File name:

SvinLauncher1.exe

Full analysis: https://app.any.run/tasks/513fe616-ffd2-4e7d-beb2-39960bf048be
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: August 02, 2025, 18:02:41
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
golang
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 9 sections
MD5:

8328F31CA863554FDE9FFDF109FCF33A

SHA1:

26C4AB3CBFB5B41D94A7728B58C9738BB5959986

SHA256:

805696E2515BAEDB0E5F9777AF9EABB11D4CBEBBFDAE9A6AFAA7D02353A4FAFB

SSDEEP:

98304:tAon1MYZgha2uNw4LVvWCU2Mo6XhgltfTYaOhhDiPkoNhehhx9NEsjAJCtCQSmV2:QGPO30QC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • MicrosoftEdgeUpdate.exe (PID: 6796)

    • The DLL Hijacking

      • msedgewebview2.exe (PID: 2668)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • SvinLauncher1.exe (PID: 1604)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1128)
      • MicrosoftEdgeUpdate.exe (PID: 6796)
      • MicrosoftEdge_X64_138.0.3351.121.exe (PID: 4412)
      • setup.exe (PID: 5824)

    • Process drops legitimate windows executable

      • SvinLauncher1.exe (PID: 1604)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1128)
      • MicrosoftEdgeUpdate.exe (PID: 6796)
      • MicrosoftEdge_X64_138.0.3351.121.exe (PID: 4412)
      • setup.exe (PID: 5824)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeWebview2Setup.exe (PID: 1128)
      • MicrosoftEdgeUpdate.exe (PID: 6796)

    • Starts itself from another location

      • MicrosoftEdgeUpdate.exe (PID: 6796)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7004)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6304)
      • MicrosoftEdgeUpdate.exe (PID: 3100)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 4768)

    • Reads security settings of Internet Explorer

      • MicrosoftEdgeUpdate.exe (PID: 6796)
      • MicrosoftEdgeUpdate.exe (PID: 4024)
      • msedgewebview2.exe (PID: 1728)

    • Application launched itself

      • setup.exe (PID: 5824)
      • MicrosoftEdgeUpdate.exe (PID: 4024)
      • msedgewebview2.exe (PID: 1728)

    • Searches for installed software

      • setup.exe (PID: 5824)
      • msedgewebview2.exe (PID: 1728)

    • Creates a software uninstall entry

      • setup.exe (PID: 5824)

  • INFO

    • Reads the computer name

      • SvinLauncher1.exe (PID: 1604)
      • MicrosoftEdgeUpdate.exe (PID: 6796)
      • MicrosoftEdgeUpdate.exe (PID: 3100)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6304)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7004)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 4768)
      • MicrosoftEdgeUpdate.exe (PID: 6504)
      • MicrosoftEdgeUpdate.exe (PID: 6508)
      • MicrosoftEdgeUpdate.exe (PID: 4024)
      • MicrosoftEdgeUpdateCore.exe (PID: 3936)
      • MicrosoftEdgeUpdate.exe (PID: 304)
      • MicrosoftEdge_X64_138.0.3351.121.exe (PID: 4412)
      • setup.exe (PID: 5824)
      • MicrosoftEdgeUpdate.exe (PID: 2312)
      • msedgewebview2.exe (PID: 1728)
      • msedgewebview2.exe (PID: 2668)
      • msedgewebview2.exe (PID: 3964)

    • Checks supported languages

      • SvinLauncher1.exe (PID: 1604)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1128)
      • MicrosoftEdgeUpdate.exe (PID: 6796)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7004)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6304)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 4768)
      • MicrosoftEdgeUpdate.exe (PID: 3100)
      • MicrosoftEdgeUpdate.exe (PID: 4024)
      • MicrosoftEdgeUpdate.exe (PID: 6504)
      • MicrosoftEdgeUpdate.exe (PID: 6508)
      • MicrosoftEdgeUpdateCore.exe (PID: 3936)
      • setup.exe (PID: 5824)
      • MicrosoftEdge_X64_138.0.3351.121.exe (PID: 4412)
      • MicrosoftEdgeUpdate.exe (PID: 304)
      • setup.exe (PID: 4196)
      • msedgewebview2.exe (PID: 1728)
      • MicrosoftEdgeUpdate.exe (PID: 2312)
      • msedgewebview2.exe (PID: 1244)
      • msedgewebview2.exe (PID: 2668)
      • msedgewebview2.exe (PID: 3964)
      • msedgewebview2.exe (PID: 1612)
      • msedgewebview2.exe (PID: 5028)
      • msedgewebview2.exe (PID: 5616)

