File name:

SvinLauncher1.exe

Full analysis: https://app.any.run/tasks/513fe616-ffd2-4e7d-beb2-39960bf048be
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: August 02, 2025, 18:02:41
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
golang
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 9 sections
MD5:

8328F31CA863554FDE9FFDF109FCF33A

SHA1:

26C4AB3CBFB5B41D94A7728B58C9738BB5959986

SHA256:

805696E2515BAEDB0E5F9777AF9EABB11D4CBEBBFDAE9A6AFAA7D02353A4FAFB

SSDEEP:

98304:tAon1MYZgha2uNw4LVvWCU2Mo6XhgltfTYaOhhDiPkoNhehhx9NEsjAJCtCQSmV2:QGPO30QC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • MicrosoftEdgeUpdate.exe (PID: 6796)

    • The DLL Hijacking

      • msedgewebview2.exe (PID: 2668)

  • SUSPICIOUS

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeWebview2Setup.exe (PID: 1128)
      • MicrosoftEdgeUpdate.exe (PID: 6796)

    • Executable content was dropped or overwritten

      • SvinLauncher1.exe (PID: 1604)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1128)
      • MicrosoftEdgeUpdate.exe (PID: 6796)
      • MicrosoftEdge_X64_138.0.3351.121.exe (PID: 4412)
      • setup.exe (PID: 5824)

    • Process drops legitimate windows executable

      • MicrosoftEdgeWebview2Setup.exe (PID: 1128)
      • SvinLauncher1.exe (PID: 1604)
      • MicrosoftEdge_X64_138.0.3351.121.exe (PID: 4412)
      • setup.exe (PID: 5824)
      • MicrosoftEdgeUpdate.exe (PID: 6796)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 6796)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6304)
      • MicrosoftEdgeUpdate.exe (PID: 3100)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7004)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 4768)

    • Reads security settings of Internet Explorer

      • MicrosoftEdgeUpdate.exe (PID: 6796)
      • MicrosoftEdgeUpdate.exe (PID: 4024)
      • msedgewebview2.exe (PID: 1728)

    • Application launched itself

      • setup.exe (PID: 5824)
      • MicrosoftEdgeUpdate.exe (PID: 4024)
      • msedgewebview2.exe (PID: 1728)

    • Creates a software uninstall entry

      • setup.exe (PID: 5824)

    • Searches for installed software

      • setup.exe (PID: 5824)
      • msedgewebview2.exe (PID: 1728)

  • INFO

    • Checks supported languages

      • SvinLauncher1.exe (PID: 1604)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1128)
      • MicrosoftEdgeUpdate.exe (PID: 6796)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7004)
      • MicrosoftEdgeUpdate.exe (PID: 3100)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6304)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 4768)
      • MicrosoftEdgeUpdate.exe (PID: 6508)
      • MicrosoftEdgeUpdate.exe (PID: 6504)
      • MicrosoftEdgeUpdate.exe (PID: 4024)
      • MicrosoftEdgeUpdate.exe (PID: 304)
      • MicrosoftEdgeUpdateCore.exe (PID: 3936)
      • MicrosoftEdge_X64_138.0.3351.121.exe (PID: 4412)
      • setup.exe (PID: 5824)
      • setup.exe (PID: 4196)
      • MicrosoftEdgeUpdate.exe (PID: 2312)
      • msedgewebview2.exe (PID: 1728)
      • msedgewebview2.exe (PID: 1244)
      • msedgewebview2.exe (PID: 2668)
      • msedgewebview2.exe (PID: 3964)
      • msedgewebview2.exe (PID: 1612)
      • msedgewebview2.exe (PID: 5616)
      • msedgewebview2.exe (PID: 5028)

    • Reads Environment values

      • SvinLauncher1.exe (PID: 1604)
      • MicrosoftEdgeUpdate.exe (PID: 6508)
      • MicrosoftEdgeUpdate.exe (PID: 2312)
      • msedgewebview2.exe (PID: 1728)

