URL:

https://abbaspc.net/ms-office-2019-crack-free-download/

Full analysis: https://app.any.run/tasks/1d1c31c9-79f0-495b-82f2-9d096153b118
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: August 16, 2024, 07:45:29
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
lumma
stealer
netreactor
crypto-regex
amadey
botnet
Indicators:
MD5:

432ED7D1414A53A80383D5D82E81A613

SHA1:

1B055DDF7412515764DBB9C1AA9633358535F552

SHA256:

73AEE9BE710080AC8253762FB31A8632ABB3495776F3A2793ADEDFF5E1ECAC0E

SSDEEP:

3:N8lLAsjFVUcIGLAzFmn:2RAZcIfM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • Setup.exe (PID: 5472)

    • LUMMA has been detected (SURICATA)

      • Setup.exe (PID: 5472)

    • LUMMA has been detected (YARA)

      • Setup.exe (PID: 5472)

    • Stealers network behavior

      • Setup.exe (PID: 5472)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 4780)

    • Probably downloads file via BitsAdmin (POWERSHELL)

      • powershell.exe (PID: 4780)

    • Changes powershell execution policy (Bypass)

      • Setup.exe (PID: 5472)

    • AMADEY has been detected (SURICATA)

      • explorer.exe (PID: 6776)

    • AMADEY has been detected (YARA)

      • explorer.exe (PID: 6776)

    • Connects to the CnC server

      • explorer.exe (PID: 6776)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 188)
      • ShellExperienceHost.exe (PID: 3144)

    • Application launched itself

      • WinRAR.exe (PID: 188)

    • Potential Corporate Privacy Violation

      • msedge.exe (PID: 6676)

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 5140)

    • Searches for installed software

      • Setup.exe (PID: 5472)

    • Starts a Microsoft application from unusual location

      • W27MQ24SHFJA686ZGR7HQ.exe (PID: 2648)

    • Executable content was dropped or overwritten

      • Setup.exe (PID: 5472)

    • The process executes Powershell scripts

      • Setup.exe (PID: 5472)

    • Starts POWERSHELL.EXE for commands execution

      • Setup.exe (PID: 5472)

    • Starts application with an unusual extension

      • ETIE3KYANWI70M6UM5WWEATI.exe (PID: 2872)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 4780)

    • Extracts files to a directory (POWERSHELL)

      • powershell.exe (PID: 4780)

    • Drops the executable file immediately after the start

      • Setup.exe (PID: 5472)

    • Found regular expressions for crypto-addresses (YARA)

      • MSBuild.exe (PID: 5904)

    • Connects to unusual port

      • MSBuild.exe (PID: 5904)

    • Contacting a server suspected of hosting an CnC

      • explorer.exe (PID: 6776)

  • INFO

    • Reads Microsoft Office registry keys

      • msedge.exe (PID: 6356)

    • Checks supported languages

      • identity_helper.exe (PID: 6256)
      • W27MQ24SHFJA686ZGR7HQ.exe (PID: 2648)
      • ShellExperienceHost.exe (PID: 3144)
      • Setup.exe (PID: 5472)
      • more.com (PID: 7404)
      • ETIE3KYANWI70M6UM5WWEATI.exe (PID: 2872)
      • MSBuild.exe (PID: 5904)

    • Reads the computer name

      • identity_helper.exe (PID: 6256)
      • ShellExperienceHost.exe (PID: 3144)
      • Setup.exe (PID: 5472)
      • ETIE3KYANWI70M6UM5WWEATI.exe (PID: 2872)
      • W27MQ24SHFJA686ZGR7HQ.exe (PID: 2648)
      • more.com (PID: 7404)

    • Reads Environment values

      • identity_helper.exe (PID: 6256)

    • The process uses the downloaded file

      • msedge.exe (PID: 3700)
      • WinRAR.exe (PID: 188)
      • msedge.exe (PID: 6356)