    • Reads Environment values

      • SvinLauncher1.exe (PID: 1604)
      • MicrosoftEdgeUpdate.exe (PID: 6508)
      • MicrosoftEdgeUpdate.exe (PID: 2312)
      • msedgewebview2.exe (PID: 1728)

    • Create files in a temporary directory

      • SvinLauncher1.exe (PID: 1604)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1128)
      • msedgewebview2.exe (PID: 1728)

    • Reads the machine GUID from the registry

      • SvinLauncher1.exe (PID: 1604)
      • MicrosoftEdgeUpdate.exe (PID: 6508)
      • MicrosoftEdgeUpdate.exe (PID: 4024)
      • MicrosoftEdgeUpdate.exe (PID: 2312)
      • msedgewebview2.exe (PID: 1728)

    • Reads the software policy settings

      • SvinLauncher1.exe (PID: 1604)
      • MicrosoftEdgeUpdate.exe (PID: 6508)
      • MicrosoftEdgeUpdate.exe (PID: 4024)
      • MicrosoftEdgeUpdate.exe (PID: 2312)
      • slui.exe (PID: 3108)

    • The sample compiled with english language support

      • SvinLauncher1.exe (PID: 1604)
      • MicrosoftEdgeWebview2Setup.exe (PID: 1128)
      • MicrosoftEdgeUpdate.exe (PID: 6796)
      • MicrosoftEdge_X64_138.0.3351.121.exe (PID: 4412)
      • setup.exe (PID: 5824)

    • Launching a file from a Registry key

      • MicrosoftEdgeUpdate.exe (PID: 6796)

    • Creates files or folders in the user directory

      • MicrosoftEdgeUpdate.exe (PID: 6796)
      • MicrosoftEdgeUpdate.exe (PID: 4024)
      • MicrosoftEdge_X64_138.0.3351.121.exe (PID: 4412)
      • setup.exe (PID: 5824)
      • setup.exe (PID: 4196)
      • msedgewebview2.exe (PID: 1244)
      • msedgewebview2.exe (PID: 1728)
      • SvinLauncher1.exe (PID: 1604)
      • msedgewebview2.exe (PID: 3964)

    • Checks proxy server information

      • MicrosoftEdgeUpdate.exe (PID: 6508)
      • MicrosoftEdgeUpdate.exe (PID: 4024)
      • MicrosoftEdgeUpdate.exe (PID: 2312)
      • msedgewebview2.exe (PID: 1728)
      • slui.exe (PID: 3108)

    • Process checks computer location settings

      • MicrosoftEdgeUpdate.exe (PID: 6796)
      • setup.exe (PID: 5824)
      • msedgewebview2.exe (PID: 1728)
      • msedgewebview2.exe (PID: 5616)

    • Application based on Golang

      • SvinLauncher1.exe (PID: 1604)

    • Manual execution by a user

      • MicrosoftEdgeUpdateCore.exe (PID: 3936)

    • Drops encrypted JS script (Microsoft Script Encoder)

      • SvinLauncher1.exe (PID: 1604)

    • Reads CPU info

      • msedgewebview2.exe (PID: 1728)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 3
CodeSize: 13211648
InitializedDataSize: 690688
UninitializedDataSize: -
EntryPoint: 0x6c780
OSVersion: 6.1
ImageVersion: 1
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 1.0.1.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Built using Wails (https://wails.io)
CompanyName: SvinLand
FileDescription: SvinLauncher
LegalCopyright: Copyright © 2024 SvinLand
ProductName: SvinLauncher
ProductVersion: 1.0.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
160
Monitored processes
24
Malicious processes
7
Suspicious processes
2

