URL:

https://www.rewasd.com/joystick-mapper

Full analysis: https://app.any.run/tasks/93fe8348-1902-4ce7-b8c2-160ce0dc21d4
Verdict: Malicious activity
Analysis date: August 28, 2024, 13:09:58
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MD5:

239EC0592AED73747B488ACC0C6B477F

SHA1:

F1B805110BF0F3EF4094C73254261127FD227ED9

SHA256:

8B9C68254B9A9A0761AB4C9FCBE9418BFA42359F06BB5E02D664F87C23ECB94A

SSDEEP:

3:N8DSLQKfWMGnWX:2OLQKu2X

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • windowsdesktop-runtime-8.0.3-win-x86.exe (PID: 7540)
      • AspNetCoreSharedFrameworkBundle-x86.exe (PID: 7164)
      • reWASD730-9159.exe (PID: 7744)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • reWASD730-9159.exe (PID: 7744)
      • windowsdesktop-runtime-win-x86.exe (PID: 6488)
      • aspnetcore-runtime-x86.exe (PID: 4996)

    • Drops the executable file immediately after the start

      • reWASD730-9159.exe (PID: 7744)
      • windowsdesktop-runtime-win-x86.exe (PID: 4404)
      • windowsdesktop-runtime-win-x86.exe (PID: 6488)
      • windowsdesktop-runtime-8.0.3-win-x86.exe (PID: 7540)
      • msiexec.exe (PID: 6672)
      • aspnetcore-runtime-x86.exe (PID: 6812)
      • aspnetcore-runtime-x86.exe (PID: 4996)
      • AspNetCoreSharedFrameworkBundle-x86.exe (PID: 7164)
      • rwsdsvc.exe (PID: 6180)
      • drvinst.exe (PID: 3208)
      • drvinst.exe (PID: 7756)

    • Process drops legitimate windows executable

      • reWASD730-9159.exe (PID: 7744)
      • windowsdesktop-runtime-win-x86.exe (PID: 4404)
      • windowsdesktop-runtime-win-x86.exe (PID: 6488)
      • windowsdesktop-runtime-8.0.3-win-x86.exe (PID: 7540)
      • msiexec.exe (PID: 6672)
      • aspnetcore-runtime-x86.exe (PID: 6812)
      • aspnetcore-runtime-x86.exe (PID: 4996)
      • AspNetCoreSharedFrameworkBundle-x86.exe (PID: 7164)

    • Reads the date of Windows installation

      • reWASD730-9159.exe (PID: 7744)
      • windowsdesktop-runtime-win-x86.exe (PID: 6488)
      • aspnetcore-runtime-x86.exe (PID: 4996)

    • Starts a Microsoft application from unusual location

      • windowsdesktop-runtime-win-x86.exe (PID: 4404)
      • windowsdesktop-runtime-win-x86.exe (PID: 6488)
      • windowsdesktop-runtime-8.0.3-win-x86.exe (PID: 7540)
      • aspnetcore-runtime-x86.exe (PID: 6812)
      • aspnetcore-runtime-x86.exe (PID: 4996)
      • AspNetCoreSharedFrameworkBundle-x86.exe (PID: 7164)

    • Executable content was dropped or overwritten

      • windowsdesktop-runtime-win-x86.exe (PID: 4404)
      • windowsdesktop-runtime-win-x86.exe (PID: 6488)
      • windowsdesktop-runtime-8.0.3-win-x86.exe (PID: 7540)
      • aspnetcore-runtime-x86.exe (PID: 6812)
      • aspnetcore-runtime-x86.exe (PID: 4996)
      • reWASD730-9159.exe (PID: 7744)
      • AspNetCoreSharedFrameworkBundle-x86.exe (PID: 7164)
      • rwsdsvc.exe (PID: 6180)
      • drvinst.exe (PID: 3208)
      • drvinst.exe (PID: 7756)

