URL:

https://sites.google.com/view/salexcheat

Full analysis: https://app.any.run/tasks/c29b89e7-e5c8-484f-be9f-9964c7e1ab79
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: August 07, 2024, 17:45:27
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
lumma
stealer
loader
xmrig
pastebin
miner
Indicators:
MD5:

5C5B9E08ECE5B456FEFFBA216E5E5CBB

SHA1:

366FBCBE948B2FB34370A57EEAFF266240BB7BB6

SHA256:

8B851D1201142DB9CFA09B6E27E80753A0DBDF3BA411FA2D57ADCDEE448A5E9F

SSDEEP:

3:N8BhLJ3u1v:2J+1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • SalexCheat.exe (PID: 7640)
      • 7z.exe (PID: 8184)
      • 7z.exe (PID: 4236)
      • 7z.exe (PID: 7596)
      • 7z.exe (PID: 3116)
      • 7z.exe (PID: 5944)
      • 7z.exe (PID: 3812)
      • cmd.exe (PID: 8132)
      • Installer.exe (PID: 5888)
      • 3MY64CE3J0KMDL9FAL78KSTI1CXB8.exe (PID: 7752)
      • 7z.exe (PID: 3104)
      • 7z.exe (PID: 7316)
      • 7z.exe (PID: 8000)
      • 7z.exe (PID: 7896)
      • 7z.exe (PID: 460)
      • 7z.exe (PID: 6812)
      • cmd.exe (PID: 5196)
      • RegSvcs.exe (PID: 2900)

    • Connects to the CnC server

      • svchost.exe (PID: 2256)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2256)
      • Installer.exe (PID: 5888)

    • Stealers network behavior

      • Installer.exe (PID: 5888)

    • Actions looks like stealing of personal data

      • Installer.exe (PID: 5888)

    • Scans artifacts that could help determine the target

      • Installer.exe (PID: 2584)

    • XMRig has been detected

      • RegSvcs.exe (PID: 2900)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 2476)
      • cmd.exe (PID: 252)

    • MINER has been detected (SURICATA)

      • RegSvcs.exe (PID: 2900)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 8136)
      • SalexCheat.exe (PID: 7640)
      • 3MY64CE3J0KMDL9FAL78KSTI1CXB8.exe (PID: 7752)
      • Installer.exe (PID: 2584)

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 8136)

    • Drops 7-zip archiver for unpacking

      • SalexCheat.exe (PID: 7640)
      • 3MY64CE3J0KMDL9FAL78KSTI1CXB8.exe (PID: 7752)

    • Executable content was dropped or overwritten

      • SalexCheat.exe (PID: 7640)
      • cmd.exe (PID: 8132)
      • 7z.exe (PID: 3812)
      • Installer.exe (PID: 5888)
      • 3MY64CE3J0KMDL9FAL78KSTI1CXB8.exe (PID: 7752)
      • 7z.exe (PID: 6812)
      • cmd.exe (PID: 5196)
      • RegSvcs.exe (PID: 2900)

    • Reads the date of Windows installation

      • SalexCheat.exe (PID: 7640)
      • 3MY64CE3J0KMDL9FAL78KSTI1CXB8.exe (PID: 7752)

    • The executable file from the user directory is run by the CMD process

      • 7z.exe (PID: 7320)
      • 7z.exe (PID: 1216)
      • 7z.exe (PID: 7928)
      • 7z.exe (PID: 7952)
      • 7z.exe (PID: 8028)
      • 7z.exe (PID: 8188)
      • 7z.exe (PID: 8184)
      • 7z.exe (PID: 4236)
      • 7z.exe (PID: 7596)
      • 7z.exe (PID: 3116)
      • 7z.exe (PID: 5944)
      • 7z.exe (PID: 3812)
      • Installer.exe (PID: 7920)
      • Installer.exe (PID: 8168)
      • Installer.exe (PID: 5888)
      • 7z.exe (PID: 6732)
      • 7z.exe (PID: 7316)
      • 7z.exe (PID: 3104)
      • 7z.exe (PID: 2208)
      • 7z.exe (PID: 8000)
      • 7z.exe (PID: 7896)
      • 7z.exe (PID: 6812)
      • Installer.exe (PID: 2584)
      • 7z.exe (PID: 460)

    • Starts CMD.EXE for commands execution

      • SalexCheat.exe (PID: 7640)
      • 3MY64CE3J0KMDL9FAL78KSTI1CXB8.exe (PID: 7752)
      • RegSvcs.exe (PID: 2900)

    • Executing commands from a ".bat" file

      • SalexCheat.exe (PID: 7640)
      • 3MY64CE3J0KMDL9FAL78KSTI1CXB8.exe (PID: 7752)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 8132)
      • cmd.exe (PID: 5196)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2256)
      • Installer.exe (PID: 5888)