Behavior graph

Click at the process to see the details
start svinlauncher1.exe microsoftedgewebview2setup.exe microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe microsoftedgeupdatecore.exe no specs microsoftedgeupdate.exe no specs microsoftedge_x64_138.0.3351.121.exe setup.exe slui.exe setup.exe no specs microsoftedgeupdate.exe msedgewebview2.exe msedgewebview2.exe no specs msedgewebview2.exe no specs msedgewebview2.exe msedgewebview2.exe no specs msedgewebview2.exe no specs msedgewebview2.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
304"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /cC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdateCore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.195.65
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
1128C:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
SvinLauncher1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update Setup
Exit code:
0
Version:
1.3.195.65
Modules
Images
c:\users\admin\appdata\local\temp\microsoftedgewebview2setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1244C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\138.0.3351.121\msedgewebview2.exe --type=crashpad-handler --user-data-dir=C:\Users\admin\AppData\Roaming\SvinLauncher1.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\admin\AppData\Roaming\SvinLauncher1.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=138.0.7204.184 --annotation=exe=C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\138.0.3351.121\msedgewebview2.exe --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=138.0.3351.121 --initial-client-data=0x1a0,0x1a4,0x1a8,0x17c,0x1b0,0x7ffc44dfa178,0x7ffc44dfa184,0x7ffc44dfa190C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\138.0.3351.121\msedgewebview2.exe—msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge WebView2
Version:
138.0.3351.121
Modules
Images
c:\users\admin\appdata\local\microsoft\edgewebview\application\138.0.3351.121\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\microsoft\edgewebview\application\138.0.3351.121\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1604"C:\Users\admin\Desktop\SvinLauncher1.exe" C:\Users\admin\Desktop\SvinLauncher1.exe
explorer.exe
User:
admin
Company:
SvinLand
Integrity Level:
MEDIUM
Description:
SvinLauncher
Modules
Images
c:\users\admin\desktop\svinlauncher1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\umpdc.dll
1612"C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\138.0.3351.121\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Roaming\SvinLauncher1.exe\EBWebView" --webview-exe-name=SvinLauncher1.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1892,i,3200892160599657266,13724933895053700755,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTipping,msEdgeTranslate,msEdgeUseCaptivePortalService,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSmartScreenProtection,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:8C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\138.0.3351.121\msedgewebview2.exe—msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge WebView2
Version:
138.0.3351.121
Modules
Images
c:\users\admin\appdata\local\microsoft\edgewebview\application\138.0.3351.121\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\microsoft\edgewebview\application\138.0.3351.121\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1728"C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\138.0.3351.121\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=SvinLauncher1.exe --webview-exe-version=1.0.1 --user-data-dir="C:\Users\admin\AppData\Roaming\SvinLauncher1.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --mojo-named-platform-channel-pipe=1604.5744.5270653645528037631C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\138.0.3351.121\msedgewebview2.exe
