File name:

final_boss_flashing.bat

Full analysis: https://app.any.run/tasks/37ceb285-c3dc-45a7-9317-bc5a60b42770
Verdict: Malicious activity
Analysis date: May 25, 2025, 03:52:21
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
github
Indicators:
MIME: text/plain
File info: Unicode text, UTF-8 text
MD5:

30B1B4BA6ED4BE10104E72CACE1AD602

SHA1:

3DC7BA170270EF3C71ABC1DAFFB0923D6866DBB0

SHA256:

78BC09A949CB1F59E748893382E592BEA2378829D056538B2566F580B13A1B82

SSDEEP:

48:1+LZEsfhqF6slqsXpsNDC8JE1B+bVoJLmJF/TFRiugrL1s+D:1WZEsfMF63kpo3JygVfhoVrLD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • PowerShell delay command usage (probably sleep evasion)

      • powershell.exe (PID: 856)
      • powershell.exe (PID: 5668)
      • powershell.exe (PID: 9752)
      • powershell.exe (PID: 10020)
      • powershell.exe (PID: 10864)
      • powershell.exe (PID: 10760)
      • powershell.exe (PID: 10620)
      • powershell.exe (PID: 6148)
      • powershell.exe (PID: 11976)
      • powershell.exe (PID: 12100)
      • powershell.exe (PID: 9844)
      • powershell.exe (PID: 8804)
      • powershell.exe (PID: 10068)
      • powershell.exe (PID: 11916)
      • powershell.exe (PID: 5344)
      • powershell.exe (PID: 10800)

    • Application launched itself

      • cmd.exe (PID: 5588)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 5048)
      • cmd.exe (PID: 4736)
      • cmd.exe (PID: 644)
      • cmd.exe (PID: 2904)
      • cmd.exe (PID: 8656)
      • cmd.exe (PID: 10040)
      • cmd.exe (PID: 9520)
      • cmd.exe (PID: 6404)
      • cmd.exe (PID: 8332)
      • cmd.exe (PID: 11068)
      • cmd.exe (PID: 11092)
      • cmd.exe (PID: 11076)
      • cmd.exe (PID: 10592)
      • cmd.exe (PID: 11104)
      • cmd.exe (PID: 9104)
      • cmd.exe (PID: 11200)
      • cmd.exe (PID: 7324)
      • cmd.exe (PID: 5344)
      • cmd.exe (PID: 11084)
      • cmd.exe (PID: 9900)
      • cmd.exe (PID: 8820)
      • cmd.exe (PID: 11056)
      • cmd.exe (PID: 8616)
      • cmd.exe (PID: 7156)
      • cmd.exe (PID: 4740)
      • cmd.exe (PID: 5084)
      • cmd.exe (PID: 8820)
      • cmd.exe (PID: 8348)
      • cmd.exe (PID: 9096)
      • cmd.exe (PID: 11652)
      • cmd.exe (PID: 11428)
      • cmd.exe (PID: 6892)
      • cmd.exe (PID: 11108)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 5588)

    • Uses sleep to delay execution (POWERSHELL)

      • powershell.exe (PID: 856)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 5588)

    • Sets XML DOM element text (SCRIPT)

      • wordpad.exe (PID: 4688)

    • Reads security settings of Internet Explorer

      • wordpad.exe (PID: 4688)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 5588)

  • INFO

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 5156)
      • powershell.exe (PID: 856)
      • powershell.exe (PID: 1672)
      • powershell.exe (PID: 8100)
      • powershell.exe (PID: 8856)
      • powershell.exe (PID: 8216)

    • Reads security settings of Internet Explorer

      • OpenWith.exe (PID: 6404)
      • notepad.exe (PID: 7148)
      • calc.exe (PID: 920)
      • write.exe (PID: 1052)
      • calc.exe (PID: 8452)
      • write.exe (PID: 8480)
      • OpenWith.exe (PID: 8960)
      • notepad.exe (PID: 8664)

    • Application launched itself

      • msedge.exe (PID: 720)

    • Reads Environment values

      • wordpad.exe (PID: 4688)

    • Reads the computer name

      • wordpad.exe (PID: 4688)
      • wordpad.exe (PID: 8752)