    • The sample compiled with english language support

      • SvinLauncher1.exe (PID: 1604)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1128)
      • MicrosoftEdgeUpdate.exe (PID: 6796)
      • MicrosoftEdge_X64_138.0.3351.121.exe (PID: 4412)
      • setup.exe (PID: 5824)

    • Reads the machine GUID from the registry

      • SvinLauncher1.exe (PID: 1604)
      • MicrosoftEdgeUpdate.exe (PID: 6508)
      • MicrosoftEdgeUpdate.exe (PID: 4024)
      • MicrosoftEdgeUpdate.exe (PID: 2312)
      • msedgewebview2.exe (PID: 1728)

    • Reads the software policy settings

      • SvinLauncher1.exe (PID: 1604)
      • MicrosoftEdgeUpdate.exe (PID: 4024)
      • MicrosoftEdgeUpdate.exe (PID: 6508)
      • MicrosoftEdgeUpdate.exe (PID: 2312)
      • slui.exe (PID: 3108)

    • Create files in a temporary directory

      • MicrosoftEdgeWebview2Setup.exe (PID: 1128)
      • SvinLauncher1.exe (PID: 1604)
      • msedgewebview2.exe (PID: 1728)

    • Reads the computer name

      • SvinLauncher1.exe (PID: 1604)
      • MicrosoftEdgeUpdate.exe (PID: 6796)
      • MicrosoftEdgeUpdate.exe (PID: 3100)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6304)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7004)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 4768)
      • MicrosoftEdgeUpdate.exe (PID: 6508)
      • MicrosoftEdgeUpdate.exe (PID: 6504)
      • MicrosoftEdgeUpdate.exe (PID: 4024)
      • MicrosoftEdgeUpdateCore.exe (PID: 3936)
      • MicrosoftEdgeUpdate.exe (PID: 304)
      • MicrosoftEdge_X64_138.0.3351.121.exe (PID: 4412)
      • setup.exe (PID: 5824)
      • msedgewebview2.exe (PID: 1728)
      • msedgewebview2.exe (PID: 2668)
      • msedgewebview2.exe (PID: 3964)
      • MicrosoftEdgeUpdate.exe (PID: 2312)

    • Launching a file from a Registry key

      • MicrosoftEdgeUpdate.exe (PID: 6796)

    • Creates files or folders in the user directory

      • MicrosoftEdgeUpdate.exe (PID: 6796)
      • MicrosoftEdgeUpdate.exe (PID: 4024)
      • MicrosoftEdge_X64_138.0.3351.121.exe (PID: 4412)
      • setup.exe (PID: 4196)
      • setup.exe (PID: 5824)
      • msedgewebview2.exe (PID: 1728)
      • msedgewebview2.exe (PID: 1244)
      • SvinLauncher1.exe (PID: 1604)
      • msedgewebview2.exe (PID: 3964)

    • Process checks computer location settings

      • MicrosoftEdgeUpdate.exe (PID: 6796)
      • setup.exe (PID: 5824)
      • msedgewebview2.exe (PID: 1728)
      • msedgewebview2.exe (PID: 5616)

    • Checks proxy server information

      • MicrosoftEdgeUpdate.exe (PID: 6508)
      • MicrosoftEdgeUpdate.exe (PID: 4024)
      • MicrosoftEdgeUpdate.exe (PID: 2312)
      • msedgewebview2.exe (PID: 1728)
      • slui.exe (PID: 3108)

    • Manual execution by a user

      • MicrosoftEdgeUpdateCore.exe (PID: 3936)

    • Application based on Golang

      • SvinLauncher1.exe (PID: 1604)

    • Reads CPU info

      • msedgewebview2.exe (PID: 1728)

    • Drops encrypted JS script (Microsoft Script Encoder)

      • SvinLauncher1.exe (PID: 1604)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 3
CodeSize: 13211648
InitializedDataSize: 690688
UninitializedDataSize: -
EntryPoint: 0x6c780
OSVersion: 6.1
ImageVersion: 1
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 1.0.1.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Built using Wails (https://wails.io)
CompanyName: SvinLand
FileDescription: SvinLauncher
LegalCopyright: Copyright © 2024 SvinLand
ProductName: SvinLauncher
ProductVersion: 1.0.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
160
Monitored processes
24
Malicious processes
7
Suspicious processes
2