SvinLauncher1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge WebView2
Version:
138.0.3351.121
Modules
Images
c:\users\admin\appdata\local\microsoft\edgewebview\application\138.0.3351.121\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\microsoft\edgewebview\application\138.0.3351.121\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2312"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNjUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNjUiIGlzbWFjaGluZT0iMCIgc2Vzc2lvbmlkPSJ7RkU4RTkxNTEtMzhBRi00QzRGLTlBODQtNTkxNUQ3RjM5MTNCfSIgdXNlcmlkPSJ7NUMyQjA2QjEtMjZCOC00MzBBLUI4RTMtQjUyQ0Y4OUJFRjhGfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0ie0JEQzgyQUNDLTcxMDgtNEY0MC05RTZCLTQyQ0Y0Mjk5NEY3OH0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSI0IiBwaHlzbWVtb3J5PSI0IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDUuNDA0NiIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJERUxMIiBwcm9kdWN0X25hbWU9IkRFTEwiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEzOC4wLjMzNTEuMTIxIiBsYW5nPSJlbiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE2MzczNTEyNDQ2IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTYzNzM2NjkwNjYiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNjczNjQ1OTg5MCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMjA5YmNmMjItZGIyMi00MzY5LTlkMDEtZTVjMWEyMTMzNDFlP1AxPTE3NTQ3NjI1ODEmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9VmdVWDYyb0RXSkN2R2JPZU9SUmVuVm96ZW5ENlNiOFQ2YnM2Z1ZpYW9rNjNtOGlNelMlMmZoekR5TjRLWGY2Smhpajh3Y0JZeDVQME96ZktZTU1VMEIxQSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE3OTg1NDkyOCIgdG90YWw9IjE3OTg1NDkyOCIgZG93bmxvYWRfdGltZV9tcz0iMzI4NDIiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNjczNjYxNjQ2OSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE2NzU3NTUyODA2IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNzA5OTQzMzAxNCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjE1OTQiIGRvd25sb2FkX3RpbWVfbXM9IjM2Mjk1IiBkb3dubG9hZGVkPSIxNzk4NTQ5MjgiIHRvdGFsPSIxNzk4NTQ5MjgiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjM0MTczIi8-PC9hcHA-PC9yZXF1ZXN0PgC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.195.65
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
2668"C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\138.0.3351.121\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Roaming\SvinLauncher1.exe\EBWebView" --webview-exe-name=SvinLauncher1.exe --webview-exe-version=1.0.1 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1892,i,3200892160599657266,13724933895053700755,262144 --enable-features=ForceSWDCompWhenDCompFallbackRequired,msAggressiveCacheTrimming,msCustomDataPartition,msWebView2NoTabForScreenShare,msWindowsTaskManager --disable-features=BackForwardCache,BackgroundTabLoadingFromPerformanceManager,CloseOmniboxPopupOnInactiveAreaClick,CollectAVProductsInfo,CollectCodeIntegrityInfo,EnableHangWatcher,FilterAdsOnAbusiveSites,GetWifiProtocol,LoginDetection,MediaFoundationCameraUsageMonitoring,PreconnectToSearch,SafetyHub,SegmentationPlatform,SpareRendererForSitePerProcess,Ukm,WebPayments,msAITrackerClassification,msAbydosForWindowlessWV2,msAffirmVirtualCard,msAllowChromeWebstore,msAllowMSAPrtSSOForNonMSAProfile,msApplicationGuard,msAskBeforeClosingMultipleTabs,msAutoToggleAADPrtSSOForNonAADProfile,msAutofillEdgeCoupons,msAutofillEdgeCouponsAutoApply,msAutofillEdgeServiceRequest,msAutofillEnableEdgeSuggestions,msAutomaticTabFreeze,msBrowserSettingsSupported,msCoarseGeolocationService,msDataProtection,msDesktopMode,msDesktopRewards,msDisableVariationsSeedFetchThrottling,msEEProactiveHistory,msETFOffstoreExtensionFileDataCollection,msETFPasswordTheftDNRActionSignals,msEdgeAdPlatformUI,msEdgeAddWebCapturetoCollections,msEdgeAutofillShowDeployedPassword,msEdgeCaptureSelectionInPDF,msEdgeCloudConfigService,msEdgeCloudConfigServiceV2,msEdgeCohorts,msEdgeCollectionsPrismExperiment1,msEdgeCollectionsPrismOverallMigration,