    • Checks supported languages

      • wordpad.exe (PID: 4688)
      • wordpad.exe (PID: 8752)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
458
Monitored processes
326
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start cmd.exe no specs conhost.exe no specs notepad.exe no specs calc.exe no specs mspaint.exe no specs write.exe no specs wordpad.exe no specs openwith.exe no specs msedge.exe no specs msedge.exe cmd.exe no specs notepad.exe no specs conhost.exe no specs msg.exe no specs powershell.exe no specs timeout.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs powershell.exe no specs powershell.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs powershell.exe no specs powershell.exe no specs msedge.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs ping.exe no specs notepad.exe no specs calc.exe no specs mspaint.exe no specs write.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs notepad.exe no specs conhost.exe no specs msg.exe no specs msedge.exe no specs wordpad.exe no specs powershell.exe no specs openwith.exe no specs timeout.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs powershell.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs powershell.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs powershell.exe no specs msedge.exe no specs powershell.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs ping.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs notepad.exe no specs calc.exe no specs mspaint.exe no specs write.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs wordpad.exe no specs cmd.exe no specs conhost.exe no specs notepad.exe no specs msg.exe no specs msedge.exe no specs powershell.exe no specs openwith.exe no specs timeout.exe no specs msedge.exe no specs powershell.exe no specs powershell.exe no specs msedge.exe no specs powershell.exe no specs powershell.exe no specs msedge.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs msedge.exe no specs ping.exe no specs notepad.exe no specs calc.exe no specs mspaint.exe no specs write.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs notepad.exe no specs conhost.exe no specs msg.exe no specs msedge.exe no specs wordpad.exe no specs powershell.exe no specs openwith.exe no specs timeout.exe no specs powershell.exe no specs powershell.exe no specs msedge.exe no specs powershell.exe no specs msedge.exe no specs powershell.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs ping.exe no specs notepad.exe no specs calc.exe no specs mspaint.exe no specs write.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs wordpad.exe no specs cmd.exe no specs notepad.exe no specs conhost.exe no specs msedge.exe no specs msg.exe no specs powershell.exe no specs timeout.exe no specs openwith.exe no specs slui.exe powershell.exe no specs msedge.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs ping.exe no specs notepad.exe no specs calc.exe no specs mspaint.exe no specs write.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs wordpad.exe no specs msedge.exe no specs cmd.exe no specs notepad.exe no specs conhost.exe no specs msg.exe no specs openwith.exe no specs powershell.exe no specs timeout.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs msedge.exe no specs powershell.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs msedge.exe no specs ping.exe no specs notepad.exe no specs calc.exe no specs mspaint.exe no specs write.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs wordpad.exe no specs cmd.exe no specs conhost.exe no specs notepad.exe no specs msg.exe no specs openwith.exe no specs powershell.exe no specs timeout.exe no specs msedge.exe no specs powershell.exe no specs powershell.exe no specs msedge.exe no specs powershell.exe no specs powershell.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs msedge.exe no specs ping.exe no specs notepad.exe no specs calc.exe no specs mspaint.exe no specs write.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs notepad.exe no specs conhost.exe no specs msg.exe no specs wordpad.exe no specs msedge.exe no specs powershell.exe no specs openwith.exe no specs timeout.exe no specs powershell.exe no specs msedge.exe no specs powershell.exe no specs msedge.exe no specs powershell.exe no specs powershell.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs ping.exe no specs notepad.exe no specs calc.exe no specs mspaint.exe no specs write.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs notepad.exe no specs msg.exe no specs conhost.exe no specs wordpad.exe no specs powershell.exe no specs openwith.exe no specs timeout.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
644cmd /c "color a0 && title glitch && timeout /t 1 && exit"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
664"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://theuselessweb.com/C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
720"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://theuselessweb.com/C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
728powershell -command "(new-object -comobject wscript.shell).sendkeys('^{ALT}{LEFT}')"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
736"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4160 --field-trial-handle=2116,i,13776792840597591122,1815278602872673129,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
812\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
856powershell -command "for ($i=0; $i -lt 10; $i++) { $colors = '0c','1f','2a','3b','4e','5d','6c','7b','8a','9f'; $color = $colors[(Get-Random -Minimum 0 -Maximum $colors.Length)]; Write-Host ([char]27 + "[" + $color + "m") -NoNewline; Start-Sleep -Milliseconds 100 }"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
920calc C:\Windows\System32\calc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Calculator
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\calc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
968"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=7700 --field-trial-handle=2116,i,13776792840597591122,1815278602872673129,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1052write C:\Windows\System32\write.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Write
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\write.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
238 686
Read events
238 359
Write events
309
Delete events
18