Behavior graph

Click at the process to see the details
start svinlauncher1.exe microsoftedgewebview2setup.exe microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe microsoftedgeupdatecore.exe no specs microsoftedgeupdate.exe no specs microsoftedge_x64_138.0.3351.121.exe setup.exe slui.exe setup.exe no specs microsoftedgeupdate.exe msedgewebview2.exe msedgewebview2.exe no specs msedgewebview2.exe no specs msedgewebview2.exe msedgewebview2.exe no specs msedgewebview2.exe no specs msedgewebview2.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
304"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /cC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdateCore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.195.65
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
1128C:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
SvinLauncher1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update Setup
Exit code:
0
Version:
1.3.195.65
Modules
Images
c:\users\admin\appdata\local\temp\microsoftedgewebview2setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1244C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\138.0.3351.121\msedgewebview2.exe --type=crashpad-handler --user-data-dir=C:\Users\admin\AppData\Roaming\SvinLauncher1.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\admin\AppData\Roaming\SvinLauncher1.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=138.0.7204.184 --annotation=exe=C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\138.0.3351.121\msedgewebview2.exe --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=138.0.3351.121 --initial-client-data=0x1a0,0x1a4,0x1a8,0x17c,0x1b0,0x7ffc44dfa178,0x7ffc44dfa184,0x7ffc44dfa190C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\138.0.3351.121\msedgewebview2.exe—msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge WebView2
Version:
138.0.3351.121
Modules
Images
c:\users\admin\appdata\local\microsoft\edgewebview\application\138.0.3351.121\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\microsoft\edgewebview\application\138.0.3351.121\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1604"C:\Users\admin\Desktop\SvinLauncher1.exe" C:\Users\admin\Desktop\SvinLauncher1.exe
explorer.exe
User:
admin
Company:
SvinLand
Integrity Level:
MEDIUM
Description:
SvinLauncher
Modules
Images
c:\users\admin\desktop\svinlauncher1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\umpdc.dll
1612"C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\138.0.3351.121\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Roaming\SvinLauncher1.exe\EBWebView" --webview-exe-name=SvinLauncher1.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1892,i,3200892160599657266,13724933895053700755,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTipping,msEdgeTranslate,msEdgeUseCaptivePortalService,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSmartScreenProtection,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:8C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\138.0.3351.121\msedgewebview2.exe—msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge WebView2
Version:
138.0.3351.121
Modules
Images
c:\users\admin\appdata\local\microsoft\edgewebview\application\138.0.3351.121\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\microsoft\edgewebview\application\138.0.3351.121\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1728"C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\138.0.3351.121\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=SvinLauncher1.exe --webview-exe-version=1.0.1 --user-data-dir="C:\Users\admin\AppData\Roaming\SvinLauncher1.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --mojo-named-platform-channel-pipe=1604.5744.5270653645528037631C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\138.0.3351.121\msedgewebview2.exe
SvinLauncher1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge WebView2
Version:
138.0.3351.121
Modules
Images
c:\users\admin\appdata\local\microsoft\edgewebview\application\138.0.3351.121\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\microsoft\edgewebview\application\138.0.3351.121\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2312"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNjUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNjUiIGlzbWFjaGluZT0iMCIgc2Vzc2lvbmlkPSJ7RkU4RTkxNTEtMzhBRi00QzRGLTlBODQtNTkxNUQ3RjM5MTNCfSIgdXNlcmlkPSJ7NUMyQjA2QjEtMjZCOC00MzBBLUI4RTMtQjUyQ0Y4OUJFRjhGfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0JEQzgyQUNDLTcxMDgtNEY0MC05RTZCLTQyQ0Y0Mjk5NEY3OH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI0IiBwaHlzbWVtb3J5PSI0IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDUuNDA0NiIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJERUxMIiBwcm9kdWN0X25hbWU9IkRFTEwiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEzOC4wLjMzNTEuMTIxIiBsYW5nPSJlbiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE2MzczNTEyNDQ2IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTYzNzM2NjkwNjYiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNjczNjQ1OTg5MCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMjA5YmNmMjItZGIyMi00MzY5LTlkMDEtZTVjMWEyMTMzNDFlP1AxPTE3NTQ3NjI1ODEmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9VmdVWDYyb0RXSkN2R2JPZU9SUmVuVm96ZW5ENlNiOFQ2YnM2Z1ZpYW9rNjNtOGlNelMlMmZoekR5TjRLWGY2Smhpajh3Y0JZeDVQME96ZktZTU1VMEIxQSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE3OTg1NDkyOCIgdG90YWw9IjE3OTg1NDkyOCIgZG93bmxvYWRfdGltZV9tcz0iMzI4NDIiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNjczNjYxNjQ2OSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE2NzU3NTUyODA2IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNzA5OTQzMzAxNCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjE1OTQiIGRvd25sb2FkX3RpbWVfbXM9IjM2Mjk1IiBkb3dubG9hZGVkPSIxNzk4NTQ5MjgiIHRvdGFsPSIxNzk4NTQ5MjgiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjM0MTczIi8-PC9hcHA-PC9yZXF1ZXN0PgC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.195.65
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
2668"C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\138.0.3351.121\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Roaming\SvinLauncher1.exe\EBWebView" --webview-exe-name=SvinLauncher1.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1892,i,3200892160599657266,13724933895053700755,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTipping,msEdgeTranslate,msEdgeUseCaptivePortalService,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSmartScreenProtection,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=1836 /prefetch:2C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\138.0.3351.121\msedgewebview2.exe—msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge WebView2
Version:
138.0.3351.121
Modules
Images
c:\users\admin\appdata\local\microsoft\edgewebview\application\138.0.3351.121\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\microsoft\edgewebview\application\138.0.3351.121\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3100"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserverC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.195.65
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
3108C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
25 526
Read events
23 241
Write events
2 217
Delete events
68