msEdgeComposeNext,msEdgeEnableNurturingFramework,msEdgeEnclavePrefsBasic,msEdgeEnclavePrefsNotification,msEdgeFaviconService,msEdgeHJTelemetry,msEdgeHubAppSkype,msEdgeImageEditorUI,msEdgeLinkDoctor,msEdgeMouseGestureDefaultEnabled,msEdgeMouseGestureSupported,msEdgeNewDeviceFre,msEdgeOnRampFRE,msEdgeOnRampImport,msEdgePDFCMHighlightUX,msEdgePasswordIris,msEdgePasswordIrisSaveBubble,msEdgeProngPersonalization,msEdgeReadingView,msEdgeRose,msEdgeScreenshotUI,msEdgeSendTabToSelf,msEdgeSettingsImport,msEdgeSettingsImportV2,msEdgeShoppingPersistentStorage,msEdgeShoppingUI,msEdgeSmartFind,msEdgeSuperDragDefaultEnabled,msEdgeSuperDragDropSupported,msEdgeTipping,msEdgeTranslate,msEdgeUseCaptivePortalService,msEdgeWebCapture,msEdgeWebCaptureUniformExperience,msEdgeWebContentFilteringFeedback,msEdgeWorkSearchBanner,msEnableCustomJobMemoryLimitsOnXbox,msEnableMIPForPDF,msEnablePdfUpsell,msEnableThirdPartyScanning,msEnableWebSignInCta,msEnableWebToBrowserSignIn,msEndpointDlp,msEntityExtraction,msExtensionTelemetryFramework,msExternalTaskManager,msFileSystemAccessDirectoryIterationBlocklistCheck,msForceBrowserSignIn,msForeignSessionsPage,msGeolocationAccessService,msGeolocationOSLocationPermissionFallback,msGeolocationSQMService,msGeolocationService,msGrowthInfraLaunchSourceLogging,msGuidedSwitchAllowed,msHubPinPersist,msImplicitSignin,msIrm,msIrmv2,msKlarnaVirtualCard,msLlmConsumerDlpPurview,msLoadStatistics,msLogIsEdgePinnedToTaskbarOnLaunch,msMIPCrossTenantPdfViewSupport,msMdatpWebSiteDlp,msNotificationPermissionForPWA,msNumberOfSitesToPin,msNurturingSitePinningWithWindowsConsent,msOnHoverSearchInSidebar,msOpenOfficeDocumentsInWebViewer,msPasswordBreachDetection,msPdfAnnotationsVisibility,msPdfDataRecovery,msPdfDigitalSignatureRead,msPdfFreeText,msPdfFreeTextForCJK,msPdfHighlightMode,msPdfInking,msPdfKeyphraseSupport,msPdfOOUI,msPdfPopupMarkerRenderer,msPdfShare,msPdfSharedLibrary,msPdfTextNote,msPdfTextNoteMoreMenu,msPdfThumbnailCache,msPdfUnderside,msPdfViewRestore,msPersonalizationUMA,msPriceComparison,msPromptDefaultHandlerForPDF,msReactiveSearch,msReadAloud,msReadAloudPdf,msRedirectToShoreline,msRevokeExtensions,msSaasDlp,msShoppingTrigger,msShorelineSearch,msShorelineSearchFindOnPageWebUI,msShowOfflineGameEntrance,msShowReadAloudIconInAddressBar,msShowUXForAADPrtSSOForNonAADProfile,msSitePinningWithoutUi,msSmartScreenProtection,msSuspendMessageForNewSessionWhenHavingPendingNavigation,msSyncEdgeCollections,msTabResourceStats,msTokenizationAutofillInlineEnabled,msTouchMode,msTriggeringSignalGenerator,msUserUnderstanding,msVideoSuperResolutionUI,msWalletBuyNow,msWalletCheckout,msWalletDiagnosticDataLogger,msWalletHubEntry,msWalletHubIntlP3,msWalletPartialCard,msWalletPasswordCategorization,msWalletPasswordCategorizationPlatformExpansion,msWalletTokenizationCardMetadata,msWalletTokenizedAutofill,msWebAssist,msWebAssistHistorySearchService,msWebOOUI,msWindowsUserActivities,msZipPayVirtualCard --variations-seed-version --mojo-platform-channel-handle=1836 /prefetch:2C:\Users\admin\AppData\Local\Microsoft\EdgeWebView\Application\138.0.3351.121\msedgewebview2.exe—msedgewebview2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge WebView2
Version:
138.0.3351.121
Modules
Images
c:\users\admin\appdata\local\microsoft\edgewebview\application\138.0.3351.121\msedgewebview2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\microsoft\edgewebview\application\138.0.3351.121\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3100"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserverC:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe—MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.195.65
Modules
Images
c:\users\admin\appdata\local\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
3108C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
25 526
Read events
23 241
Write events
2 217
Delete events
68

