File name:

https://bitly.ws/?redirect=b4c7

Full analysis: https://app.any.run/tasks/6f1b49b4-1f1d-440c-ba83-e12f0939f388
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: November 07, 2023, 22:22:23
OS: Windows 8.1 Professional (build: 9600, 32 bit)
Tags:
loader
Indicators:
MIME: text/plain
File info: ASCII text, with CRLF line terminators
MD5:

81051BCC2CF1BEDF378224B0A93E2877

SHA1:

BA8AB5A0280B953AA97435FF8946CBCBB2755A27

SHA256:

7EB70257593DA06F682A3DDDA54A9D260D4FC514F645237F5CA74B08F8DA61A6

SSDEEP:

3:y:y

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts Visual C# compiler

      • sdiagnhost.exe (PID: 168)

    • Drops the executable file immediately after the start

      • MicrosoftEdgeUpdateSetup_X86_1.3.181.5.exe (PID: 2740)
      • csc.exe (PID: 588)
      • csc.exe (PID: 2776)
      • csc.exe (PID: 896)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • MicrosoftEdgeUpdate.exe (PID: 3936)
      • MicrosoftEdgeUpdate.exe (PID: 2924)
      • msdt.exe (PID: 1780)
      • MicrosoftEdgeUpdateSetup_X86_1.3.181.5.exe (PID: 2740)

    • Executes as Windows Service

      • MicrosoftEdgeUpdate.exe (PID: 3936)
      • MicrosoftEdgeUpdate.exe (PID: 3192)

    • Checks Windows Trust Settings

      • MicrosoftEdgeUpdate.exe (PID: 3936)
      • MicrosoftEdgeUpdate.exe (PID: 1668)
      • MicrosoftEdgeUpdate.exe (PID: 1448)

    • Application launched itself

      • MicrosoftEdgeUpdate.exe (PID: 3936)

    • Disables SEHOP

      • MicrosoftEdgeUpdate.exe (PID: 2924)

    • Creates a software uninstall entry

      • MicrosoftEdgeUpdate.exe (PID: 2924)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdate.exe (PID: 3816)

    • Reads settings of System Certificates

      • msdt.exe (PID: 1780)

    • Reads the Internet Settings

      • sdiagnhost.exe (PID: 168)
      • rundll32.exe (PID: 2444)
      • msdt.exe (PID: 1780)

    • Uses .NET C# to load dll

      • sdiagnhost.exe (PID: 168)

    • Probably uses Microsoft diagnostics tool to execute malicious payload

      • pcwrun.exe (PID: 2912)

    • Uses RUNDLL32.EXE to load library

      • msdt.exe (PID: 1780)
      • csrstub.exe (PID: 2752)

    • The process executes via Task Scheduler

      • MicrosoftEdgeUpdate.exe (PID: 3000)

  • INFO

    • Checks supported languages

      • MicrosoftEdgeUpdate.exe (PID: 3936)
      • MicrosoftEdgeUpdateSetup_X86_1.3.181.5.exe (PID: 2740)
      • MicrosoftEdgeUpdate.exe (PID: 1448)
      • MicrosoftEdgeUpdate.exe (PID: 2924)
      • MicrosoftEdgeUpdate.exe (PID: 1380)
      • MicrosoftEdgeUpdate.exe (PID: 3816)
      • MicrosoftEdgeUpdate.exe (PID: 1668)
      • csc.exe (PID: 588)
      • csc.exe (PID: 2776)
      • cvtres.exe (PID: 1720)
      • cvtres.exe (PID: 2496)
      • csc.exe (PID: 896)
      • cvtres.exe (PID: 3604)
      • MicrosoftEdgeUpdate.exe (PID: 3000)
      • MicrosoftEdgeUpdate.exe (PID: 3192)

    • Reads the computer name

      • MicrosoftEdgeUpdate.exe (PID: 3936)
      • MicrosoftEdgeUpdate.exe (PID: 1448)
      • MicrosoftEdgeUpdate.exe (PID: 2924)
      • MicrosoftEdgeUpdate.exe (PID: 1380)
      • MicrosoftEdgeUpdate.exe (PID: 1668)
      • MicrosoftEdgeUpdate.exe (PID: 3816)
      • MicrosoftEdgeUpdate.exe (PID: 3000)
      • MicrosoftEdgeUpdate.exe (PID: 3192)

