| File name: | MicrosoftEdgeSetup.exe |
| Full analysis: | https://app.any.run/tasks/1b1b5611-3964-497a-ba5b-e84f82c74710 |
| Verdict: | Malicious activity |
| Analysis date: | August 04, 2025, 19:08:47 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections |
| MD5: | 03ED8982FA50CE9ED1299643574D3F56 |
| SHA1: | F82273368FED243B022163F46CE691540912A5EF |
| SHA256: | 6F45DFF38AF2ED377519330827D5E17A49EA2431EBC0B903D1CF39823CA24BCF |
| SSDEEP: | 49152:cTNF/P/9XuHfzyQCik//T1s9FuUEbLmWCqrJqkXWr/2BjH2erPiQmmUm8eXVfxjm:cvVeHfzy9iC1srZO11ruKIol9XfbVZXa |
MALICIOUS
No malicious indicators.SUSPICIOUS
Process drops legitimate windows executable
- MicrosoftEdgeSetup.exe (PID: 3936)
- MicrosoftEdgeUpdate.exe (PID: 5528)
- MicrosoftEdgeUpdateSetup.exe (PID: 2972)
Creates file in the systems drive root
- MicrosoftEdgeSetup.exe (PID: 3936)
Disables SEHOP
- MicrosoftEdgeUpdate.exe (PID: 5528)
Starts a Microsoft application from unusual location
- MicrosoftEdgeUpdate.exe (PID: 5496)
- MicrosoftEdgeUpdateSetup.exe (PID: 2972)
- MicrosoftEdgeUpdate.exe (PID: 5528)
Reads security settings of Internet Explorer
- MicrosoftEdgeUpdate.exe (PID: 5496)
- MicrosoftEdgeUpdate.exe (PID: 5528)
Executable content was dropped or overwritten
- MicrosoftEdgeSetup.exe (PID: 3936)
- MicrosoftEdgeUpdateSetup.exe (PID: 2972)
INFO
The sample compiled with english language support
- MicrosoftEdgeSetup.exe (PID: 3936)
- MicrosoftEdgeUpdateSetup.exe (PID: 2972)
- MicrosoftEdgeUpdate.exe (PID: 5528)
Checks supported languages
- MicrosoftEdgeSetup.exe (PID: 3936)
- MicrosoftEdgeUpdate.exe (PID: 5496)
- MicrosoftEdgeUpdateSetup.exe (PID: 2972)
- MicrosoftEdgeUpdate.exe (PID: 5528)
Reads Environment values
- MicrosoftEdgeUpdate.exe (PID: 5528)
Create files in a temporary directory
- MicrosoftEdgeSetup.exe (PID: 3936)
Reads the computer name
- MicrosoftEdgeUpdate.exe (PID: 5496)
- MicrosoftEdgeUpdate.exe (PID: 5528)
Process checks computer location settings
- MicrosoftEdgeUpdate.exe (PID: 5496)
- MicrosoftEdgeUpdate.exe (PID: 5528)
Creates files in the program directory
- MicrosoftEdgeUpdateSetup.exe (PID: 2972)
Checks proxy server information
- MicrosoftEdgeUpdate.exe (PID: 5528)
- wermgr.exe (PID: 2228)
Reads the software policy settings
- MicrosoftEdgeUpdate.exe (PID: 5528)
- wermgr.exe (PID: 2228)
Creates files or folders in the user directory
- wermgr.exe (PID: 2228)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (76.4) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (12.4) |
| .exe | | | Generic Win/DOS Executable (5.5) |
| .exe | | | DOS Executable Generic (5.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2025:07:25 21:34:18+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14.31 |
| CodeSize: | 110592 |
| InitializedDataSize: | 1526272 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x83f0 |
| OSVersion: | 5.1 |
| ImageVersion: | - |
| SubsystemVersion: | 5.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.3.195.65 |
| ProductVersionNumber: | 1.3.195.65 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Windows NT 32-bit |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | Microsoft Corporation |
| FileDescription: | Microsoft Edge Update Setup |
| FileVersion: | 1.3.195.65 |
| InternalName: | Microsoft Edge Update Setup |
| LegalCopyright: | Copyright Microsoft Corporation |
| OriginalFileName: | MicrosoftEdgeUpdateSetup.exe |
| ProductName: | Microsoft Edge Update |
| ProductVersion: | 1.3.195.65 |
| UpstreamVersion: | 1.3.99.0 |
| LanguageId: | en |
Total processes
138
Monitored processes
6