    • Manual execution by a user

      • WinRAR.exe (PID: 188)
      • Setup.exe (PID: 5472)
      • MSBuild.exe (PID: 5904)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5140)

    • Create files in a temporary directory

      • Setup.exe (PID: 5472)
      • ETIE3KYANWI70M6UM5WWEATI.exe (PID: 2872)
      • MSBuild.exe (PID: 5904)
      • more.com (PID: 7404)

    • Application launched itself

      • msedge.exe (PID: 6356)

    • Reads the software policy settings

      • Setup.exe (PID: 5472)

    • Reads the machine GUID from the registry

      • W27MQ24SHFJA686ZGR7HQ.exe (PID: 2648)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 4780)

    • .NET Reactor protector has been detected

      • W27MQ24SHFJA686ZGR7HQ.exe (PID: 2648)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 4780)

    • Checks proxy server information

      • explorer.exe (PID: 6776)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 6776)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Lumma

(PID) Process(5472) Setup.exe
C2 (9)consciousourwi.shop
southedhiscuso.shop
interactiedovspm.shop
weiggheticulop.shop
cagedwifedsozm.shop
charecteristicdxp.shop
deicedosmzj.shop
refrigaterpsm.shop
potentioallykeos.shop

Amadey

(PID) Process(6776) explorer.exe
C2simple-updatereport.com
Strings (123)ESET
|
zip
CurrentBuild
&& Exit"
Kaspersky Lab
<c>
vs:
abcdefghijklmnopqrstuvwxyz0123456789-_
\0000
\
id:
cred.dll
dm:
shutdown -s -t 0
------
Content-Type: multipart/form-data; boundary=----
360TotalSecurity
/Plugins/
+++
Programs
rundll32.exe
S-%lu-
cred.dll|clip.dll|
Startup
%-lu
=
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
WinDefender
Comodo
3e8f85f577
Bitdefender
ComputerName
kernel32.dll
cmd /C RMDIR /s/q
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
shell32.dll
/k
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Norton
/h9fmdW6/index.php
ProgramData\
av:
Content-Disposition: form-data; name="data"; filename="
os:
/quiet
bi:
:::
pc:
-unicode-
clip.dll
%USERPROFILE%
2019
POST
" && timeout 1 && del
ar:
cmd
"
?scr=1
&&
exe
Rem
&unit=
sd:
e1
wb
4.41
simple-updatereport.com
http://
r=
random
rb
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
og:
Hkbsse.exe
Doctor Web
/h9fmdW7/index.php
-executionpolicy remotesigned -File "
-%lu
d1
simple-updatereport2.com
#
Sophos
------
" Content-Type: application/octet-stream
un:
.jpg
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
"taskkill /f /im "
AVAST Software
simple-updatereport3.com
msi
lv:
0123456789
st=s
GET
AVG
ProductName
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
\App
Avira
/h9fmdW5/index.php
<d>
SOFTWARE\Microsoft\Windows NT\CurrentVersion
Content-Type: application/x-www-form-urlencoded
DefaultSettings.YResolution
Powershell.exe
e0
https://
Panda Security
2022
2016
e2
dll
" && ren
--
SYSTEM\ControlSet001\Services\BasicDisplay\Video
rundll32
DefaultSettings.XResolution
VideoID
ps1
GetNativeSystemInfo
Main
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
216
Monitored processes
73
Malicious processes
10
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs winrar.exe no specs winrar.exe no specs winrar.exe no specs rundll32.exe no specs winrar.exe no specs winrar.exe no specs winrar.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs shellexperiencehost.exe no specs systemsettingsbroker.exe no specs msedge.exe no specs #LUMMA setup.exe msedge.exe THREAT w27mq24shfja686zgr7hq.exe no specs etie3kyanwi70m6um5wweati.exe no specs powershell.exe no specs conhost.exe no specs more.com no specs conhost.exe no specs msedge.exe no specs THREAT msbuild.exe #AMADEY explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
188"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --mojo-platform-channel-handle=5268 --field-trial-handle=2236,i,9308199392633923939,17924433260332675173,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
188"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\✪➳OPeN~S͜͡eTUP!・2028・!P͜@$w0rD$~FiLe.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
812C:\Windows\System32\SystemSettingsBroker.exe -EmbeddingC:\Windows\System32\SystemSettingsBroker.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
System Settings Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\systemsettingsbroker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
1060"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=1484 --field-trial-handle=2236,i,9308199392633923939,17924433260332675173,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1116"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=1504 --field-trial-handle=2236,i,9308199392633923939,17924433260332675173,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1680"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5448 --field-trial-handle=2236,i,9308199392633923939,17924433260332675173,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1716"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5972 --field-trial-handle=2236,i,9308199392633923939,17924433260332675173,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2128"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5704 --field-trial-handle=2236,i,9308199392633923939,17924433260332675173,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2128"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6216 --field-trial-handle=2236,i,9308199392633923939,17924433260332675173,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2132"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7904 --field-trial-handle=2236,i,9308199392633923939,17924433260332675173,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
54 539
Read events
54 253
Write events
283
Delete events
3