Modification events

(PID) Process:(6796) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:path
Value:
C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
(PID) Process:(6796) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:UninstallCmdLine
Value:
"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /uninstall
(PID) Process:(6796) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:pv
Value:
1.3.195.65
(PID) Process:(6796) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:name
Value:
Microsoft Edge Update
(PID) Process:(6796) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:pv
Value:
1.3.195.65
(PID) Process:(6796) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Microsoft Edge Update
Value:
"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.65\MicrosoftEdgeUpdateCore.exe"
(PID) Process:(6796) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:edgeupdate_task_name_c
Value:
MicrosoftEdgeUpdateTaskUserS-1-5-21-1693682860-607145093-2874071422-1001Core{EBBE3CA0-F89B-4C83-AD81-A1FE1D5B363C}
(PID) Process:(6796) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:edgeupdate_task_name_ua
Value:
MicrosoftEdgeUpdateTaskUserS-1-5-21-1693682860-607145093-2874071422-1001UA{84CA8001-17C9-44E9-9C68-10D540D86C87}
(PID) Process:(6796) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:delete valueName:eulaaccepted
Value:
(PID) Process:(6304) MicrosoftEdgeUpdateComRegisterShell64.exeKey:HKEY_CLASSES_ROOT\CLSID\{81093D63-7825-417B-BFC8-ADC63FA4E53D}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Both
Executable files
210
Suspicious files
122
Text files
27
Unknown types
0

