File name:

vshare-plugin.exe

Full analysis: https://app.any.run/tasks/ed45d2f9-0ddb-4d8b-b130-7227a5344d3b
Verdict: Malicious activity
Analysis date: May 15, 2025, 12:46:20
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

18E0C865FCA7D017378E87C4A6742BF5

SHA1:

465699B4EBD97A17A24BD7D0F85A768910A7F429

SHA256:

939F63DFF04033C4DF71771AEF878062EEACFBECE1F0AF7C34E6931682FEE2C2

SSDEEP:

24576:sj+boTw3lcbVCgGaXlhrfEHDIkJAsLozhjhBH33aAQR:sj+boTmlcbVCgGaXlhrfiDIkJAsLozhk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • vshare-plugin.exe (PID: 4784)
      • vshare-plugin.exe (PID: 1276)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • vshare-plugin.exe (PID: 4784)

    • Changes the Home page of Internet Explorer

      • vshare-plugin.exe (PID: 4784)

    • Creates/Modifies COM task schedule object

      • vshare-plugin.exe (PID: 4784)

    • The process creates files with name similar to system file names

      • vshare-plugin.exe (PID: 4784)

    • Executable content was dropped or overwritten

      • vshare-plugin.exe (PID: 4784)

    • Changes the title of the Internet Explorer window

      • vshare-plugin.exe (PID: 4784)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • vshare-plugin.exe (PID: 4784)

    • There is functionality for taking screenshot (YARA)

      • vshare-plugin.exe (PID: 4784)

    • Creates a software uninstall entry

      • vshare-plugin.exe (PID: 4784)

  • INFO

    • Application launched itself

      • msedge.exe (PID: 4452)
      • msedge.exe (PID: 3796)
      • msedge.exe (PID: 1672)

    • Manual execution by a user

      • msedge.exe (PID: 1672)

    • Creates files or folders in the user directory

      • vshare-plugin.exe (PID: 4784)

    • Create files in a temporary directory

      • vshare-plugin.exe (PID: 4784)

    • Checks proxy server information

      • vshare-plugin.exe (PID: 4784)
      • slui.exe (PID: 6768)

    • The sample compiled with english language support

      • vshare-plugin.exe (PID: 4784)

    • Creates files in the program directory

      • vshare-plugin.exe (PID: 4784)

    • Reads the computer name

      • vshare-plugin.exe (PID: 4784)
      • identity_helper.exe (PID: 2960)
      • identity_helper.exe (PID: 3032)
      • identity_helper.exe (PID: 7172)
      • identity_helper.exe (PID: 7588)

    • Checks supported languages

      • vshare-plugin.exe (PID: 4784)
      • identity_helper.exe (PID: 7172)
      • identity_helper.exe (PID: 7588)
      • identity_helper.exe (PID: 2960)
      • identity_helper.exe (PID: 3032)

    • Reads Environment values

      • identity_helper.exe (PID: 7172)
      • identity_helper.exe (PID: 2960)
      • identity_helper.exe (PID: 3032)
      • identity_helper.exe (PID: 7588)

    • Reads the software policy settings

      • slui.exe (PID: 3304)
      • slui.exe (PID: 6768)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | NSIS - Nullsoft Scriptable Install System (94.8)
.exe | Win32 Executable MS Visual C++ (generic) (3.4)
.dll | Win32 Dynamic Link Library (generic) (0.7)
.exe | Win32 Executable (generic) (0.5)
.exe | Generic Win/DOS Executable (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2009:12:05 22:50:46+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 23552
InitializedDataSize: 119808
UninitializedDataSize: 1024
EntryPoint: 0x323c
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
215
Monitored processes
80
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start vshare-plugin.exe sppextcomobj.exe no specs slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs slui.exe identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs vshare-plugin.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
132"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3892 --field-trial-handle=2260,i,929372830720371996,14030829744451440401,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
672"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5548 --field-trial-handle=2260,i,929372830720371996,14030829744451440401,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
744"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5160 --field-trial-handle=2260,i,929372830720371996,14030829744451440401,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1188"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2248 --field-trial-handle=2260,i,11189333845292195759,902832473824545837,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1276"C:\Users\admin\AppData\Local\Temp\vshare-plugin.exe" C:\Users\admin\AppData\Local\Temp\vshare-plugin.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\vshare-plugin.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1388"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4148 --field-trial-handle=2260,i,11189333845292195759,902832473824545837,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1660"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x310,0x314,0x318,0x308,0x320,0x7ffc89dd5fd8,0x7ffc89dd5fe4,0x7ffc89dd5ff0C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1672"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --do-not-de-elevate --single-argument http://vshare.tv/postplugin.php?tb=startsearchC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1748"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5028 --field-trial-handle=2260,i,929372830720371996,14030829744451440401,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2084"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5540 --field-trial-handle=2260,i,929372830720371996,14030829744451440401,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
10 797
Read events
10 687
Write events
108
Delete events
2

Modification events

(PID) Process:(4784) vshare-plugin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A1B48071-416D-474E-A13B-BE5456E7FC31}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(4784) vshare-plugin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{82443621-A29A-473E-8335-F5C958A7A4CA}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(4784) vshare-plugin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{82443621-A29A-473E-8335-F5C958A7A4CA}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(4784) vshare-plugin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{231047C5-F7E9-45BE-9EFD-6E9BB6D59A9F}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(4784) vshare-plugin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{231047C5-F7E9-45BE-9EFD-6E9BB6D59A9F}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(4784) vshare-plugin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(4784) vshare-plugin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C876A2AD-D4BA-11D3-9D38-D0D087C500CC}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(4784) vshare-plugin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C876A2AD-D4BA-11D3-9D38-D0D087C500CC}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(4784) vshare-plugin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(4784) vshare-plugin.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar
Operation:writeName:{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}
Value:
VShareTB
Executable files
30
Suspicious files
476
Text files
80
Unknown types
0

