URL:

https://krnl.vip/download/

Full analysis: https://app.any.run/tasks/ca93062d-d595-4ab5-96ad-83d7916ae162
Verdict: Malicious activity
Analysis date: March 15, 2025, 17:18:59
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
discord
github
autorun-reg
Indicators:
MD5:

38FB95DF86445E0732ED25CCAD4F26CD

SHA1:

C0A1D2E1D201830AAFD873ACFF3C6F2F8E6DF479

SHA256:

80251BFDECCD3793E47E33CB2107C956CBEB4B411A90B4C3814287C9A8784D2C

SSDEEP:

3:N8S9Vkn:2S96

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • Cheat Engine.exe (PID: 3800)
      • Cheat Engine.exe (PID: 236)
      • Nopdeengine-x86_64.exe (PID: 8676)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 4180)

    • Changes the autorun value in the registry

      • MicrosoftEdgeUpdate.exe (PID: 4308)

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 7332)

    • Drops a system driver (possible attempt to evade defenses)

      • WinRAR.exe (PID: 7816)

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 7816)
      • powershell.exe (PID: 4180)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1660)
      • MicrosoftEdgeUpdate.exe (PID: 4308)

    • Reads security settings of Internet Explorer

      • Cheat Engine.exe (PID: 3800)
      • MicrosoftEdgeUpdate.exe (PID: 4308)

    • Downloads file from URI via Powershell

      • powershell.exe (PID: 4180)

    • Starts process via Powershell

      • powershell.exe (PID: 4180)

    • Starts POWERSHELL.EXE for commands execution

      • msiexec.exe (PID: 8012)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 8012)

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 8012)

    • Manipulates environment variables

      • powershell.exe (PID: 4180)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 4180)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 4180)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1660)
      • MicrosoftEdgeUpdate.exe (PID: 4308)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeWebview2Setup.exe (PID: 1660)
      • MicrosoftEdgeUpdate.exe (PID: 4308)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 4308)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 1388)
      • MicrosoftEdgeUpdate.exe (PID: 5796)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 8608)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 8292)

  • INFO

    • Reads the computer name

      • identity_helper.exe (PID: 8012)
      • msiexec.exe (PID: 8012)
      • msiexec.exe (PID: 8724)
      • identity_helper.exe (PID: 8756)
      • Cheat Engine.exe (PID: 3800)
      • Nopdeengine-x86_64.exe (PID: 8676)
      • msiexec.exe (PID: 8720)
      • MicrosoftEdgeUpdate.exe (PID: 4308)
      • MicrosoftEdgeUpdate.exe (PID: 5796)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 1388)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 8608)
      • MicrosoftEdgeUpdate.exe (PID: 5772)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 8292)
      • MicrosoftEdgeUpdate.exe (PID: 6820)
      • MicrosoftEdgeUpdate.exe (PID: 2416)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 1240)
      • BackgroundTransferHost.exe (PID: 8856)
      • BackgroundTransferHost.exe (PID: 9168)
      • BackgroundTransferHost.exe (PID: 8572)
      • BackgroundTransferHost.exe (PID: 8160)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 8856)
      • slui.exe (PID: 7880)
      • powershell.exe (PID: 4180)
      • MicrosoftEdgeUpdate.exe (PID: 5772)
      • MicrosoftEdgeUpdate.exe (PID: 6820)

    • Reads Environment values

      • identity_helper.exe (PID: 8012)
      • identity_helper.exe (PID: 8756)
      • MicrosoftEdgeUpdate.exe (PID: 5772)