    • Searches for installed software

      • Installer.exe (PID: 5888)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 7248)

    • BASE64 encoded PowerShell command has been detected

      • cmd.exe (PID: 7248)

    • Creates file in the systems drive root

      • RegSvcs.exe (PID: 2900)

    • The process creates files with name similar to system file names

      • RegSvcs.exe (PID: 2900)

    • Base64-obfuscated command line is found

      • cmd.exe (PID: 7248)

    • Drops a system driver (possible attempt to evade defenses)

      • RegSvcs.exe (PID: 2900)

    • Connects to the server without a host name

      • RegSvcs.exe (PID: 2900)

    • Potential Corporate Privacy Violation

      • RegSvcs.exe (PID: 2900)

    • Process requests binary or script from the Internet

      • RegSvcs.exe (PID: 2900)

    • Crypto Currency Mining Activity Detected

      • RegSvcs.exe (PID: 2900)

  • INFO

    • Reads Environment values

      • identity_helper.exe (PID: 6340)
      • RegSvcs.exe (PID: 2900)

    • Reads Microsoft Office registry keys

      • msedge.exe (PID: 6480)

    • The process uses the downloaded file

      • msedge.exe (PID: 7876)
      • WinRAR.exe (PID: 8136)
      • msedge.exe (PID: 6480)

    • Application launched itself

      • msedge.exe (PID: 6480)

    • Checks supported languages

      • identity_helper.exe (PID: 6340)
      • SalexCheat.exe (PID: 7640)
      • 7z.exe (PID: 7320)
      • 7z.exe (PID: 1216)
      • 7z.exe (PID: 7928)
      • 7z.exe (PID: 7952)
      • 7z.exe (PID: 8028)
      • 7z.exe (PID: 8188)
      • 7z.exe (PID: 8184)
      • 7z.exe (PID: 4236)
      • mode.com (PID: 6400)
      • 7z.exe (PID: 7596)
      • 7z.exe (PID: 3116)
      • 7z.exe (PID: 5944)
      • 7z.exe (PID: 3812)
      • Installer.exe (PID: 5888)
      • 3MY64CE3J0KMDL9FAL78KSTI1CXB8.exe (PID: 7752)
      • mode.com (PID: 640)
      • 7z.exe (PID: 3104)
      • 7z.exe (PID: 7316)
      • 7z.exe (PID: 7896)
      • 7z.exe (PID: 460)
      • 7z.exe (PID: 8000)
      • 7z.exe (PID: 6812)
      • RegSvcs.exe (PID: 2900)
      • Installer.exe (PID: 2584)
      • 7z.exe (PID: 6732)
      • 7z.exe (PID: 2208)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 8136)

    • Reads the computer name

      • identity_helper.exe (PID: 6340)
      • SalexCheat.exe (PID: 7640)
      • 7z.exe (PID: 1216)
      • 7z.exe (PID: 7928)
      • 7z.exe (PID: 7952)
      • 7z.exe (PID: 8028)
      • 7z.exe (PID: 8188)
      • 7z.exe (PID: 8184)
      • 7z.exe (PID: 4236)
      • 7z.exe (PID: 7320)
      • 7z.exe (PID: 7596)
      • 7z.exe (PID: 3116)
      • 7z.exe (PID: 5944)
      • 7z.exe (PID: 3812)
      • Installer.exe (PID: 5888)
      • 3MY64CE3J0KMDL9FAL78KSTI1CXB8.exe (PID: 7752)
      • 7z.exe (PID: 3104)
      • 7z.exe (PID: 7316)
      • 7z.exe (PID: 8000)
      • 7z.exe (PID: 460)
      • 7z.exe (PID: 6812)
      • Installer.exe (PID: 2584)
      • RegSvcs.exe (PID: 2900)
      • 7z.exe (PID: 2208)
      • 7z.exe (PID: 6732)
      • 7z.exe (PID: 7896)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 8136)

    • Create files in a temporary directory

      • SalexCheat.exe (PID: 7640)
      • 7z.exe (PID: 1216)
      • 7z.exe (PID: 7928)
      • 7z.exe (PID: 7952)
      • 7z.exe (PID: 8028)
      • 7z.exe (PID: 8188)
      • 7z.exe (PID: 8184)
      • 7z.exe (PID: 4236)
      • 7z.exe (PID: 7320)
      • 7z.exe (PID: 7596)
      • 7z.exe (PID: 3116)
      • 7z.exe (PID: 5944)
      • 7z.exe (PID: 3812)
      • Installer.exe (PID: 5888)
      • 3MY64CE3J0KMDL9FAL78KSTI1CXB8.exe (PID: 7752)
      • 7z.exe (PID: 3104)
      • 7z.exe (PID: 2208)
      • 7z.exe (PID: 8000)
      • 7z.exe (PID: 7896)
      • 7z.exe (PID: 7316)
      • 7z.exe (PID: 460)
      • 7z.exe (PID: 6812)
      • RegSvcs.exe (PID: 2900)
      • 7z.exe (PID: 6732)