Modification events

(PID) Process:(6796) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:path
Value:
C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
(PID) Process:(6796) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:UninstallCmdLine
Value:
"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /uninstall
(PID) Process:(6796) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:pv
Value:
1.3.195.65
(PID) Process:(6796) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:name
Value:
Microsoft Edge Update
(PID) Process:(6796) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
Operation:writeName:pv
Value:
1.3.195.65
(PID) Process:(6796) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Microsoft Edge Update
Value:
"C:\Users\admin\AppData\Local\Microsoft\EdgeUpdate\1.3.195.65\MicrosoftEdgeUpdateCore.exe"
(PID) Process:(6796) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:edgeupdate_task_name_c
Value:
MicrosoftEdgeUpdateTaskUserS-1-5-21-1693682860-607145093-2874071422-1001Core{EBBE3CA0-F89B-4C83-AD81-A1FE1D5B363C}
(PID) Process:(6796) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:writeName:edgeupdate_task_name_ua
Value:
MicrosoftEdgeUpdateTaskUserS-1-5-21-1693682860-607145093-2874071422-1001UA{84CA8001-17C9-44E9-9C68-10D540D86C87}
(PID) Process:(6796) MicrosoftEdgeUpdate.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate
Operation:delete valueName:eulaaccepted
Value:
(PID) Process:(6304) MicrosoftEdgeUpdateComRegisterShell64.exeKey:HKEY_CLASSES_ROOT\CLSID\{81093D63-7825-417B-BFC8-ADC63FA4E53D}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Both
Executable files
210
Suspicious files
122
Text files
27
Unknown types
0