    • Reads the software policy settings

      • MicrosoftEdgeUpdate.exe (PID: 3936)
      • MicrosoftEdgeUpdate.exe (PID: 1668)
      • msdt.exe (PID: 1780)
      • MicrosoftEdgeUpdate.exe (PID: 3192)
      • MicrosoftEdgeUpdate.exe (PID: 1448)

    • Manual execution by a user

      • rundll32.exe (PID: 1296)
      • pcwrun.exe (PID: 2912)

    • Create files in a temporary directory

      • MicrosoftEdgeUpdate.exe (PID: 3936)
      • pcwrun.exe (PID: 2912)
      • msdt.exe (PID: 1780)
      • sdiagnhost.exe (PID: 168)
      • csc.exe (PID: 588)
      • cvtres.exe (PID: 3604)
      • cvtres.exe (PID: 1720)
      • csc.exe (PID: 2776)
      • cvtres.exe (PID: 2496)
      • csc.exe (PID: 896)

    • Creates files in the program directory

      • MicrosoftEdgeUpdateSetup_X86_1.3.181.5.exe (PID: 2740)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 1448)
      • MicrosoftEdgeUpdate.exe (PID: 1668)

    • Reads security settings of Internet Explorer

      • msdt.exe (PID: 1780)
      • sdiagnhost.exe (PID: 168)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 588)
      • csc.exe (PID: 2776)
      • cvtres.exe (PID: 1720)
      • csc.exe (PID: 896)
      • cvtres.exe (PID: 3604)
      • cvtres.exe (PID: 2496)

    • Drops the executable file immediately after the start

      • msdt.exe (PID: 1780)

    • Checks proxy server information

      • sdiagnhost.exe (PID: 168)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
74
Monitored processes
29
Malicious processes
5
Suspicious processes
4

Behavior graph

Click at the process to see the details
start rundll32.exe openwith.exe no specs microsoftedgeupdate.exe rundll32.exe no specs fondue.exe no specs tiworker.exe no specs microsoftedgeupdatesetup_x86_1.3.181.5.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdate.exe pcwrun.exe no specs msdt.exe no specs sdiagnhost.exe conhost.exe no specs csc.exe no specs cvtres.exe no specs csc.exe no specs cvtres.exe no specs csc.exe no specs cvtres.exe no specs rundll32.exe conhost.exe no specs csrstub.exe fondue.exe no specs rundll32.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdate.exe