Dropped files

PID
Process
Filename
Type
4784vshare-plugin.exeC:\Users\admin\AppData\Local\Temp\nstC027.tmp\welcome.bmpimage
MD5:94EE5F16CCFF815E5B2FE6283C156558
SHA256:7FD5CDE2913D99557CC5B0690FA62F6272C37397B8B0F35AD4299F41D735AAB3
4784vshare-plugin.exeC:\Program Files (x86)\vShare.tv plugin\vshareplg.crxbinary
MD5:D7D3304BBD770BB3A62B55B2E18B427E
SHA256:D8BC3EE57CA18CB7232C5635AC893963F8E808B1253717CFA05ED4F8C1F7F946
4784vshare-plugin.exeC:\Users\admin\AppData\Local\Temp\sqlite3.dllexecutable
MD5:FEC17D5FB09A03376D3AA204C65562A7
SHA256:1E384AF4479BA64BD2FA02B00603205C4B0A99A468CFA4CC33CDCA7BAC845BEC
4784vshare-plugin.exeC:\Program Files (x86)\vShare.tv plugin\MyNewsBar.dllexecutable
MD5:E5FEE2B4D30DBCA62607C75D6C52313D
SHA256:F9EAC0891106176745EF57C3944B706CA9A8A311A991518ABE66C3CD718DF0FE
4784vshare-plugin.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs.jstext
MD5:837A691395E2ED522BBCA0B59677994E
SHA256:D89FFAAFF70E08FA24DC7786E15177845C57FA58F38599A6B3685D77B37EC4A8
4784vshare-plugin.exeC:\Users\admin\AppData\Local\Temp\chutil.dllexecutable
MD5:8A497E8284C2B9E71BCA1EC8A165AF03
SHA256:F32B02D76279764758E5219C8F892C11793A60907CBCCF6641077D75174A5596
1672msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF10fbb7.TMP —
MD5:—
SHA256:—
1672msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
4784vshare-plugin.exeC:\Program Files (x86)\vShare.tv plugin\uninst.exeexecutable
MD5:FE4393EFF76C5F8D5A5F597D47AE1CEC
SHA256:9A34BE04DD3FA1C325B4A17AF15F0B641F74001D4CC570B4FAA71084BF7D7BBC
4452msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Variationsbinary
MD5:6971E42ED64D2BE125547F021EB852B1
SHA256:B46CFDC4106DF566F71AA34D6F10B53767C561DFD17DD07A5930A18E67BB344B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
32
TCP/UDP connections
170
DNS requests
221
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.48.23.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4784
vshare-plugin.exe
GET
200
64.190.63.222:80
http://startsear.ch/install.php?aff=1&id=a57b81a2-318a-11f0-b4ed-18f7786f96ee&sp=1&hp=1&pp=vshare
unknown
—
—
unknown
5960
msedge.exe
GET
200
208.91.196.145:80
http://ww1.vshare.tv/
unknown
—
—
unknown
5960
msedge.exe
GET
200
208.91.196.145:80
http://ww1.vshare.tv/?fp=6pvIubxF7mx0x4NiHi4xRAXEnsZrsvwPo0tZ7%2BJxO6keiAStaHkTeZDB9naFSb7GYL1dIfhVYXXtBlgzKEAaShUSbCAy7OIBbrmp3JbsozqY8cyrbBA5GlMAgGmA2r75ob9Vd2ZDsBKhKRn2aM8%2FMyrk60oPB0SOwrfDsJJIBDDloQUY8sI%2B442tpbBSOSc7O1bQI2HSbOL2o7qPcmuOg2OAXimNGae0n52r0j60Z95CurfGJAH5G6zb%2B9CpEcuSv9ijilYP1LxL3TesI5pvRQ%3D%3D&poru=99abZKoYV3uJZtNggepp3P59kLAPexHYwdTqo38OGb0%3D&_opnslfp=1&
unknown
—
—
unknown
5960
msedge.exe
GET
404
208.91.196.145:80
http://ww1.vshare.tv/favicon.ico
unknown
—
—
unknown
8000
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8000
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7556
svchost.exe
HEAD
200
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fb6dd03b-99d7-4cc8-a878-91c8e655c2d3?P1=1747705072&P2=404&P3=2&P4=DryZniJZgQS%2fjFnJSHPM1Nr3E4r8HFhLD4zLgs8RonlmCNnL%2fZiaFsKAkphuRmBFwPqNSOKQdaeDA9Pr5rJckw%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
23.48.23.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.69:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4784
vshare-plugin.exe
64.190.63.222:80
startsear.ch
SEDO GmbH
DE
unknown
5960
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.176
  • 23.48.23.167
  • 23.48.23.159
  • 23.48.23.164
  • 23.48.23.173
  • 23.48.23.156
  • 23.48.23.193
  • 23.48.23.177
  • 23.48.23.166
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.31.69
  • 20.190.159.130
  • 20.190.159.23
  • 20.190.159.129
  • 20.190.159.68
  • 20.190.159.71
  • 20.190.159.4
  • 40.126.31.2
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
startsear.ch
  • 64.190.63.222
unknown
config.edge.skype.com
  • 13.107.42.16
whitelisted
vshare.tv
  • 94.229.72.117
unknown

Threats

PID
Process
Class
Message
5960
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
5960
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] BootstrapCDN (maxcdn .bootstrapcdn .com)
5960
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
5960
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
5960
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare content delivery network (cdnjs .cloudflare .com)
5960
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] BootstrapCDN (maxcdn .bootstrapcdn .com)
5960
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
5960
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
5960
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
5960
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
vshare-plugin.exe