Dropped files

PID
Process
Filename
Type
1128MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUEEEF.tmp\MicrosoftEdgeUpdateBroker.exeexecutable
MD5:1AB505E831556BD56A75038062536E8E
SHA256:C438D3598CE4D2166AB2A636A585FF2C6E866E1355CB149DAA1C815488431D41
1604SvinLauncher1.exeC:\Users\admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exeexecutable
MD5:FB7FF07F000EF3F6EBF22B0044F0DC13
SHA256:1BDCFC30FD8F711134DDC400C39C126A7678ED5717E9E3A320BBF4F4E4DA2ED4
1128MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUEEEF.tmp\MicrosoftEdgeUpdate.exeexecutable
MD5:00F783B313796440834D82778F2850E5
SHA256:F4CE25C64DA2142B2CB7D9C5B0F1540D1718E4A5CEF38683634E7BA2636D7D7B
1128MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUEEEF.tmp\psuser_arm64.dllexecutable
MD5:4004A0CF7E0E15F50A2D8D37EBE0BDF4
SHA256:D947D243C39E273AB8FF6F27EA4EBE4C86A3C1901900DD0518116CAE2C48F3F3
1128MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUEEEF.tmp\EdgeUpdate.datbinary
MD5:369BBC37CFF290ADB8963DC5E518B9B8
SHA256:3D7EC761BEF1B1AF418B909F1C81CE577C769722957713FDAFBC8131B0A0C7D3
1128MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUEEEF.tmp\msedgeupdateres_bg.dllexecutable
MD5:BB056FAF64F82DA27A6569E3FD9D284A
SHA256:016B43C72B3AFAF95139348DF1DA0E9F32828F2FB4A1A9463A967238BD1E673B
1128MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUEEEF.tmp\MicrosoftEdgeUpdateCore.exeexecutable
MD5:79421D4F94A5C0C2726B483645035727
SHA256:206F308825A05D83E4207B5AEF0745377C672FEED2D6F56F9026A71BC3C9C988
1128MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUEEEF.tmp\NOTICE.TXTtext
MD5:6DD5BF0743F2366A0BDD37E302783BCD
SHA256:91D3FC490565DED7621FF5198960E501B6DB857D5DD45AF2FE7C3ECD141145F5
1128MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUEEEF.tmp\msedgeupdateres_am.dllexecutable
MD5:8922D946DEA77527E430AA2D931E4DE4
SHA256:9736025F5A99F2B440687C4EF66489FDE91F1261A33A6966F7C29861D2AD8302
1128MicrosoftEdgeWebview2Setup.exeC:\Users\admin\AppData\Local\Temp\EUEEEF.tmp\psuser_64.dllexecutable
MD5:91CA1359EB017D7FCBAF696FCEFCD3EE
SHA256:09C1A044F1E8D96F2E1E44EF04932D7BF27A0B53A97C08F0A5E3AB0FE90F4894
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
33
DNS requests
20
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5436
svchost.exe
HEAD
200
208.89.74.23:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/209bcf22-db22-4369-9d01-e5c1a213341e?P1=1754762581&P2=404&P3=2&P4=VgUX62oDWJCvGbOeORRenVozenD6Sb8T6bs6gViaok63m8iMzS%2fhzDyN4KXf6Jhij8wcBYx5P0OzfKYMMU0B1A%3d%3d
unknown
—
—
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
GET
200
150.171.22.17:443
https://config.edge.skype.com/config/v1/Edge/138.0.3351.121?clientId=8563719294765859660&agents=EdgeRuntimeConfig%2CEdgeDomainActions&osname=win&client=webview&channel=stable&scpfre=0&osarch=x86_64&osver=10.0.19045&wu=0&devicefamily=desktop&soobedate=1504771245&uma=0&sessionid=0&mngd=0&installdate=1754157856&edu=0&vm=0
unknown
binary
13.1 Kb
whitelisted
—
—
POST
200
150.171.27.11:443
https://edge.microsoft.com/componentupdater/api/v1/update?cup2key=7:aqZAnWm1d_x5pEMarxF4EZCspRVbBCpjNN08NIF0rNQ&cup2hreq=f0db61d662b63f7d8633a3e13485046dfcd0dc7c50fc59af53476680d0cc31a2
unknown
text
10.3 Kb
whitelisted
5436
svchost.exe
HEAD
200
208.89.74.17:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fb6dd03b-99d7-4cc8-a878-91c8e655c2d3?P1=1754359519&P2=404&P3=2&P4=QXV7FBwOw8p6fLXEHEReM5JGBZZRJqf6i%2bDwo%2bDP5M8rFQ7ckrV1bOdB%2fha53mFjR%2bspgLYDGT%2boNaqUthqDHw%3d%3d
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.216.77.36:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.216.77.36:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4084
RUXIMICS.exe
GET
200
72.246.169.155:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
72.246.169.155:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
72.246.169.155:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4084
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
23.216.77.36:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
23.216.77.36:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
72.246.169.155:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4084
RUXIMICS.exe
72.246.169.155:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5944
MoUsoCoreWorker.exe
72.246.169.155:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 23.216.77.36
  • 23.216.77.43
  • 23.216.77.28
  • 23.216.77.22
  • 23.216.77.42
  • 23.216.77.27
  • 23.216.77.39
  • 23.216.77.26
  • 23.216.77.29
whitelisted
www.microsoft.com
  • 72.246.169.155
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
msedge.sf.dl.delivery.mp.microsoft.com
  • 23.50.131.87
  • 23.50.131.88
whitelisted
config.edge.skype.com
  • 150.171.22.17
whitelisted
msedge.api.cdp.microsoft.com
  • 20.165.94.46
whitelisted
msedge.f.tlu.dl.delivery.mp.microsoft.com
  • 208.89.74.23
  • 208.89.74.17
  • 208.89.74.27
  • 208.89.74.31
  • 208.89.74.19
  • 208.89.74.21
  • 208.89.74.29
whitelisted
self.events.data.microsoft.com
  • 52.178.17.233
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
—
—
Misc activity
ET INFO Go-http-client User-Agent Observed Outbound
—
—
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
—
—
Misc activity
ET INFO Go-http-client User-Agent Observed Outbound
—
—
Misc activity
ET INFO Request for EXE via GO HTTP Client
—
—
Misc activity
ET INFO Packed Executable Download
5436
svchost.exe
Misc activity
ET INFO Packed Executable Download
Process
Message
msedgewebview2.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Roaming directory exists )
SvinLauncher1.exe
Warning: AddWebResourceRequestedFilter without SourceKind parameter is deprecated! It does not behave as expected for iframes.Please use AddWebResourceRequestedFilterWithRequestSourceKinds instead. For more information, please see https://go.microsoft.com/fwlink/?linkid=2286319
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SvinLauncher1.exe