URL:

zh-cn.emeditor.com

Full analysis: https://app.any.run/tasks/f9f14ed6-751e-43ec-95ac-85ed4c568cee
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: July 14, 2025, 10:38:55
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
adware
advancedinstaller
rust
Indicators:
MD5:

CE01E0FDF51B71EECF4DCF404F36FA48

SHA1:

3F0AB67F9821EF66B943AF3C9D2391D9F93EDAD2

SHA256:

91C1FA7EBF3D56E8D40B41FD735EEE548B28A60082B43C2EE55BE8E8B46FA6B7

SSDEEP:

3:9/sbK:97

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • EmEditor.exe (PID: 5876)

    • ADVANCEDINSTALLER has been detected (SURICATA)

      • eeupdate.exe (PID: 7292)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 1944)
      • msiexec.exe (PID: 7652)

    • Executes as Windows Service

      • VSSVC.exe (PID: 5500)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 7652)

    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 7652)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 7652)

    • Reads security settings of Internet Explorer

      • EmEditor.exe (PID: 5876)
      • msiexec.exe (PID: 3760)
      • eeupdate.exe (PID: 7292)

    • Reads the date of Windows installation

      • EmEditor.exe (PID: 5876)

    • Access to an unwanted program domain was detected

      • eeupdate.exe (PID: 7292)

    • There is functionality for taking screenshot (YARA)

      • EmEditor.exe (PID: 5876)

  • INFO

    • Application launched itself

      • msedge.exe (PID: 3540)
      • firefox.exe (PID: 2168)
      • firefox.exe (PID: 4540)

    • Checks supported languages

      • identity_helper.exe (PID: 7736)
      • msiexec.exe (PID: 7652)
      • msiexec.exe (PID: 1944)
      • msiexec.exe (PID: 3760)
      • msiexec.exe (PID: 7772)
      • EmEditor.exe (PID: 5876)
      • eeupdate.exe (PID: 7292)
      • emedtray.exe (PID: 7032)
      • eehlpver.exe (PID: 1268)
      • eehlpver.exe (PID: 7328)
      • eehlpver.exe (PID: 8080)
      • eehlpver.exe (PID: 2132)
      • eehlpver.exe (PID: 4052)
      • eehlpver.exe (PID: 7272)

    • Reads the computer name

      • identity_helper.exe (PID: 7736)
      • msiexec.exe (PID: 7652)
      • msiexec.exe (PID: 1944)
      • msiexec.exe (PID: 3760)
      • msiexec.exe (PID: 7772)
      • EmEditor.exe (PID: 5876)
      • eeupdate.exe (PID: 7292)

    • Reads Environment values

      • identity_helper.exe (PID: 7736)
      • msiexec.exe (PID: 1944)
      • msiexec.exe (PID: 3760)
      • msiexec.exe (PID: 7772)
      • eeupdate.exe (PID: 7292)

    • Reads Microsoft Office registry keys

      • msedge.exe (PID: 3540)
      • OpenWith.exe (PID: 7456)
      • firefox.exe (PID: 4540)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 1068)
      • OpenWith.exe (PID: 7456)

    • Reads the software policy settings

      • msiexec.exe (PID: 1068)
      • slui.exe (PID: 7884)
      • msiexec.exe (PID: 7652)
      • EmEditor.exe (PID: 5876)
      • eeupdate.exe (PID: 7292)

    • Create files in a temporary directory

      • msiexec.exe (PID: 1068)
      • msiexec.exe (PID: 1944)

    • The sample compiled with english language support

      • msiexec.exe (PID: 1944)
      • msiexec.exe (PID: 1068)
      • msiexec.exe (PID: 7652)
      • firefox.exe (PID: 4540)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 1944)
      • msiexec.exe (PID: 1068)
      • msiexec.exe (PID: 7652)
      • firefox.exe (PID: 4540)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 7652)
      • EmEditor.exe (PID: 5876)
      • eeupdate.exe (PID: 7292)

    • Manages system restore points

      • SrTasks.exe (PID: 6352)

    • Checks proxy server information

      • slui.exe (PID: 7884)
      • EmEditor.exe (PID: 5876)
      • eeupdate.exe (PID: 7292)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 7652)
      • msiexec.exe (PID: 7772)
      • EmEditor.exe (PID: 5876)
      • eeupdate.exe (PID: 7292)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 7652)