    • Process checks computer location settings

      • SalexCheat.exe (PID: 7640)
      • 3MY64CE3J0KMDL9FAL78KSTI1CXB8.exe (PID: 7752)

    • Reads the software policy settings

      • Installer.exe (PID: 5888)
      • RegSvcs.exe (PID: 2900)

    • Checks proxy server information

      • Installer.exe (PID: 2584)
      • RegSvcs.exe (PID: 2900)

    • Creates files in the program directory

      • RegSvcs.exe (PID: 2900)

    • Disables trace logs

      • RegSvcs.exe (PID: 2900)

    • Reads the machine GUID from the registry

      • RegSvcs.exe (PID: 2900)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7644)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7644)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
249
Monitored processes
105
Malicious processes
10
Suspicious processes
2

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs winrar.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs salexcheat.exe cmd.exe conhost.exe no specs mode.com no specs 7z.exe no specs 7z.exe no specs 7z.exe no specs 7z.exe no specs 7z.exe no specs 7z.exe no specs 7z.exe no specs 7z.exe no specs 7z.exe no specs 7z.exe no specs 7z.exe no specs 7z.exe attrib.exe no specs installer.exe no specs installer.exe no specs #LUMMA installer.exe #LUMMA svchost.exe msedge.exe no specs msedge.exe no specs msedge.exe 3my64ce3j0kmdl9fal78ksti1cxb8.exe cmd.exe conhost.exe no specs mode.com no specs 7z.exe no specs 7z.exe no specs 7z.exe no specs 7z.exe no specs 7z.exe no specs 7z.exe no specs 7z.exe no specs 7z.exe attrib.exe no specs installer.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs #MINER regsvcs.exe cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs schtasks.exe no specs schtasks.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs ucpdmgr.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5468 --field-trial-handle=2380,i,9154417580401923126,10773239836360361052,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
252"cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"C:\Windows\SysWOW64\cmd.exe—RegSvcs.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
4294967295
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
360"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.3636 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=7948 --field-trial-handle=2380,i,9154417580401923126,10773239836360361052,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4607z.exe e extracted/file_2.zip -oextractedC:\Users\admin\AppData\Local\Temp\main\7z.exe—cmd.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Console
Exit code:
0
Version:
19.00
Modules
Images
c:\users\admin\appdata\local\temp\main\7z.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
640mode 65,10C:\Windows\System32\mode.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
DOS Device MODE Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mode.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
640SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"C:\Windows\SysWOW64\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
888\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1020"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4468 --field-trial-handle=2380,i,9154417580401923126,10773239836360361052,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
12167z.exe e extracted/file_11.zip -oextractedC:\Users\admin\AppData\Local\Temp\main\7z.exe—cmd.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip Console
Exit code:
0
Version:
19.00
Modules
Images
c:\users\admin\appdata\local\temp\main\7z.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
1432\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
38 621
Read events
38 403
Write events
212
Delete events
6

Modification events

(PID) Process:(6480) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6480) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6480) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(6480) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(6480) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(6480) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:dr
Value:
1
(PID) Process:(6480) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(6480) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge
Operation:writeName:UsageStatsInSample
Value:
1
(PID) Process:(6480) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:usagestats
Value:
0
(PID) Process:(6480) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:urlstats
Value:
0
Executable files
15
Suspicious files
431
Text files
117
Unknown types
46

Dropped files

PID
Process
Filename
Type
6480msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RFe53a9.TMP —
MD5:—
SHA256:—
6480msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
6480msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RFe53a9.TMP —
MD5:—
SHA256:—
6480msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RFe53b9.TMP —
MD5:—
SHA256:—
6480msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
6480msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
6480msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RFe53b9.TMP —
MD5:—
SHA256:—
6480msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
6480msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RFe53c9.TMP —
MD5:—
SHA256:—
6480msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
38
TCP/UDP connections
342
DNS requests
368
Threats
45