Dropped files

PID
Process
Filename
Type
1604SvinLauncher1.exeC:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exeexecutable
MD5:FB7FF07F000EF3F6EBF22B0044F0DC13
SHA256:1BDCFC30FD8F711134DDC400C39C126A7678ED5717E9E3A320BBF4F4E4DA2ED4
1128MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUEEEF.tmp\MicrosoftEdgeUpdateBroker.exeexecutable
MD5:1AB505E831556BD56A75038062536E8E
SHA256:C438D3598CE4D2166AB2A636A585FF2C6E866E1355CB149DAA1C815488431D41
1128MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUEEEF.tmp\psmachine.dllexecutable
MD5:EAD519174ECE77F205B731C834FA1254
SHA256:1CC5C90531D6DE53BD1953F61ABABCFF1E925D4A86D1FEE2EB085E1C5AB1A308
1128MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUEEEF.tmp\MicrosoftEdgeUpdateComRegisterShell64.exeexecutable
MD5:A0530FB9B74B7D1597FD8536393F32AC
SHA256:BA42D0AE2191EFA24A2C90B437D693FBF63C5FC333A85E36918740AA3B8D4EF0
1128MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUEEEF.tmp\msedgeupdate.dllexecutable
MD5:FADF3B40EA0BE2351EA8CBE57D5116F8
SHA256:E2C8B7BD5B0095F08E9A3C4142C81936B0946394E7CD0A83B8C171C44CAD3A1C
1128MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUEEEF.tmp\MicrosoftEdgeComRegisterShellARM64.exeexecutable
MD5:B9690BC05B42CDAF092162A50806264C
SHA256:FF577F4C29A184A37014992DE44549BD81DFF20997D8DEAF55DF509F3D33ED1C
1128MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUEEEF.tmp\MicrosoftEdgeUpdateOnDemand.exeexecutable
MD5:51A1EF4E52178EB3C1C094D12EF96EFC
SHA256:F12362BDB47D6D5DBF01EA9C2CD3104002034E03FF7D4E39EB77E16C875CEE34
1128MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUEEEF.tmp\psuser_64.dllexecutable
MD5:91CA1359EB017D7FCBAF696FCEFCD3EE
SHA256:09C1A044F1E8D96F2E1E44EF04932D7BF27A0B53A97C08F0A5E3AB0FE90F4894
1128MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUEEEF.tmp\psmachine_arm64.dllexecutable
MD5:DF48414C12F739F526B01075B6B73A84
SHA256:D1F11F6FE0132E3FC9475C66823BB39AB1571A306A94C518179D19861B20225F
1128MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUEEEF.tmp\EdgeUpdate.datbinary
MD5:369BBC37CFF290ADB8963DC5E518B9B8
SHA256:3D7EC761BEF1B1AF418B909F1C81CE577C769722957713FDAFBC8131B0A0C7D3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
33
DNS requests
20
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.216.77.36:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
825 b
whitelisted
1268
svchost.exe
GET
200
72.246.169.155:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
814 b
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.216.77.36:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
825 b
whitelisted
4084
RUXIMICS.exe
GET
200
72.246.169.155:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
814 b
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
72.246.169.155:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
814 b
whitelisted
—
—
GET
200
23.50.131.87:443
https://msedge.sf.dl.delivery.mp.microsoft.com/filestreamingservice/files/f2910a1e-e5a6-4f17-b52d-7faf525d17f8/MicrosoftEdgeWebview2Setup.exe
US
—
—
unknown
—
—
GET
301
69.192.161.161:443
https://go.microsoft.com/fwlink/p/?LinkId=2124703
US
—
—
unknown
—
—
GET
200
150.171.22.17:443
https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.195.65?clientId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&appChannel_edgeupdate=6&appConsentState_edgeupdate=0&appDayOfInstall_edgeupdate=0&appInactivityBadgeApplied_edgeupdate=0&appInactivityBadgeCleared_edgeupdate=0&appInactivityBadgeDuration_edgeupdate=0&appInstallTimeDiffSec_edgeupdate=0&appIsPinnedSystem_edgeupdate=false&appLastLaunchCount_edgeupdate=0&appLastLaunchTime_edgeupdate=0&appLastLaunchTimeJson_edgeupdate=0&appLastLaunchTimeDaysAgo_edgeupdate=0&appVersion_edgeupdate=1.3.195.65&appUpdateCheckIsUpdateDisabled_edgeupdate=false&appUpdatesAllowedForMeteredNetworks_edgeupdate=false&hwDiskType=2&hwHasSsse3=true&hwLogicalCpus=4&hwPhysmemory=4&isCTADevice=false&isMsftDomainJoined=false&oemProductManufacturer=DELL&oemProductName=DELL&osArch=x64&osIsDefaultNetworkConnectionMetered=false&osIsInLockdownMode=false&osIsWIP=false&osPlatform=win&osProductType=48&osVersion=10.0.19045.4046&requestCheckPeriodSec=-1&requestDomainJoined=false&requestInstallSource=taggedmi&requestIsMachine=false&requestOmahaShellVersion=1.3.195.65&requestOmahaVersion=1.3.195.65