    • Process checks computer location settings

      • msiexec.exe (PID: 3760)
      • EmEditor.exe (PID: 5876)
      • eeupdate.exe (PID: 7292)

    • Launching a file from the Startup directory

      • EmEditor.exe (PID: 5876)

    • Creates files in the program directory

      • eeupdate.exe (PID: 7292)

    • Application based on Rust

      • EmEditor.exe (PID: 5876)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
230
Monitored processes
79
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msiexec.exe msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs msedge.exe no specs msedge.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs emeditor.exe emedtray.exe no specs #ADVANCEDINSTALLER eeupdate.exe eehlpver.exe no specs eehlpver.exe no specs eehlpver.exe no specs eehlpver.exe no specs eehlpver.exe no specs eehlpver.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs rundll32.exe no specs openwith.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs msedge.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
480"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.3636 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=7056,i,15303900467456377608,18133485067877328590,262144 --variations-seed-version --mojo-platform-channel-handle=7732 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1068"C:\WINDOWS\System32\msiexec.exe" /i "C:\Users\admin\Downloads\emed64_25.2.2.msi" C:\Windows\System32\msiexec.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1208"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=7740,i,15303900467456377608,18133485067877328590,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1232"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --field-trial-handle=6368,i,15303900467456377608,18133485067877328590,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1268"C:\Users\admin\AppData\Local\Programs\EmEditor\eehlpver.exe" chatai 25.2.2C:\Users\admin\AppData\Local\Programs\EmEditor\eehlpver.exe—eeupdate.exe
User:
admin
Company:
Emurasoft, Inc.
Integrity Level:
MEDIUM
Description:
EmEditor program for updater
Exit code:
1
Version:
25.2.2.0
Modules
Images
c:\users\admin\appdata\local\programs\emeditor\eehlpver.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1412"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250227124745 -prefsHandle 3280 -prefsLen 36996 -prefMapHandle 3272 -prefMapSize 272997 -ipcHandle 3304 -initialChannelId {f3511c79-093c-4dac-87d6-31f425b98ae1} -parentPid 4540 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4540" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rddC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
1728"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4288,i,15303900467456377608,18133485067877328590,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1944C:\Windows\syswow64\MsiExec.exe -Embedding 3DA1AA4FEAD96D9171EAA98FB31EF6F0 UC:\Windows\SysWOW64\msiexec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2128"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=2776,i,15303900467456377608,18133485067877328590,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2132"C:\Users\admin\AppData\Local\Programs\EmEditor\eehlpver.exe" ja 25.2.2C:\Users\admin\AppData\Local\Programs\EmEditor\eehlpver.exe—eeupdate.exe
User:
admin
Company:
Emurasoft, Inc.
Integrity Level:
MEDIUM
Description:
EmEditor program for updater
Exit code:
1
Version:
25.2.2.0
Modules
Images
c:\users\admin\appdata\local\programs\emeditor\eehlpver.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
44 545
Read events
43 758
Write events
737
Delete events
50

Modification events

(PID) Process:(3540) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3540) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3540) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(3540) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(3540) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3540) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(3540) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
E450298D77982F00
(PID) Process:(3540) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\459496
Operation:writeName:WindowTabManagerFileMappingId
Value:
{C4A036EC-3272-4FCA-A571-4EDA4EB5766C}
(PID) Process:(3540) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\459496
Operation:writeName:WindowTabManagerFileMappingId
Value:
{03C1BD5C-D800-477A-B0EB-E397D95BFEB7}
(PID) Process:(3540) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\459496
Operation:writeName:WindowTabManagerFileMappingId
Value:
{E5ADA1D2-AE54-4A99-9E5E-67981AD1AF5C}
Executable files
151
Suspicious files
396
Text files
329
Unknown types
206