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2228 | "C:\WINDOWS\system32\wermgr.exe" "-outproc" "0" "5528" "2208" "892" "2212" "0" "0" "0" "0" "0" "0" "0" "0" | C:\Windows\SysWOW64\wermgr.exe | MicrosoftEdgeUpdate.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Problem Reporting Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2972 | "C:\Users\admin\AppData\Local\Temp\EUC733.tmp\MicrosoftEdgeUpdateSetup.exe" /installsource taggedmi /install "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&lang=en&brand=M100" /installelevated /nomitag | C:\Users\admin\AppData\Local\Temp\EUC733.tmp\MicrosoftEdgeUpdateSetup.exe | MicrosoftEdgeUpdate.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Edge Update Setup Version: 1.3.195.65 Modules
| |||||||||||||||
| 3852 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3936 | "C:\MicrosoftEdgeSetup.exe" | C:\MicrosoftEdgeSetup.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Update Setup Version: 1.3.195.65 Modules
| |||||||||||||||
| 5496 | C:\Users\admin\AppData\Local\Temp\EUC733.tmp\MicrosoftEdgeUpdate.exe /installsource taggedmi /install "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&lang=en&brand=M100" | C:\Users\admin\AppData\Local\Temp\EUC733.tmp\MicrosoftEdgeUpdate.exe | — | MicrosoftEdgeSetup.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Update Version: 1.3.195.65 Modules
| |||||||||||||||
| 5528 | "C:\Program Files (x86)\Microsoft\Temp\EU4905.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}&appname=Microsoft%20Edge&needsadmin=prefers&lang=en&brand=M100" /installelevated | C:\Program Files (x86)\Microsoft\Temp\EU4905.tmp\MicrosoftEdgeUpdate.exe | MicrosoftEdgeUpdateSetup.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Edge Update Version: 1.3.195.65 Modules
| |||||||||||||||
Total events
4 175
Read events
4 165
Write events
8
Delete events
2
Modification events
| (PID) Process: | (5528) MicrosoftEdgeUpdate.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe |
| Operation: | write | Name: | DisableExceptionChainValidation |
Value: 0 | |||
| (PID) Process: | (5528) MicrosoftEdgeUpdate.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{13D67FED-AB29-40B0-A76A-01F361B536C1} |
| Operation: | write | Name: | PersistedPingString |
Value: <?xml version="1.0" encoding="UTF-8"?><request protocol="3.0" updater="Omaha" updaterversion="1.3.195.65" shell_version="1.3.147.37" ismachine="1" sessionid="{68BA32ED-C12B-443B-BE6D-C0D53958BD41}" userid="{FD984739-A122-4DB0-BE5B-46E3E09D84E4}" installsource="taggedmi" requestid="{13D67FED-AB29-40B0-A76A-01F361B536C1}" dedup="cr" domainjoined="0"><hw logical_cpus="4" physmemory="4" disk_type="2" sse="1" sse2="1" sse3="1" ssse3="1" sse41="1" sse42="1" avx="1"/><os platform="win" version="10.0.19045.4046" sp="" arch="x64" product_type="48" is_wip="0" is_in_lockdown_mode="0"/><oem product_manufacturer="DELL" product_name="DELL"/><exp etag=""r452t1+k2Tgq/HXzjvFNBRhopBWR9sbjXxqeUDH9uX0=""/><app appid="{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}" version="1.3.195.43" nextversion="1.3.195.65" lang="en" brand="M100" client=""><event eventtype="2" eventresult="1" errorcode="0" extracode1="0" system_uptime_ticks="16613011743" install_time_ms="281"/></app></request> | |||
| (PID) Process: | (5528) MicrosoftEdgeUpdate.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{13D67FED-AB29-40B0-A76A-01F361B536C1} |
| Operation: | write | Name: | PersistedPingTime |
Value: 133988081697188868 | |||
| (PID) Process: | (5528) MicrosoftEdgeUpdate.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\proxy |
| Operation: | write | Name: | source |
Value: auto | |||
| (PID) Process: | (5528) MicrosoftEdgeUpdate.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{13D67FED-AB29-40B0-A76A-01F361B536C1} |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (5528) MicrosoftEdgeUpdate.exe | Key: | \REGISTRY\A\{3f709c40-8c12-0460-511f-eb2dece8643a}\Root\InventoryApplicationFile |
| Operation: | write | Name: | WritePermissionsCheck |
Value: 1 | |||