Process information

PID
CMD
Path
Indicators
Parent process
168C:\Windows\System32\sdiagnhost.exe -EmbeddingC:\Windows\System32\sdiagnhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Scripted Diagnostics Native Host
Exit code:
0
Version:
6.3.9600.16384 (winblue_rtm.130821-1623)
Modules
Images
c:\windows\system32\sdiagnhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\combase.dll
588"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\tnxrwule.cmdline"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe—sdiagnhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.7.2053.0 built by: NET47REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcr120_clr0400.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\user32.dll
692\??\C:\Windows\system32\conhost.exe 0xffffffffC:\Windows\System32\conhost.exe—sdiagnhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
6.3.9600.16384 (winblue_rtm.130821-1623)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\combase.dll
896"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\sjqpm01k.cmdline"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe—sdiagnhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.7.2053.0 built by: NET47REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcr120_clr0400.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\user32.dll
1296C:\Windows\system32\RunDll32.exe shell32.dll,Control_RunDLL ntvdmcpl.dll,,/originalapp:"C:\Users\admin\Desktop\openwith.exe"C:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.3.9600.16384 (winblue_rtm.130821-1623)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\combase.dll
c:\windows\system32\gdi32.dll
1380"C:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvcC:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.175.29
Modules
Images
c:\program files\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\combase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
1448"C:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzcuMTEiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzUuMjkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NTFFNEE4Q0MtMDYzNC00MDJELUI0NkMtRUZBNEZDODkyMjUwfSIgdXNlcmlkPSJ7OUJGNUU4QkMtMUU5MS00NjMxLTk4QTktQzQwOTRCRTkyMDI1fSIgaW5zdGFsbHNvdXJjZT0iY29yZSIgcmVxdWVzdGlkPSJ7RUIxNkEzQzItMEM1Ri00NTBBLTkzQ0ItRjM4MUU2QjAxQTgyfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjQiIHBoeXNtZW1vcnk9IjMiIGRpc2tfdHlwZT0iMCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4zLjk2MDAuMTg3NzgiIHNwPSIiIGFyY2g9Ing4NiIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREVMTCIgcHJvZHVjdF9uYW1lPSJERUxMIi8-PGV4cCBldGFnPSIiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE3Ny4xMSIgbmV4dHZlcnNpb249IjEuMy4xODEuNSIgbGFuZz0iIiBicmFuZD0iTTEwMCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSIyMjEiIGluc3RhbGxkYXRlPSI1OTI5IiBjb2hvcnQ9InJyZkAwLjgxIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjEyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIyNTg5MDc3NzE0NCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIyNTg5MDc3NzE0NCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAxMjg2NiIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMjcyMzM0NjczODIiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzL2EwYjFkMWNkLTkzZTItNDU4OS1hZDkxLTQyYTEzMjVjM2Q4OD9QMT0xNzAwMDAwNTkyJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVV6bThhVDZDJTJienB0VXFzSiUyYnFGUkM2NSUyYjg1cnljYXZZeGt2dk54UnNPN2pSWGNKRjFvQ0FOVWRnZjBjUnVubVNqZG5HS0JrNVZlVkRNODgzMFg3VUZ3JTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iNzA5MCIgdG90YWw9IjE2MTE3NDQiIGRvd25sb2FkX3RpbWVfbXM9IjEzMTk3NiIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIyNzIzMzQ2NzM4MiIgc291cmNlX3VybF9pbmRleD0iMCIgZG93bmxvYWRlcj0id2luaHR0cCIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvYTBiMWQxY2QtOTNlMi00NTg5LWFkOTEtNDJhMTMyNWMzZDg4P1AxPTE3MDAwMDA1OTImYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9VXptOGFUNkMlMmJ6cHRVcXNKJTJicUZSQzY1JTJiODVyeWNhdll4a3Z2TnhSc083alJYY0pGMW9DQU5VZGdmMGNSdW5tU2pkbkdLQms1VmVWRE04ODMwWDdVRnclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSI4LjI0OC4xMTUuMjU0IiBjZG5fY2lkPSIzIiBjZG5fY2NjPSJERSIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE2MTE3NDQiIHRvdGFsPSIxNjExNzQ0IiBkb3dubG9hZF90aW1lX21zPSIyMjE0Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjI3MjMzNDY3MzgyIiBzb3VyY2VfdXJsX2luZGV4PSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjI3MjM4NzgwMjAwIi8-PHBpbmcgcj0iMjIxIiByZD0iNTkzMyIgcGluZ19mcmVzaG5lc3M9Ins5ODUyODg3Ni04MDRELTQ4MzctOUExOS0xRTM4OUEyMjQ3Qjd9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjEwOS4wLjE1MTguMTE1IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9Ik0xMDAiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyMjEiIGluc3RhbGxkYXRlPSI1OTI5IiBjb2hvcnQ9InJyZkAwLjcyIiBpc19waW5uZWRfc3lzdGVtPSJ0cnVlIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzMjQ3NjkyOTc4MDg2MzEwIiBmaXJzdF9mcmVfc2Vlbl90aW1lPSIxMzMyNDc2OTI2MzYzNTI4OTAiIGZpcnN0X2ZyZV9zZWVuX3ZlcnNpb249IjEwOS4wLjE1MTguMTE1Ij48dXBkYXRlY2hlY2svPjxwaW5nIGFjdGl2ZT0iMCIgcj0iMjIxIiByZD0iNTkzMyIgcGluZ19mcmVzaG5lc3M9InswQTVCMjcyNS05RkI3LTQxNDUtQjVFMS01QjNDRjE3NTk5MTF9Ii8-PC9hcHA-PC9yZXF1ZXN0PgC:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.175.29
Modules
Images
c:\program files\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\combase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
1668"C:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODEuNSIgc2hlbGxfdmVyc2lvbj0iMS4zLjE3NS4yOSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins1MUU0QThDQy0wNjM0LTQwMkQtQjQ2Qy1FRkE0RkM4OTIyNTB9IiB1c2VyaWQ9Ins5QkY1RThCQy0xRTkxLTQ2MzEtOThBOS1DNDA5NEJFOTIwMjV9IiBpbnN0YWxsc291cmNlPSJzZWxmdXBkYXRlIiByZXF1ZXN0aWQ9Ins2QjM1Njg2OC00ODJBLTRBMzEtODZFOS1ENUExRkJCOUE2MDZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iNCIgcGh5c21lbW9yeT0iMyIgZGlza190eXBlPSIwIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSI2LjMuOTYwMC4xODc3OCIgc3A9IiIgYXJjaD0ieDg2IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJERUxMIiBwcm9kdWN0X25hbWU9IkRFTEwiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNzcuMTEiIG5leHR2ZXJzaW9uPSIxLjMuMTgxLjUiIGxhbmc9IiIgYnJhbmQ9Ik0xMDAiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIyMjEiIGluc3RhbGxkYXRlPSI1OTI5IiBpbnN0YWxsZGF0ZXRpbWU9IjE2ODAyOTU2NDUiIGNvaG9ydD0icnJmQDAuODEiPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjI3Mzc2MTYyNTQwIi8-PC9hcHA-PC9yZXF1ZXN0PgC:\Program Files\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.175.29
Modules
Images
c:\program files\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\combase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
1720C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES24BD.tmp" "c:\Users\admin\AppData\Local\Temp\CSC59EB1F8CEEB344DC891C5CECE4C6C97A.TMP"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
12.00.52519.0 built by: VSWINSERVICING
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcr120_clr0400.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
1780C:\Windows\System32\msdt.exe -path C:\Windows\diagnostics\index\PCWDiagnostic.xml -af C:\Users\admin\AppData\Local\Temp\PCW21CF.xml /skip TRUEC:\Windows\System32\msdt.exe—pcwrun.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Diagnostics Troubleshooting Wizard
Exit code:
0
Version:
6.3.9600.16384 (winblue_rtm.130821-1623)
Modules
Images
c:\windows\system32\msdt.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_a9ec6aab013aafee\comctl32.dll
c:\windows\system32\oleaut32.dll
Total events
15 965
Read events
11 936
Write events
3 941
Delete events
88