    • Checks supported languages

      • identity_helper.exe (PID: 8012)
      • msiexec.exe (PID: 8012)
      • msiexec.exe (PID: 8724)
      • identity_helper.exe (PID: 8756)
      • Cheat Engine.exe (PID: 3800)
      • Nopdeengine-x86_64.exe (PID: 8676)
      • msiexec.exe (PID: 8720)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1660)
      • MicrosoftEdgeUpdate.exe (PID: 4308)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 8608)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 1388)
      • MicrosoftEdgeUpdate.exe (PID: 5796)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 8292)
      • MicrosoftEdgeUpdate.exe (PID: 5772)
      • MicrosoftEdgeUpdate.exe (PID: 2416)
      • MicrosoftEdgeUpdate.exe (PID: 6820)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 8856)
      • MicrosoftEdgeUpdate.exe (PID: 4308)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 8856)
      • slui.exe (PID: 4120)
      • slui.exe (PID: 7880)
      • MicrosoftEdgeUpdate.exe (PID: 5772)
      • MicrosoftEdgeUpdate.exe (PID: 6820)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 7416)
      • msedge.exe (PID: 732)
      • msiexec.exe (PID: 5308)
      • WinRAR.exe (PID: 7816)
      • msiexec.exe (PID: 728)
      • msedge.exe (PID: 4016)
      • msiexec.exe (PID: 8012)

    • Reads Microsoft Office registry keys

      • msedge.exe (PID: 732)

    • Manages system restore points

      • SrTasks.exe (PID: 5112)
      • SrTasks.exe (PID: 5384)

    • Application launched itself

      • msedge.exe (PID: 732)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 7816)
      • msedge.exe (PID: 4016)
      • powershell.exe (PID: 4180)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1660)
      • MicrosoftEdgeUpdate.exe (PID: 4308)

    • Manual execution by a user

      • Cheat Engine.exe (PID: 3800)
      • Cheat Engine.exe (PID: 236)

    • Process checks computer location settings

      • Cheat Engine.exe (PID: 3800)
      • MicrosoftEdgeUpdate.exe (PID: 4308)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 8012)

    • Disables trace logs

      • powershell.exe (PID: 4180)

    • The executable file from the user directory is run by the Powershell process

      • MicrosoftEdgeWebview2Setup.exe (PID: 1660)

    • Create files in a temporary directory

      • MicrosoftEdgeWebview2Setup.exe (PID: 1660)
      • MicrosoftEdgeUpdate.exe (PID: 4308)

    • Autorun file from Registry key

      • MicrosoftEdgeUpdate.exe (PID: 4308)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
293
Monitored processes
147
Malicious processes
6
Suspicious processes
4

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs sppextcomobj.exe no specs slui.exe msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs srtasks.exe no specs conhost.exe no specs msedge.exe no specs slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs winrar.exe msedge.exe no specs msedge.exe no specs rundll32.exe no specs cheat engine.exe no specs cheat engine.exe msedge.exe no specs nopdeengine-x86_64.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msiexec.exe msiexec.exe no specs msedge.exe msedge.exe no specs srtasks.exe no specs conhost.exe no specs msedge.exe no specs powershell.exe conhost.exe no specs msedge.exe no specs microsoftedgewebview2setup.exe microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
132"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=10048 --field-trial-handle=2208,i,3563086592801807009,14530737395831883172,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
236"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=13484 --field-trial-handle=2208,i,3563086592801807009,14530737395831883172,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
236"C:\Users\admin\Desktop\Nopde Engine 6.4\Cheat Engine.exe" C:\Users\admin\Desktop\Nopde Engine 6.4\Cheat Engine.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Version:
6.3.0.0
Modules
Images
c:\users\admin\desktop\nopde engine 6.4\cheat engine.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
240\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
720"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=72 --mojo-platform-channel-handle=10060 --field-trial-handle=2208,i,3563086592801807009,14530737395831883172,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
728"C:\WINDOWS\System32\msiexec.exe" /i "C:\Users\admin\Downloads\jjsploit_8.13.1_x64_en-US.msi" C:\Windows\System32\msiexec.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
732"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://krnl.vip/download/"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1012"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=59 --mojo-platform-channel-handle=13688 --field-trial-handle=2208,i,3563086592801807009,14530737395831883172,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1240"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1348"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=14144 --field-trial-handle=2208,i,3563086592801807009,14530737395831883172,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
27 998
Read events
26 383
Write events
1 563
Delete events
52