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5552
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5552
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7252
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5552
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
964
svchost.exe
HEAD
200
152.199.19.161:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8c130d2f-1a45-445f-88a5-07fb8663d0df?P1=1723582610&P2=404&P3=2&P4=FUurbtDRZkE1Gyzb3dDKiRSbkIyeE5CjA%2fJ3s3z4%2fXLx5xSqsyY8cZ0DH9TEaDq8bdznxvWwXe3LOeJPHYgWEA%3d%3d
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
964
svchost.exe
GET
206
152.199.19.161:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8c130d2f-1a45-445f-88a5-07fb8663d0df?P1=1723582610&P2=404&P3=2&P4=FUurbtDRZkE1Gyzb3dDKiRSbkIyeE5CjA%2fJ3s3z4%2fXLx5xSqsyY8cZ0DH9TEaDq8bdznxvWwXe3LOeJPHYgWEA%3d%3d
unknown
—
—
whitelisted
7196
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
—
—
GET
200
147.45.47.81:80
http://147.45.47.81/conhost.exe
unknown
—
—
suspicious
964
svchost.exe
GET
206
152.199.19.161:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/8c130d2f-1a45-445f-88a5-07fb8663d0df?P1=1723582610&P2=404&P3=2&P4=FUurbtDRZkE1Gyzb3dDKiRSbkIyeE5CjA%2fJ3s3z4%2fXLx5xSqsyY8cZ0DH9TEaDq8bdznxvWwXe3LOeJPHYgWEA%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4016
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2424
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
6808
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6480
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
6808
msedge.exe
204.79.197.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
6808
msedge.exe
13.107.246.45:443
edge-mobile-static.azureedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
6808
msedge.exe
142.250.185.78:443
sites.google.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 142.250.185.206
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
sites.google.com
  • 142.250.185.78
  • 216.58.206.78
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.45
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
bzib.nelreports.net
  • 23.48.23.151
  • 23.48.23.152
  • 2.19.126.152
  • 2.19.126.145
whitelisted
www.bing.com
  • 95.100.146.10
  • 95.100.146.17
  • 95.100.146.8
  • 95.100.146.35
  • 95.100.146.27
  • 95.100.146.25
  • 95.100.146.18
  • 95.100.146.40
  • 95.100.146.32
  • 95.100.146.19
  • 95.100.146.26
  • 2.23.209.176
  • 2.23.209.148
  • 2.23.209.179
  • 2.23.209.150
  • 2.23.209.177
  • 2.23.209.182
  • 2.23.209.149
  • 2.23.209.185
  • 2.23.209.158
  • 2.23.209.130
  • 2.23.209.135
  • 2.23.209.189
  • 2.23.209.141
  • 2.23.209.187
  • 2.23.209.140
  • 2.23.209.133
whitelisted
apis.google.com
  • 142.250.185.78
whitelisted

Threats

PID
Process
Class
Message
6808
msedge.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
6808
msedge.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
6808
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
6808
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
6808
msedge.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
6808
msedge.exe
Potentially Bad Traffic
ET HUNTING File Sharing Related Domain (www .mediafire .com) in DNS Lookup
6808
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
6808
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
6808
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
6808
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
1 ETPRO signatures available at the full report
Process
Message
msedge.exe
[0807/174608.091:WARNING:device_ticket.cc(151)] Timed out waiting for device ticket. Canceling async operation.
msedge.exe
[0807/174608.681:ERROR:process_memory_win.cc(74)] ReadMemory at 0x7ff6278d0000 of 64 bytes failed: Only part of a ReadProcessMemory or WriteProcessMemory request was completed. (0x12B)
msedge.exe
[0807/174608.682:WARNING:pe_image_reader.cc(340)] could not read dos header from C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
[0807/174608.682:ERROR:process_memory_win.cc(74)] ReadMemory at 0x7ffff85f0000 of 64 bytes failed: Only part of a ReadProcessMemory or WriteProcessMemory request was completed. (0x12B)
msedge.exe
[0807/174608.682:WARNING:pe_image_reader.cc(340)] could not read dos header from C:\WINDOWS\SYSTEM32\ntdll.dll
msedge.exe
[0807/174608.682:ERROR:process_memory_win.cc(74)] ReadMemory at 0x7ffff6f10000 of 64 bytes failed: Only part of a ReadProcessMemory or WriteProcessMemory request was completed. (0x12B)
msedge.exe
[0807/174608.682:WARNING:pe_image_reader.cc(340)] could not read dos header from C:\WINDOWS\System32\KERNEL32.DLL
msedge.exe
[0807/174608.683:ERROR:process_memory_win.cc(74)] ReadMemory at 0x7ffff5da0000 of 64 bytes failed: Only part of a ReadProcessMemory or WriteProcessMemory request was completed. (0x12B)
msedge.exe
[0807/174608.683:WARNING:pe_image_reader.cc(340)] could not read dos header from C:\WINDOWS\System32\KERNELBASE.dll
msedge.exe
[0807/174608.683:ERROR:process_memory_win.cc(74)] ReadMemory at 0x7fffcb390000 of 64 bytes failed: Only part of a ReadProcessMemory or WriteProcessMemory request was completed. (0x12B)
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://sites.google.com/view/salexcheat