Modification events

(PID) Process:(3936) MicrosoftEdgeUpdate.exeKey:HKEY_USERS\S-1-5-21-2655973190-2785740294-2321183924-1001_CLASSES\Local Settings\MuiCache\2e\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3936) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\CurrentState
Operation:delete keyName:(default)
Value:
(PID) Process:(3936) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\CurrentState
Operation:delete keyName:(default)
Value:
(PID) Process:(3936) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\PersistedPings\{D028F3B8-E4FE-48C1-ABE1-31C3DF1EFF71}
Operation:delete keyName:(default)
Value:
(PID) Process:(3936) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\CurrentState
Operation:writeName:StateValue
Value:
3
(PID) Process:(3936) MicrosoftEdgeUpdate.exeKey:HKEY_USERS\S-1-5-21-2655973190-2785740294-2321183924-1001\Software\Microsoft\EdgeUpdate\proxy
Operation:writeName:source
Value:
auto
(PID) Process:(3936) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:ConsecutiveCheckFailures
Value:
0
(PID) Process:(3936) MicrosoftEdgeUpdate.exeKey:HKEY_USERS\S-1-5-21-2655973190-2785740294-2321183924-1001\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:dr
Value:
0
(PID) Process:(3936) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:DayOfLastRollCall
Value:
5933
(PID) Process:(3936) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:ping_freshness
Value:
{0A5B2725-9FB7-4145-B5E1-5B3CF1759911}
Executable files
207
Suspicious files
8
Text files
19
Unknown types
0