US
binary
234 b
whitelisted
—
—
GET
200
140.82.121.6:443
https://api.github.com/repos/SvinLandMC/svinlauncher-releases/releases
US
text
6.45 Kb
whitelisted
—
—
GET
304
150.171.22.17:443
https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.195.65?clientId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&appChannel_webview=5&appConsentState_webview=0&appDayOfInstall_webview=-1&appInactivityBadgeApplied_webview=0&appInactivityBadgeCleared_webview=0&appInactivityBadgeDuration_webview=0&appInstallTimeDiffSec_webview=-86400&appIsPinnedSystem_webview=false&appLang_webview=en&appLastLaunchCount_webview=0&appLastLaunchTime_webview=0&appLastLaunchTimeJson_webview=0&appLastLaunchTimeDaysAgo_webview=0&appVersion_webview=138.0.3351.121&appUpdateCheckIsUpdateDisabled_webview=false&appUpdatesAllowedForMeteredNetworks_webview=false&hwDiskType=2&hwHasSsse3=true&hwLogicalCpus=4&hwPhysmemory=4&isCTADevice=false&isMsftDomainJoined=false&oemProductManufacturer=DELL&oemProductName=DELL&osArch=x64&osIsDefaultNetworkConnectionMetered=false&osIsInLockdownMode=false&osIsWIP=false&osPlatform=win&osProductType=48&osVersion=10.0.19045.4046&requestCheckPeriodSec=-1&requestDomainJoined=false&requestInstallSource=taggedmi&requestIsMachine=false&requestOmahaShellVersion=1.3.195.65&requestOmahaVersion=1.3.195.65
US
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4084
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
23.216.77.36:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
23.216.77.36:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
72.246.169.155:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4084
RUXIMICS.exe
72.246.169.155:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5944
MoUsoCoreWorker.exe
72.246.169.155:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 23.216.77.36
  • 23.216.77.43
  • 23.216.77.28
  • 23.216.77.22
  • 23.216.77.42
  • 23.216.77.27
  • 23.216.77.39
  • 23.216.77.26
  • 23.216.77.29
whitelisted
www.microsoft.com
  • 72.246.169.155
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
msedge.sf.dl.delivery.mp.microsoft.com
  • 23.50.131.87
  • 23.50.131.88
whitelisted
config.edge.skype.com
  • 150.171.22.17
whitelisted
msedge.api.cdp.microsoft.com
  • 20.165.94.46
whitelisted
msedge.f.tlu.dl.delivery.mp.microsoft.com
  • 208.89.74.23
  • 208.89.74.17
  • 208.89.74.27
  • 208.89.74.31
  • 208.89.74.19
  • 208.89.74.21
  • 208.89.74.29
whitelisted
self.events.data.microsoft.com
  • 52.178.17.233
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
—
—
Misc activity
ET INFO Go-http-client User-Agent Observed Outbound
—
—
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
—
—
Misc activity
ET INFO Go-http-client User-Agent Observed Outbound
—
—
Misc activity
ET INFO Request for EXE via GO HTTP Client
—
—
Misc activity
ET INFO Packed Executable Download
5436
svchost.exe
Misc activity
ET INFO Packed Executable Download
Process
Message
msedgewebview2.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Roaming directory exists )
SvinLauncher1.exe
Warning: AddWebResourceRequestedFilter without SourceKind parameter is deprecated! It does not behave as expected for iframes.Please use AddWebResourceRequestedFilterWithRequestSourceKinds instead. For more information, please see https://go.microsoft.com/fwlink/?linkid=2286319
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SvinLauncher1.exe