Modification events

(PID) Process:(6356) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6356) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6356) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(6356) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(6356) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(6356) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:dr
Value:
1
(PID) Process:(6356) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(6356) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge
Operation:writeName:UsageStatsInSample
Value:
1
(PID) Process:(6356) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:usagestats
Value:
0
(PID) Process:(6356) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:urlstats
Value:
0
Executable files
29
Suspicious files
325
Text files
147
Unknown types
6

Dropped files

PID
Process
Filename
Type
6356msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RFe532c.TMP —
MD5:—
SHA256:—
6356msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RFe532c.TMP —
MD5:—
SHA256:—
6356msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
6356msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RFe533c.TMP —
MD5:—
SHA256:—
6356msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RFe533c.TMP —
MD5:—
SHA256:—
6356msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
6356msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
6356msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
6356msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RFe535b.TMP —
MD5:—
SHA256:—
6356msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
33
TCP/UDP connections
155
DNS requests
143
Threats
55

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4436
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7508
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5980
svchost.exe
HEAD
200
152.199.19.161:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/e3669989-c3d2-49f0-b6af-dc12ba8062e1?P1=1724331362&P2=404&P3=2&P4=V00aQCNf%2bjeWt5vhw%2f92UFQUQP51HghEntYhoVJ0%2bAU87wM%2fH%2bRcLQy7dSvbh%2b62EfzecYC4T8Dn3F1%2f7EUc0Q%3d%3d
unknown
—
—
whitelisted
7484
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5980
svchost.exe
GET
206
152.199.19.161:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/e3669989-c3d2-49f0-b6af-dc12ba8062e1?P1=1724331362&P2=404&P3=2&P4=V00aQCNf%2bjeWt5vhw%2f92UFQUQP51HghEntYhoVJ0%2bAU87wM%2fH%2bRcLQy7dSvbh%2b62EfzecYC4T8Dn3F1%2f7EUc0Q%3d%3d
unknown
—
—
whitelisted
5980
svchost.exe
GET
206
152.199.19.161:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/e3669989-c3d2-49f0-b6af-dc12ba8062e1?P1=1724331362&P2=404&P3=2&P4=V00aQCNf%2bjeWt5vhw%2f92UFQUQP51HghEntYhoVJ0%2bAU87wM%2fH%2bRcLQy7dSvbh%2b62EfzecYC4T8Dn3F1%2f7EUc0Q%3d%3d
unknown
—
—
whitelisted
5980
svchost.exe
GET
206
152.199.19.161:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/e3669989-c3d2-49f0-b6af-dc12ba8062e1?P1=1724331362&P2=404&P3=2&P4=V00aQCNf%2bjeWt5vhw%2f92UFQUQP51HghEntYhoVJ0%2bAU87wM%2fH%2bRcLQy7dSvbh%2b62EfzecYC4T8Dn3F1%2f7EUc0Q%3d%3d
unknown
—
—
whitelisted
5980
svchost.exe
GET
206