Dropped files

PID
Process
Filename
Type
3936MicrosoftEdgeUpdate.exeC:\Program Files\Microsoft\EdgeUpdate\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.181.5\MicrosoftEdgeUpdateSetup_X86_1.3.181.5.exeexecutable
MD5:9B09E682511FD006DE0458875A8C2E84
SHA256:2450A90417EC5205709D79CC2BA5BB0401B49AF95DCF8D6E1786E0D72DA53754
2740MicrosoftEdgeUpdateSetup_X86_1.3.181.5.exeC:\Program Files\Microsoft\Temp\EU9042.tmp\MicrosoftEdgeUpdate.exeexecutable
MD5:11FE091ACE9D03B9ADA6D5A22D12C0D0
SHA256:50F4ED60A507CE9DD1F3F4E7D53053D923CB71594374A25251746A9B2271E4EE
2740MicrosoftEdgeUpdateSetup_X86_1.3.181.5.exeC:\Program Files\Microsoft\Temp\EU9042.tmp\psmachine.dllexecutable
MD5:56C1A9EC314B41CE4BF20AAE41E94078
SHA256:A82DB4F2EC83020B2BA31A96D214D4EE207173A8B4206432C765DEE870120917
2740MicrosoftEdgeUpdateSetup_X86_1.3.181.5.exeC:\Program Files\Microsoft\Temp\EU9042.tmp\MicrosoftEdgeUpdateOnDemand.exeexecutable
MD5:532D470DA7523ABBB2ADE51CBD6CF1BD
SHA256:611225DCD25B3DAB7D331CE187F3589D83C80EFC543B971D96DD5357363EC827
2740MicrosoftEdgeUpdateSetup_X86_1.3.181.5.exeC:\Program Files\Microsoft\Temp\EU9042.tmp\psmachine_64.dllexecutable
MD5:A1E69165B66D05938AB8FC8232EDC866
SHA256:5B7345DE0B70B8D0CEFD4140ACF428A5B0FFE5A147ADF8A75D981B37FBD81E3A
2740MicrosoftEdgeUpdateSetup_X86_1.3.181.5.exeC:\Program Files\Microsoft\Temp\EU9042.tmp\psmachine_arm64.dllexecutable
MD5:581BC2D275F8B2E23C2C8BEEDA8471AD
SHA256:28F2F1AC5189A07B59110946509B7C61CC7F2935AF96B000278A5C5952C4B7C3
2740MicrosoftEdgeUpdateSetup_X86_1.3.181.5.exeC:\Program Files\Microsoft\Temp\EU9042.tmp\MicrosoftEdgeUpdateComRegisterShell64.exeexecutable
MD5:7750D94E4719BA69F5F83213444C0015
SHA256:1AB31694FF0B6283FBB6EC062D6EAB9FFB26DF9D6D1BA140CF60A8E7A4CB9FE5
3936MicrosoftEdgeUpdate.exeC:\Users\admin\AppData\Local\Temp\{3AB43804-EB25-45BD-94CE-157A5BDED41E}-MicrosoftEdgeUpdateSetup_X86_1.3.181.5.exeexecutable
MD5:9B09E682511FD006DE0458875A8C2E84
SHA256:2450A90417EC5205709D79CC2BA5BB0401B49AF95DCF8D6E1786E0D72DA53754
2740MicrosoftEdgeUpdateSetup_X86_1.3.181.5.exeC:\Program Files\Microsoft\Temp\EU9042.tmp\MicrosoftEdgeUpdateBroker.exeexecutable
MD5:4FDA82E4E5DB7141350CDDCEF7DB07A4
SHA256:48EFBB4780A6BE7EADC26DCC6D2C2B16DACCE447E53A3E2725AD4B1318A34E68
2740MicrosoftEdgeUpdateSetup_X86_1.3.181.5.exeC:\Program Files\Microsoft\Temp\EU9042.tmp\MicrosoftEdgeComRegisterShellARM64.exeexecutable
MD5:9540AD83A08605BA1F52196424CE3067
SHA256:B0B5D9EB6F4B176BDFBE4DA0A060AD1B76C813186FAE3D9A6E1B1DD9EE0D01D1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
18
DNS requests
11
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
796
svchost.exe
HEAD
200
8.248.115.254:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/a0b1d1cd-93e2-4589-ad91-42a1325c3d88?P1=1700000592&P2=404&P3=2&P4=Uzm8aT6C%2bzptUqsJ%2bqFRC65%2b85rycavYxkvvNxRsO7jRXcJF1oCANUdgf0cRunmSjdnGKBk5VeVDM8830X7UFw%3d%3d
unknown
—
—
unknown
796
svchost.exe
GET
—
8.248.115.254:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/a0b1d1cd-93e2-4589-ad91-42a1325c3d88?P1=1700000592&P2=404&P3=2&P4=Uzm8aT6C%2bzptUqsJ%2bqFRC65%2b85rycavYxkvvNxRsO7jRXcJF1oCANUdgf0cRunmSjdnGKBk5VeVDM8830X7UFw%3d%3d
unknown
—
—
unknown
—
—
GET
304
config.edge.skype.com:443
https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.181.5?clientId=s:6B9497E7-8A14-4043-A0AD-B1B6823998F8&appBrandCode_edgeupdate=M100&appChannel_edgeupdate=6&appCohort_edgeupdate=rrf@0.81&appConsentState_edgeupdate=0&appDayOfInstall_edgeupdate=5929&appInactivityBadgeApplied_edgeupdate=0&appInactivityBadgeCleared_edgeupdate=0&appInactivityBadgeDuration_edgeupdate=0&appInstallTimeDiffSec_edgeupdate=19094400&appIsPinnedSystem_edgeupdate=false&appLastLaunchCount_edgeupdate=0&appLastLaunchTime_edgeupdate=0&appLastLaunchTimeJson_edgeupdate=0&appLastLaunchTimeDaysAgo_edgeupdate=0&appVersion_edgeupdate=1.3.181.5&appUpdateCheckIsUpdateDisabled_edgeupdate=false&appUpdatesAllowedForMeteredNetworks_edgeupdate=false&hwDiskType=0&hwHasSsse3=true&hwLogicalCpus=4&hwPhysmemory=3&isCTADevice=false&isMsftDomainJoined=false&oemProductManufacturer=DELL&oemProductName=DELL&osArch=x86&osIsDefaultNetworkConnectionMetered=false&osIsInLockdownMode=false&osIsWIP=false&osPlatform=win&osProductType=48&osVersion=6.3.9600.18778&requestCheckPeriodSec=-1&requestDomainJoined=false&requestInstallSource=selfupdate&requestIsMachine=true&requestOmahaShellVersion=1.3.175.29&requestOmahaVersion=1.3.181.5