Modification events

(PID) Process:(5588) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(5588) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5588) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5588) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3180) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3180) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3180) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(920) calc.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(920) calc.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(920) calc.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
14
Suspicious files
804
Text files
144
Unknown types
7

Dropped files

PID
Process
Filename
Type
720msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF10ce8d.TMP —
MD5:—
SHA256:—
720msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
720msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF10ce8d.TMP —
MD5:—
SHA256:—
720msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
720msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF10ce8d.TMP —
MD5:—
SHA256:—
720msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
720msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF10ce9c.TMP —
MD5:—
SHA256:—
720msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
720msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF10cebc.TMP —
MD5:—
SHA256:—
720msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
870
TCP/UDP connections
1 479
DNS requests
784
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
3.75.10.80:443
https://theuselessweb.com/
unknown
html
4.65 Kb
whitelisted
—
—
GET
200
172.217.23.110:443
https://www.youtube.com/watch?v=dQw4w9WgXcQ
unknown
html
1.25 Mb
whitelisted
—
—
GET
200
13.107.42.16:443
https://config.edge.skype.com/config/v1/Edge/122.0.2365.59?clientId=4489578223053569932&agents=EdgeFirstRun%2CEdgeFirstRunConfig&osname=win&client=edge&channel=stable&scpfre=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=44&mngd=0&installdate=1661339457&edu=0&bphint=2&soobedate=1504771245&fg=1
unknown
binary
768 b
whitelisted
—
—
GET
200
150.171.28.11:443
https://edge.microsoft.com/serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.19045&devicefamily=desktop&installdate=1661339457&clientversion=122.0.2365.59&experimentationmode=2&scpguard=0&scpfull=0&scpver=0
unknown
binary
431 b
whitelisted
—
—
GET
503
13.107.6.158:443
https://business.bing.com/work/api/v2/tenant/my/settingswithflights?&clienttype=edge-omnibox
unknown
html
13.7 Kb
whitelisted
—
—
GET
503
13.107.6.158:443
https://business.bing.com/api/v1/user/token/microsoftgraph?&clienttype=edge-omnibox
unknown
html
13.9 Kb
whitelisted
—
—
GET
200
13.107.246.45:443
https://edge-mobile-static.azureedge.net/eccp/get?settenant=edge-config&setplatform=win&setmkt=en-US&setchannel=stable
unknown
binary
16.0 Kb
whitelisted
—
—
GET
200
172.217.16.142:443
https://www.youtube.com/s/_/ytmainappweb/_/ss/k=ytmainappweb.kevlar_base.tDIaELTQ5hQ.L.B1.O/am=AAAQAIQC/d=0/br=1/rs=AGKMywEAEWsU_KIuK3qJeB5ij6eq5jeE2Q
unknown
text
2.52 Mb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2104
svchost.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
7480
msedge.exe
3.125.36.175:443
theuselessweb.com
AMAZON-02
DE
whitelisted
720
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
google.com
  • 142.250.185.238
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
  • 2.20.245.137
  • 2.20.245.139
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 2.23.246.101
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
theuselessweb.com
  • 3.125.36.175
  • 3.124.100.143
  • 3.75.10.80
whitelisted
www.youtube.com
  • 142.250.186.78
  • 142.250.186.110
  • 142.250.185.174
  • 142.250.184.206
  • 216.58.206.78
  • 142.250.186.174
  • 142.250.185.78
  • 142.250.186.46
  • 172.217.18.14
  • 142.250.185.142
  • 142.250.185.206
  • 172.217.18.110
  • 142.250.184.238
  • 142.250.185.110
  • 142.250.185.238
  • 142.250.186.142
  • 216.58.206.46
  • 172.217.16.206
  • 172.217.23.110
  • 216.58.212.142
  • 172.217.16.142
  • 142.250.181.238
whitelisted
edge.microsoft.com
  • 150.171.27.11
  • 150.171.28.11
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted

Threats

PID
Process
Class
Message
7480
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
7480
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
7480
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
7480
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
7480
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
7480
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
7480
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
7480
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
7480
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
7480
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
final_boss_flashing.bat