Modification events

(PID) Process:(732) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
98CEF708FB8E2F00
(PID) Process:(732) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\262994
Operation:writeName:WindowTabManagerFileMappingId
Value:
{F251698B-9AEE-47C1-8B44-431C0EEABEDA}
(PID) Process:(732) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\262994
Operation:writeName:WindowTabManagerFileMappingId
Value:
{2597148F-21C1-4FE4-9379-F74F781877F3}
(PID) Process:(732) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\262994
Operation:writeName:WindowTabManagerFileMappingId
Value:
{1F7EDFB6-613E-4EFD-8895-78CE55F7C8BF}
(PID) Process:(732) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(732) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(732) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(732) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(732) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
2FECEB08FB8E2F00
(PID) Process:(732) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\262994
Operation:writeName:WindowTabManagerFileMappingId
Value:
{7B5E6A17-2271-48C5-B8C0-B811987A279F}
Executable files
276
Suspicious files
1 150
Text files
209
Unknown types
4

Dropped files

PID
Process
Filename
Type
732msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF10b77a.TMP —
MD5:—
SHA256:—
732msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
732msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF10b76b.TMP —
MD5:—
SHA256:—
732msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
732msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF10b79a.TMP —
MD5:—
SHA256:—
732msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF10b79a.TMP —
MD5:—
SHA256:—
732msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
732msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF10b7b9.TMP —
MD5:—
SHA256:—
732msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
732msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
56
TCP/UDP connections
336
DNS requests
302
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
680
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/a575cead-e662-4f4d-b0c3-81f1438d0388?P1=1742376571&P2=404&P3=2&P4=B8iKWZSVJNXh0p304GD3Lexkx7RMY8uVHvy6albZWqtQXcmBS8Q%2fl6bWRbD4X63tFXqbFqHkLfJyag9S1PxYgg%3d%3d
unknown
—
—
whitelisted
680
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/a575cead-e662-4f4d-b0c3-81f1438d0388?P1=1742376571&P2=404&P3=2&P4=B8iKWZSVJNXh0p304GD3Lexkx7RMY8uVHvy6albZWqtQXcmBS8Q%2fl6bWRbD4X63tFXqbFqHkLfJyag9S1PxYgg%3d%3d
unknown
—
—
whitelisted
680
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/a575cead-e662-4f4d-b0c3-81f1438d0388?P1=1742376571&P2=404&P3=2&P4=B8iKWZSVJNXh0p304GD3Lexkx7RMY8uVHvy6albZWqtQXcmBS8Q%2fl6bWRbD4X63tFXqbFqHkLfJyag9S1PxYgg%3d%3d
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
23.53.40.187:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.53.40.187:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1116
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
9036
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
9036
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
8856
BackgroundTransferHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.53.40.187:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
23.53.40.187:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7416
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7416
msedge.exe
104.21.46.75:443
krnl.vip
—
—
suspicious
732
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
7416
msedge.exe
172.67.141.247:443
thekrnl.com
—
—
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.53.40.187
  • 23.53.40.169
  • 23.53.40.186
  • 23.53.41.97
  • 23.53.40.203
  • 23.53.40.184
  • 23.53.40.194
  • 23.53.40.195
  • 23.53.40.200
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
krnl.vip
  • 104.21.46.75
  • 172.67.136.103
unknown
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.44
whitelisted
bzib.nelreports.net
  • 23.50.131.74
  • 23.50.131.78
  • 2.19.11.120
  • 2.19.11.100
whitelisted
krnl.in
  • 109.176.207.173
unknown

Threats

PID
Process
Class
Message
7416
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
7416
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
7416
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
7416
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
7416
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
7416
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
7416
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
7416
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
7416
msedge.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discordapp .com)
7416
msedge.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discordapp .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://krnl.vip/download/