unknown
—
—
—
168
sdiagnhost.exe
GET
302
2.19.105.250:80
http://go.microsoft.com/fwlink/?LinkID=296332
unknown
—
—
unknown
—
—
GET
200
config.edge.skype.com:443
https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.177.11?clientId=s:6B9497E7-8A14-4043-A0AD-B1B6823998F8&appBrandCode_stable=M100&appChannel_stable=4&appCohort_stable=rrf@0.72&appConsentState_stable=393219&appDayOfInstall_stable=5929&appInactivityBadgeApplied_stable=0&appInactivityBadgeCleared_stable=0&appInactivityBadgeDuration_stable=0&appInstallTimeDiffSec_stable=19094400&appIsPinnedSystem_stable=true&appLang_stable=en&appLastLaunchCount_stable=1&appLastLaunchTime_stable=13324769297808631&appLastLaunchTimeJson_stable=2023-03-31t20:48:17.808z&appLastLaunchTimeDaysAgo_stable=221&appUpdateCheckIsUpdateDisabled_stable=false&appUpdatesAllowedForMeteredNetworks_stable=false&appVersion_stable=109.0.1518.115&hwDiskType=0&hwHasSsse3=true&hwLogicalCpus=4&hwPhysmemory=3&isCTADevice=false&isMsftDomainJoined=false&oemProductManufacturer=DELL&oemProductName=DELL&osArch=x86&osIsDefaultNetworkConnectionMetered=false&osIsInLockdownMode=false&osIsWIP=false&osPlatform=win&osProductType=48&osVersion=6.3.9600.18778&requestCheckPeriodSec=-1&requestDomainJoined=false&requestInstallSource=core&requestIsMachine=true&requestOmahaShellVersion=1.3.175.29&requestOmahaVersion=1.3.177.11
unknown
binary
234 b
—
—
—
POST
200
msedge.api.cdp.microsoft.com:443
https://msedge.api.cdp.microsoft.com/api/v1.1/internal/contents/Browser/namespaces/Default/names/msedgeupdate-stable-win-x86/versions/1.3.181.5/files?action=GenerateDownloadInfo&foregroundPriority=false
unknown
ini
759 b
—
—
—
POST
200
self.events.data.microsoft.com:443
https://self.events.data.microsoft.com/OneCollector/1.0/
unknown
binary
10 b
—
796
svchost.exe
GET
206
8.248.115.254:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/a0b1d1cd-93e2-4589-ad91-42a1325c3d88?P1=1700000592&P2=404&P3=2&P4=Uzm8aT6C%2bzptUqsJ%2bqFRC65%2b85rycavYxkvvNxRsO7jRXcJF1oCANUdgf0cRunmSjdnGKBk5VeVDM8830X7UFw%3d%3d
unknown
executable
6.92 Kb
unknown
—
—
POST
200
self.events.data.microsoft.com:443
https://self.events.data.microsoft.com/OneCollector/1.0/
unknown
binary
9 b
—
—
—
POST
200
msedge.api.cdp.microsoft.com:443
https://msedge.api.cdp.microsoft.com/api/v2/contents/Browser/namespaces/Default/names?action=batchupdates
unknown
ini
199 b
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3948
msedge.exe
224.0.0.251:5353
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
3948
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
3936
MicrosoftEdgeUpdate.exe
20.166.2.191:443
msedge.api.cdp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
796
svchost.exe
8.248.115.254:80
msedge.b.tlu.dl.delivery.mp.microsoft.com
LEVEL3
US
unknown
3936
MicrosoftEdgeUpdate.exe
8.248.115.254:80
msedge.b.tlu.dl.delivery.mp.microsoft.com
LEVEL3
US
unknown
252
MicrosoftEdgeUpdate.exe
20.189.173.7:443
self.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1448
MicrosoftEdgeUpdate.exe
52.123.243.84:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
DE
unknown
1448
MicrosoftEdgeUpdate.exe
20.189.173.7:443
self.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1668
MicrosoftEdgeUpdate.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
msedge.api.cdp.microsoft.com
  • 20.166.2.191
  • 13.95.26.4
whitelisted
msedge.b.tlu.dl.delivery.mp.microsoft.com
  • 8.248.115.254
  • 8.253.95.249
  • 67.26.75.254
whitelisted
self.events.data.microsoft.com
  • 20.189.173.7
  • 40.79.189.59
whitelisted
config.edge.skype.com
  • 52.123.243.84
  • 52.123.243.200
  • 52.123.243.71
  • 52.123.243.80
  • 13.107.42.16
whitelisted
go.microsoft.com
  • 2.19.105.250
whitelisted
compatexchange.trafficmanager.net
  • —
unknown
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
whitelisted

Threats

PID
Process
Class
Message
796
svchost.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3936
MicrosoftEdgeUpdate.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
Process
Message
rundll32.exe
SHIMVIEW: ShimInfo(Complete)
rundll32.exe
SHIMVIEW: ShimInfo(Complete)
csrstub.exe
SHIMVIEW: ShimInfo(Complete)
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://bitly.ws/?redirect=b4c7