152.199.19.161:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/e3669989-c3d2-49f0-b6af-dc12ba8062e1?P1=1724331362&P2=404&P3=2&P4=V00aQCNf%2bjeWt5vhw%2f92UFQUQP51HghEntYhoVJ0%2bAU87wM%2fH%2bRcLQy7dSvbh%2b62EfzecYC4T8Dn3F1%2f7EUc0Q%3d%3d
unknown
—
—
whitelisted
5980
svchost.exe
GET
206
152.199.19.161:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/3b6aa6cb-e9f5-4799-9d73-5c5c48582465?P1=1724313857&P2=404&P3=2&P4=YNXjd7KHQehrtrbndHBp4ZtzUWHNAj4RcMjyQKNSCDXI2l%2bE2f5tA2Rw%2baNS5hqD5ieO63CB4KapnGIgyi5ZaQ%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
692
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1060
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6356
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
6676
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6676
msedge.exe
13.107.21.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
6676
msedge.exe
13.107.246.45:443
edge-mobile-static.azureedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
6676
msedge.exe
172.67.69.237:443
abbaspc.net
CLOUDFLARENET
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
google.com
  • 142.250.184.238
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
whitelisted
abbaspc.net
  • 172.67.69.237
  • 104.26.14.242
  • 104.26.15.242
unknown
edge-mobile-static.azureedge.net
  • 13.107.246.45
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
bzib.nelreports.net
  • 23.48.23.46
  • 23.48.23.26
whitelisted
www.bing.com
  • 104.126.37.178
  • 104.126.37.130
  • 104.126.37.177
  • 104.126.37.128
  • 104.126.37.161
  • 104.126.37.170
  • 104.126.37.179
  • 104.126.37.171
  • 104.126.37.162
  • 104.126.37.131
  • 104.126.37.139
  • 104.126.37.160
  • 104.126.37.186
  • 104.126.37.163
  • 2.23.209.133
  • 2.23.209.189
  • 2.23.209.191
  • 2.23.209.182
  • 2.23.209.186
  • 2.23.209.178
  • 2.23.209.179
  • 2.23.209.185
  • 2.23.209.181
whitelisted
stats.wp.com
  • 192.0.76.3
whitelisted

Threats

PID
Process
Class
Message
6676
msedge.exe
Potential Corporate Privacy Violation
ET INFO Browser Automation Toolkit in DNS Lookup (bablosoft .com)
6676
msedge.exe
Potential Corporate Privacy Violation
ET INFO Fingerprinting Service in DNS Lookup (customfingerprints .bablosoft .com)
6676
msedge.exe
Potential Corporate Privacy Violation
ET INFO Browser Automation Toolkit in DNS Lookup (bablosoft .com)
6676
msedge.exe
Potential Corporate Privacy Violation
ET INFO Fingerprinting Service in DNS Lookup (customfingerprints .bablosoft .com)
6676
msedge.exe
Potential Corporate Privacy Violation
ET INFO Browser Automation Toolkit in TLS SNI (bablosoft .com)
6676
msedge.exe
Potential Corporate Privacy Violation
ET INFO Fingerprinting Service in TLS SNI (customfingerprints .bablosoft .com)
6676
msedge.exe
Potential Corporate Privacy Violation
ET INFO Browser Automation Toolkit in DNS Lookup (bablosoft .com)
6676
msedge.exe
Potential Corporate Privacy Violation
ET INFO Browser Automation Toolkit in DNS Lookup (bablosoft .com)
6676
msedge.exe
Potential Corporate Privacy Violation
ET INFO Fingerprinting Service in DNS Lookup (customfingerprints .bablosoft .com)
6676
msedge.exe
Potential Corporate Privacy Violation
ET INFO Browser Automation Toolkit in TLS SNI (bablosoft .com)
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://abbaspc.net/ms-office-2019-crack-free-download/