    • Searches for installed software

      • windowsdesktop-runtime-win-x86.exe (PID: 6488)
      • windowsdesktop-runtime-8.0.3-win-x86.exe (PID: 7540)
      • aspnetcore-runtime-x86.exe (PID: 4996)
      • AspNetCoreSharedFrameworkBundle-x86.exe (PID: 7164)
      • dllhost.exe (PID: 4804)
      • reWASD730-9159.exe (PID: 7744)
      • rwsdsvc.exe (PID: 6180)

    • Starts itself from another location

      • windowsdesktop-runtime-win-x86.exe (PID: 6488)
      • aspnetcore-runtime-x86.exe (PID: 4996)

    • Creates a software uninstall entry

      • windowsdesktop-runtime-8.0.3-win-x86.exe (PID: 7540)
      • AspNetCoreSharedFrameworkBundle-x86.exe (PID: 7164)
      • reWASD730-9159.exe (PID: 7744)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 6672)

    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 6672)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6672)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 6672)

    • Drops 7-zip archiver for unpacking

      • reWASD730-9159.exe (PID: 7744)

    • Executes as Windows Service

      • VSSVC.exe (PID: 5124)
      • rwsdsvc.exe (PID: 1044)

    • Drops a system driver (possible attempt to evade defenses)

      • rwsdsvc.exe (PID: 6180)
      • drvinst.exe (PID: 3208)
      • drvinst.exe (PID: 7756)

    • Likely accesses (executes) a file from the Public directory

      • logman.exe (PID: 5212)
      • logman.exe (PID: 5520)

    • Suspicious use of NETSH.EXE

      • reWASD730-9159.exe (PID: 7744)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • reWASD730-9159.exe (PID: 7744)

  • INFO

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 6764)
      • msedge.exe (PID: 4980)
      • msiexec.exe (PID: 6672)

    • Checks proxy server information

      • reWASD730-9159.exe (PID: 7744)
      • slui.exe (PID: 8092)

    • Checks supported languages

      • identity_helper.exe (PID: 236)
      • reWASD730-9159.exe (PID: 7744)
      • identity_helper.exe (PID: 736)
      • windowsdesktop-runtime-win-x86.exe (PID: 4404)
      • windowsdesktop-runtime-win-x86.exe (PID: 6488)
      • windowsdesktop-runtime-8.0.3-win-x86.exe (PID: 7540)
      • msiexec.exe (PID: 6672)
      • msiexec.exe (PID: 6460)
      • msiexec.exe (PID: 5000)
      • msiexec.exe (PID: 1608)
      • aspnetcore-runtime-x86.exe (PID: 6812)
      • msiexec.exe (PID: 7292)
      • AspNetCoreSharedFrameworkBundle-x86.exe (PID: 7164)
      • aspnetcore-runtime-x86.exe (PID: 4996)
      • rwsdsvc.exe (PID: 6180)
      • rwsdsvc.exe (PID: 2080)

    • Reads the computer name

      • identity_helper.exe (PID: 236)
      • reWASD730-9159.exe (PID: 7744)
      • identity_helper.exe (PID: 736)
      • windowsdesktop-runtime-win-x86.exe (PID: 6488)
      • windowsdesktop-runtime-8.0.3-win-x86.exe (PID: 7540)
      • msiexec.exe (PID: 6672)
      • msiexec.exe (PID: 5000)
      • msiexec.exe (PID: 6460)
      • msiexec.exe (PID: 7292)
      • msiexec.exe (PID: 1608)
      • aspnetcore-runtime-x86.exe (PID: 4996)
      • AspNetCoreSharedFrameworkBundle-x86.exe (PID: 7164)
      • rwsdsvc.exe (PID: 6180)

    • Reads Microsoft Office registry keys

      • msedge.exe (PID: 6764)
      • msedge.exe (PID: 7648)

    • Application launched itself

      • msedge.exe (PID: 6764)
      • msedge.exe (PID: 7648)

    • Reads the machine GUID from the registry

      • reWASD730-9159.exe (PID: 7744)
      • windowsdesktop-runtime-8.0.3-win-x86.exe (PID: 7540)
      • msiexec.exe (PID: 6672)
      • AspNetCoreSharedFrameworkBundle-x86.exe (PID: 7164)

    • Creates files in the program directory

      • reWASD730-9159.exe (PID: 7744)
      • windowsdesktop-runtime-8.0.3-win-x86.exe (PID: 7540)
      • AspNetCoreSharedFrameworkBundle-x86.exe (PID: 7164)
      • rwsdsvc.exe (PID: 6180)

    • Reads the software policy settings

      • reWASD730-9159.exe (PID: 7744)
      • slui.exe (PID: 7564)
      • msiexec.exe (PID: 6672)
      • slui.exe (PID: 8092)

    • Reads Environment values

      • identity_helper.exe (PID: 736)
      • identity_helper.exe (PID: 236)
      • reWASD730-9159.exe (PID: 7744)

    • Process checks computer location settings

      • reWASD730-9159.exe (PID: 7744)
      • windowsdesktop-runtime-win-x86.exe (PID: 6488)
      • aspnetcore-runtime-x86.exe (PID: 4996)

    • Create files in a temporary directory

      • windowsdesktop-runtime-win-x86.exe (PID: 6488)
      • windowsdesktop-runtime-8.0.3-win-x86.exe (PID: 7540)
      • aspnetcore-runtime-x86.exe (PID: 4996)
      • reWASD730-9159.exe (PID: 7744)
      • AspNetCoreSharedFrameworkBundle-x86.exe (PID: 7164)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 6672)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 6672)

    • Disables trace logs

      • reWASD730-9159.exe (PID: 7744)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
253
Monitored processes
115
Malicious processes
11
Suspicious processes
2

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs sppextcomobj.exe no specs slui.exe msedge.exe no specs rewasd730-9159.exe no specs rewasd730-9159.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs slui.exe windowsdesktop-runtime-win-x86.exe windowsdesktop-runtime-win-x86.exe windowsdesktop-runtime-8.0.3-win-x86.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msiexec.exe msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs aspnetcore-runtime-x86.exe aspnetcore-runtime-x86.exe aspnetcoresharedframeworkbundle-x86.exe SPPSurrogate no specs vssvc.exe no specs msedge.exe no specs srtasks.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs logman.exe no specs conhost.exe no specs logman.exe no specs conhost.exe no specs rwsdsvc.exe no specs rwsdsvc.exe msedge.exe no specs srtasks.exe no specs conhost.exe no specs drvinst.exe drvinst.exe drvinst.exe no specs msedge.exe no specs rwsdsvc.exe no specs rwsdsvc.exe no specs logman.exe no specs conhost.exe no specs logman.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
236"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6624 --field-trial-handle=2388,i,8505512657126148668,49610861372989317,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\identity_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
508"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2652 --field-trial-handle=2388,i,8505512657126148668,49610861372989317,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
736"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4752 --field-trial-handle=2268,i,10191034882509517426,5172570766476340965,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\identity_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
964"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=6172 --field-trial-handle=2388,i,8505512657126148668,49610861372989317,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1020"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7452 --field-trial-handle=2388,i,8505512657126148668,49610861372989317,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1044"C:\Program Files\reWASD\rwsdsvc.exe"C:\Program Files\reWASD\rwsdsvc.exe—services.exe
User:
SYSTEM
Company:
Disc Soft Ltd
Integrity Level:
SYSTEM
Description:
Game Controller Mapping Service
Version:
5.42.0.0
1140"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4288 --field-trial-handle=2388,i,8505512657126148668,49610861372989317,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1332\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—logman.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1332\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
1492"netsh.exe" http add urlacl url=http://localhost:35476/ sddl=D:(A;;GX;;;S-1-1-0)C:\Windows\SysWOW64\netsh.exe—reWASD730-9159.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Total events
42 279
Read events
40 622
Write events
1 561
Delete events
96

Modification events

(PID) Process:(6764) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6764) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6764) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(6764) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(6764) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(6764) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:dr
Value:
1
(PID) Process:(6764) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(6764) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge
Operation:writeName:UsageStatsInSample
Value:
1
(PID) Process:(6764) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:usagestats
Value:
0
(PID) Process:(6764) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:urlstats
Value:
0
Executable files
707
Suspicious files
264
Text files
185
Unknown types
35

Dropped files

PID
Process
Filename
Type
6764msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF12b416.TMP —
MD5:—
SHA256:—
6764msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
6764msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF12b425.TMP —
MD5:—
SHA256:—
6764msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
6764msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF12b425.TMP —
MD5:—
SHA256:—
6764msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
6764msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF12b435.TMP —
MD5:—
SHA256:—
6764msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
6764msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF12b454.TMP —
MD5:—
SHA256:—
6764msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
26
TCP/UDP connections
127
DNS requests
97
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1440
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7288
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
7288
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6672
msiexec.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
unknown
—
—
whitelisted
7156
svchost.exe
HEAD
200
2.16.10.177:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/4e7e4c6f-7b62-49ca-a1fd-f625399e76b3?P1=1725324945&P2=404&P3=2&P4=lOTBVE1FeiOxNnOMpqn6a4v9CJe69dKm3wgpqSIz7xsy6y%2fqz7Fzw0oL%2f9aRPTbGd2e4VIqpa%2bmG67AkF1zdSw%3d%3d
unknown
—
—
whitelisted
7156
svchost.exe
GET
206
2.16.10.177:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/4e7e4c6f-7b62-49ca-a1fd-f625399e76b3?P1=1725324945&P2=404&P3=2&P4=lOTBVE1FeiOxNnOMpqn6a4v9CJe69dKm3wgpqSIz7xsy6y%2fqz7Fzw0oL%2f9aRPTbGd2e4VIqpa%2bmG67AkF1zdSw%3d%3d
unknown
—
—
whitelisted
7156
svchost.exe
GET
206
2.16.10.177:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/4e7e4c6f-7b62-49ca-a1fd-f625399e76b3?P1=1725324945&P2=404&P3=2&P4=lOTBVE1FeiOxNnOMpqn6a4v9CJe69dKm3wgpqSIz7xsy6y%2fqz7Fzw0oL%2f9aRPTbGd2e4VIqpa%2bmG67AkF1zdSw%3d%3d
unknown
—
—
whitelisted
7156
svchost.exe
GET
206
2.16.10.177:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/4e7e4c6f-7b62-49ca-a1fd-f625399e76b3?P1=1725324945&P2=404&P3=2&P4=lOTBVE1FeiOxNnOMpqn6a4v9CJe69dKm3wgpqSIz7xsy6y%2fqz7Fzw0oL%2f9aRPTbGd2e4VIqpa%2bmG67AkF1zdSw%3d%3d
unknown
—
—
whitelisted
7156
svchost.exe
GET
206
2.16.10.177:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/4e7e4c6f-7b62-49ca-a1fd-f625399e76b3?P1=1725324945&P2=404&P3=2&P4=lOTBVE1FeiOxNnOMpqn6a4v9CJe69dKm3wgpqSIz7xsy6y%2fqz7Fzw0oL%2f9aRPTbGd2e4VIqpa%2bmG67AkF1zdSw%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3260
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6764
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
4980
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4980
msedge.exe
204.79.197.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4980
msedge.exe
3.77.164.15:443
www.rewasd.com
AMAZON-02
DE
unknown
4980
msedge.exe
13.107.246.67:443
edge-mobile-static.azureedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4980
msedge.exe
94.245.104.56:443
api.edgeoffer.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4980
msedge.exe
13.107.6.158:443
business.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
google.com
  • 172.217.18.110
whitelisted
client.wns.windows.com
  • 40.115.3.253
  • 40.113.110.67
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
www.rewasd.com
  • 3.77.164.15
  • 18.193.135.221
  • 18.196.168.15
  • 18.185.202.144
  • 18.194.30.182
  • 18.193.31.47
  • 52.58.170.245
  • 3.77.183.207
unknown
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.67
whitelisted
api.edgeoffer.microsoft.com
  • 94.245.104.56
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
bzib.nelreports.net
  • 23.48.23.51
  • 23.48.23.26
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.rewasd.com/joystick-mapper