
suspicious
6160
msedge.exe
150.171.27.11:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6160
msedge.exe
13.107.21.237:443
copilot.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
google.com
  • 142.250.185.206
whitelisted
edge.microsoft.com
  • 150.171.28.11
  • 150.171.27.11
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
share.eu.internxt.com
  • 162.19.108.149
unknown
copilot.microsoft.com
  • 13.107.21.237
  • 204.79.197.237
whitelisted
www.googletagmanager.com
  • 172.217.18.8
whitelisted
www.bing.com
  • 92.123.104.30
  • 92.123.104.22
  • 92.123.104.26
  • 92.123.104.18
  • 92.123.104.29
  • 92.123.104.31
  • 92.123.104.33
  • 92.123.104.34
  • 92.123.104.17
  • 2.19.96.50
  • 2.19.96.49
  • 2.19.96.106
  • 2.19.96.104
  • 2.19.96.88
  • 2.19.96.34
  • 2.19.96.123
  • 2.19.96.42
  • 2.19.96.8
whitelisted
share.internxt.com
  • 162.19.108.149
unknown
s3.us-east-1.wasabisys.com
  • 38.27.106.120
  • 38.27.106.100
  • 38.27.106.117
  • 38.27.106.119
  • 38.27.106.121
  • 38.27.106.102
  • 38.27.106.124
  • 38.27.106.108
  • 38.27.106.106
  • 38.27.106.101
  • 38.27.106.118
  • 38.27.106.104
  • 38.27.106.126
  • 38.27.106.109
  • 38.27.106.107
  • 38.27.106.125
  • 38.27.106.123
  • 38.27.106.103
  • 38.27.106.122
  • 38.27.106.105
whitelisted

Threats

PID
Process
Class
Message
6160
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
6160
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
6160
msedge.exe
Misc activity
ET FILE_SHARING Commonly Abused File Sharing Domain (wasabisys .com) in DNS Lookup
6160
msedge.exe
Misc activity
ET FILE_SHARING Commonly Abused File Sharing Domain (wasabisys .com) in DNS Lookup
6160
msedge.exe
Misc activity
ET FILE_SHARING Commonly Abused File Sharing Domain (wasabisys .com) in TLS SNI
6160
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
6160
msedge.exe
Misc activity
ET FILE_SHARING Commonly Abused File Sharing Domain (wasabisys .com) in DNS Lookup
6160
msedge.exe
Misc activity
ET FILE_SHARING Commonly Abused File Sharing Domain (wasabisys .com) in DNS Lookup
6160
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
6160
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] An application monitoring request to newrelic .com
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://share.eu.internxt.com/d/sh/file/78818e7f-9839-47bd-a9a6-b6912e9ed4d7/8b2de6fd86893a8558482bdc8696e3531c84e4486b6e03ebf7351fa8860588d5