Dropped files

PID
Process
Filename
Type
3540msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old~RF175469.TMP —
MD5:—
SHA256:—
3540msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old —
MD5:—
SHA256:—
3540msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF175469.TMP —
MD5:—
SHA256:—
3540msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
3540msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF175479.TMP —
MD5:—
SHA256:—
3540msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
3540msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF175479.TMP —
MD5:—
SHA256:—
3540msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
3540msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF175479.TMP —
MD5:—
SHA256:—
3540msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF175479.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
52
TCP/UDP connections
194
DNS requests
251
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3948
msedge.exe
GET
200
150.171.28.11:80
http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:RiZG_AWmD8G51PVIvLXI_3Ba2FZFeo9Uo1oieSFazoI&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
5552
svchost.exe
HEAD
200
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/2ef98485-cbad-4d99-b4c2-cd4abac73fb4?P1=1752759750&P2=404&P3=2&P4=W9WUnlKBZvReQWEb9Glaje6vid3fRCToAq3sfIU3V5eaaCSI7LCHm3VOIkFAHFOfHqh5KtfcWocSn21kOqt3JA%3d%3d
unknown
—
—
whitelisted
3540
msedge.exe
GET
200
172.64.149.23:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQVD%2BnGf79Hpedv3mhy6uKMVZkPCQQUDyrLIIcouOxvSK4rVKYpqhekzQwCEG1tk2zfwkcXMr31bNOajGI%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.16.241.14:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6876
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5552
svchost.exe
HEAD
200
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1752759751&P2=404&P3=2&P4=hJL4HktMlqzt0sljweRHlWeoXI05d8PIvVdGM02NNKV2L2HVwXEueY9TBW1VXIGWttzLRzkow4wb0GEAjAWGNw%3d%3d
unknown
—
—
whitelisted
2692
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2692
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5552
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1752759751&P2=404&P3=2&P4=hJL4HktMlqzt0sljweRHlWeoXI05d8PIvVdGM02NNKV2L2HVwXEueY9TBW1VXIGWttzLRzkow4wb0GEAjAWGNw%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3720
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3948
msedge.exe
150.171.28.11:80
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3948
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3948
msedge.exe
104.21.23.188:443
zh-cn.emeditor.com
CLOUDFLARENET
—
whitelisted
3948
msedge.exe
150.171.28.11:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3948
msedge.exe
2.23.227.211:443
copilot.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.46
whitelisted
edge.microsoft.com
  • 150.171.28.11
  • 150.171.27.11
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
zh-cn.emeditor.com
  • 104.21.23.188
  • 172.67.212.192
whitelisted
copilot.microsoft.com
  • 2.23.227.211
  • 2.23.227.199
whitelisted
www.bing.com
  • 2.23.227.215
  • 2.23.227.208
  • 2.23.227.221
  • 2.16.241.219
  • 2.16.241.211
  • 2.16.241.206
  • 2.16.241.222
  • 2.16.241.205
  • 2.16.241.207
  • 2.16.241.218
  • 2.16.241.201
  • 2.16.241.200
  • 2.16.241.221
  • 2.16.241.223
whitelisted
www.youtube.com
  • 142.250.185.174
  • 142.250.181.238
  • 142.250.186.174
  • 142.250.185.110
  • 142.250.186.78
  • 142.250.186.110
  • 142.250.186.46
  • 172.217.18.14
  • 142.250.185.78
  • 172.217.16.206
  • 142.250.74.206
  • 142.250.185.142
  • 216.58.206.78
  • 142.250.185.238
  • 142.250.186.142
  • 142.250.185.206
  • 142.250.184.238
  • 142.250.184.206
  • 216.58.206.46
  • 172.217.16.142
whitelisted
i.ytimg.com
  • 142.250.185.118
  • 216.58.206.54
  • 142.250.186.150
  • 216.58.212.182
  • 172.217.18.118
  • 142.250.185.150
  • 172.217.23.118
  • 142.250.186.118
  • 172.217.18.22
  • 142.250.184.246
  • 142.250.186.86
  • 142.250.74.214
  • 142.250.185.86
  • 142.250.184.214
  • 142.250.186.182
  • 142.250.186.54
whitelisted
fonts.gstatic.com
  • 216.58.206.35
whitelisted
xpaywalletcdn.azureedge.net
  • 40.90.65.183
whitelisted

Threats

PID
Process
Class
Message
3948
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Global content delivery network (unpkg .com)
3948
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge
3948
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Global content delivery network (unpkg .com)
7292
eeupdate.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] AdvancedInstaller User-Agent
Process
Message
eeupdate.exe
Logger::SetLogFile( C:\ProgramData\Emurasoft\EmEditor\updates\updater.log ) while OLD path is:
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
zh-cn.emeditor.com