| (PID) Process: | (5528) MicrosoftEdgeUpdate.exe | Key: | \REGISTRY\A\{3f709c40-8c12-0460-511f-eb2dece8643a}\Root\InventoryApplicationFile\PermissionsCheckTestKey |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (2228) wermgr.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData |
| Operation: | write | Name: | ClockTimeSeconds |
Value: 7205916800000000 | |||
| (PID) Process: | (2228) wermgr.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData |
| Operation: | write | Name: | TickCount |
Value: 127B190000000000 | |||
Executable files
300
Suspicious files
2
Text files
6
Unknown types
5
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3936 | MicrosoftEdgeSetup.exe | C:\Users\admin\AppData\Local\Temp\EUC733.tmp\MicrosoftEdgeComRegisterShellARM64.exe | executable | |
MD5:B9690BC05B42CDAF092162A50806264C | SHA256:FF577F4C29A184A37014992DE44549BD81DFF20997D8DEAF55DF509F3D33ED1C | |||
| 3936 | MicrosoftEdgeSetup.exe | C:\Users\admin\AppData\Local\Temp\EUC733.tmp\psuser_64.dll | executable | |
MD5:91CA1359EB017D7FCBAF696FCEFCD3EE | SHA256:09C1A044F1E8D96F2E1E44EF04932D7BF27A0B53A97C08F0A5E3AB0FE90F4894 | |||
| 3936 | MicrosoftEdgeSetup.exe | C:\Users\admin\AppData\Local\Temp\EUC733.tmp\psuser.dll | executable | |
MD5:79D1ED3F4DBDB5103E31018D691E9309 | SHA256:616DF08938F4D959081B8121CB66FBE05313E26AC776562421E574DB08C5D309 | |||
| 3936 | MicrosoftEdgeSetup.exe | C:\Users\admin\AppData\Local\Temp\EUC733.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe | executable | |
MD5:A0530FB9B74B7D1597FD8536393F32AC | SHA256:BA42D0AE2191EFA24A2C90B437D693FBF63C5FC333A85E36918740AA3B8D4EF0 | |||
| 3936 | MicrosoftEdgeSetup.exe | C:\Users\admin\AppData\Local\Temp\EUC733.tmp\msedgeupdate.dll | executable | |
MD5:FADF3B40EA0BE2351EA8CBE57D5116F8 | SHA256:E2C8B7BD5B0095F08E9A3C4142C81936B0946394E7CD0A83B8C171C44CAD3A1C | |||
| 3936 | MicrosoftEdgeSetup.exe | C:\Users\admin\AppData\Local\Temp\EUC733.tmp\psmachine_64.dll | executable | |
MD5:D7C9EA1F61311C995A54413C9BE43EEE | SHA256:775E6BA603AB85C03CF4A9FEA71581707B96C91E8B188574BAF3CC5B0371896C | |||
| 3936 | MicrosoftEdgeSetup.exe | C:\Users\admin\AppData\Local\Temp\EUC733.tmp\MicrosoftEdgeUpdateOnDemand.exe | executable | |
MD5:51A1EF4E52178EB3C1C094D12EF96EFC | SHA256:F12362BDB47D6D5DBF01EA9C2CD3104002034E03FF7D4E39EB77E16C875CEE34 | |||
| 3936 | MicrosoftEdgeSetup.exe | C:\Users\admin\AppData\Local\Temp\EUC733.tmp\psuser_arm64.dll | executable | |
MD5:4004A0CF7E0E15F50A2D8D37EBE0BDF4 | SHA256:D947D243C39E273AB8FF6F27EA4EBE4C86A3C1901900DD0518116CAE2C48F3F3 | |||
| 3936 | MicrosoftEdgeSetup.exe | C:\Users\admin\AppData\Local\Temp\EUC733.tmp\psmachine.dll | executable | |
MD5:EAD519174ECE77F205B731C834FA1254 | SHA256:1CC5C90531D6DE53BD1953F61ABABCFF1E925D4A86D1FEE2EB085E1C5AB1A308 | |||
| 3936 | MicrosoftEdgeSetup.exe | C:\Users\admin\AppData\Local\Temp\EUC733.tmp\psmachine_arm64.dll | executable | |
MD5:DF48414C12F739F526B01075B6B73A84 | SHA256:D1F11F6FE0132E3FC9475C66823BB39AB1571A306A94C518179D19861B20225F | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
17
DNS requests
10
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.53.40.178:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
2228 | wermgr.exe | GET | 200 | 23.211.125.77:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
2228 | wermgr.exe | GET | 200 | 23.210.66.94:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
5944 | MoUsoCoreWorker.exe | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 23.53.40.178:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
1268 | svchost.exe | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1268 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5944 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5528 | MicrosoftEdgeUpdate.exe | 150.171.22.17:443 | config.edge.skype.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
config.edge.skype.com |
| whitelisted |
watson.events.data.microsoft.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |