File name:

MicrosoftEdgeWebview2Setup.exe

Full analysis: https://app.any.run/tasks/9ef7e097-8ee2-4a5a-8102-e15ce75d731a
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: February 06, 2025, 11:12:22
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
xred
backdoor
delphi
dyndns
snake
keylogger
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

A61250A4CA592CA4DF63A735A9FACC0E

SHA1:

AE06A5CC58EDDEC055C63C529E392AFEE2821854

SHA256:

A280044F416E832E17C5525334ED096F4714F0450EA9EB1526EAC9BBBFE9B541

SSDEEP:

98304:Qr7ayGJ6kHOSYENxRL5k0vktnryr1FxUvi0W6DBcuZWPSww6/Ku1Pe3GktrfEo/p:7+p

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • XRED mutex has been found

      • MicrosoftEdgeWebview2Setup.exe (PID: 6336)
      • Synaptics.exe (PID: 6456)

    • Changes the autorun value in the registry

      • MicrosoftEdgeWebview2Setup.exe (PID: 6336)

    • XRED has been detected (YARA)

      • Synaptics.exe (PID: 6456)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • MicrosoftEdgeWebview2Setup.exe (PID: 6336)
      • ._cache_MicrosoftEdgeWebview2Setup.exe (PID: 6428)

    • Process drops legitimate windows executable

      • MicrosoftEdgeWebview2Setup.exe (PID: 6336)
      • ._cache_MicrosoftEdgeWebview2Setup.exe (PID: 6428)
      • MicrosoftEdgeUpdate.exe (PID: 6572)

    • Starts a Microsoft application from unusual location

      • ._cache_MicrosoftEdgeWebview2Setup.exe (PID: 6428)
      • MicrosoftEdgeUpdate.exe (PID: 6572)

    • Reads security settings of Internet Explorer

      • MicrosoftEdgeWebview2Setup.exe (PID: 6336)
      • Synaptics.exe (PID: 6456)
      • MicrosoftEdgeUpdate.exe (PID: 6572)

    • Disables SEHOP

      • MicrosoftEdgeUpdate.exe (PID: 6572)

    • There is functionality for communication over UDP network (YARA)

      • Synaptics.exe (PID: 6456)

    • There is functionality for communication dyndns network (YARA)

      • Synaptics.exe (PID: 6456)

    • There is functionality for taking screenshot (YARA)

      • Synaptics.exe (PID: 6456)

    • Checks Windows Trust Settings

      • Synaptics.exe (PID: 6456)

  • INFO

    • Reads the computer name

      • MicrosoftEdgeWebview2Setup.exe (PID: 6336)
      • Synaptics.exe (PID: 6456)
      • MicrosoftEdgeUpdate.exe (PID: 6572)

    • The sample compiled with turkish language support

      • MicrosoftEdgeWebview2Setup.exe (PID: 6336)

    • Process checks computer location settings

      • MicrosoftEdgeWebview2Setup.exe (PID: 6336)
      • MicrosoftEdgeUpdate.exe (PID: 6572)

    • Checks supported languages

      • MicrosoftEdgeWebview2Setup.exe (PID: 6336)
      • ._cache_MicrosoftEdgeWebview2Setup.exe (PID: 6428)
      • Synaptics.exe (PID: 6456)
      • MicrosoftEdgeUpdate.exe (PID: 6572)

    • The sample compiled with english language support

      • MicrosoftEdgeWebview2Setup.exe (PID: 6336)
      • ._cache_MicrosoftEdgeWebview2Setup.exe (PID: 6428)
      • MicrosoftEdgeUpdate.exe (PID: 6572)

    • Creates files in the program directory

      • MicrosoftEdgeWebview2Setup.exe (PID: 6336)
      • Synaptics.exe (PID: 6456)
      • ._cache_MicrosoftEdgeWebview2Setup.exe (PID: 6428)

    • Checks proxy server information

      • Synaptics.exe (PID: 6456)
      • MicrosoftEdgeUpdate.exe (PID: 6572)
      • wermgr.exe (PID: 6804)

    • Reads the software policy settings

      • MicrosoftEdgeUpdate.exe (PID: 6572)
      • wermgr.exe (PID: 6804)
      • Synaptics.exe (PID: 6456)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 6572)

    • Reads the machine GUID from the registry

      • Synaptics.exe (PID: 6456)

    • Create files in a temporary directory

      • Synaptics.exe (PID: 6456)

    • Compiled with Borland Delphi (YARA)

      • Synaptics.exe (PID: 6456)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Borland Delphi 7 (47.3)
.exe | Win32 Executable Borland Delphi 5 (32.1)
.exe | Win32 Executable Borland Delphi 6 (18.7)
.exe | Win32 Executable Delphi generic (1)
.exe | Win32 Executable (generic) (0.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 629760
InitializedDataSize: 1796096
UninitializedDataSize: -
EntryPoint: 0x9ab80
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.4
ProductVersionNumber: 1.0.0.4
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Turkish
CharacterSet: Windows, Turkish
CompanyName: Synaptics
FileDescription: Synaptics Pointing Device Driver
FileVersion: 1.0.0.4
InternalName: -
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: -
ProductName: Synaptics Pointing Device Driver
ProductVersion: 1.0.0.0
Comments: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
123
Monitored processes
7
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #XRED microsoftedgewebview2setup.exe ._cache_microsoftedgewebview2setup.exe #XRED synaptics.exe svchost.exe microsoftedgeupdate.exe wermgr.exe microsoftedgewebview2setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
6172"C:\Users\admin\Desktop\MicrosoftEdgeWebview2Setup.exe" C:\Users\admin\Desktop\MicrosoftEdgeWebview2Setup.exe—explorer.exe
User:
admin
Company:
Synaptics
Integrity Level:
MEDIUM
Description:
Synaptics Pointing Device Driver
Exit code:
3221226540
Version:
1.0.0.4
Modules
Images
c:\users\admin\desktop\microsoftedgewebview2setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6336"C:\Users\admin\Desktop\MicrosoftEdgeWebview2Setup.exe" C:\Users\admin\Desktop\MicrosoftEdgeWebview2Setup.exe
explorer.exe
User:
admin
Company:
Synaptics
Integrity Level:
HIGH
Description:
Synaptics Pointing Device Driver
Exit code:
0
Version:
1.0.0.4
Modules
Images
c:\users\admin\desktop\microsoftedgewebview2setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
6428"C:\Users\admin\Desktop\._cache_MicrosoftEdgeWebview2Setup.exe" C:\Users\admin\Desktop\._cache_MicrosoftEdgeWebview2Setup.exe
MicrosoftEdgeWebview2Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update Setup
Exit code:
2147747592
Version:
1.3.195.39
Modules
Images
c:\users\admin\desktop\._cache_microsoftedgewebview2setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
6456"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdateC:\ProgramData\Synaptics\Synaptics.exe
MicrosoftEdgeWebview2Setup.exe
User:
admin
Company:
Synaptics
Integrity Level:
HIGH
Description:
Synaptics Pointing Device Driver
Version:
1.0.0.4
Modules
Images
c:\programdata\synaptics\synaptics.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
6572"C:\Program Files (x86)\Microsoft\Temp\EUA1B2.tmp\MicrosoftEdgeUpdate.exe" /installsource taggedmi /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"C:\Program Files (x86)\Microsoft\Temp\EUA1B2.tmp\MicrosoftEdgeUpdate.exe
._cache_MicrosoftEdgeWebview2Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update
Exit code:
2147747592
Version:
1.3.195.39
Modules
Images
c:\program files (x86)\microsoft\temp\eua1b2.tmp\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
6804"C:\WINDOWS\system32\wermgr.exe" "-outproc" "0" "6572" "1032" "892" "1220" "0" "0" "0" "0" "0" "0" "0" "0" C:\Windows\SysWOW64\wermgr.exe
MicrosoftEdgeUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wermgr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
14 316
Read events
14 268
Write events
46
Delete events
2

Modification events

(PID) Process:(6336) MicrosoftEdgeWebview2Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(6336) MicrosoftEdgeWebview2Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100004E3AAA90BA1C3342B8BB535773D484497D000000
(PID) Process:(6336) MicrosoftEdgeWebview2Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A7803901000060B81DB4E48ED2119906E49FADC173CAC5010000
(PID) Process:(6336) MicrosoftEdgeWebview2Setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309DE5010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A7803901000060B81DB4E48ED2119906E49FADC173CAC5010000
(PID) Process:(6336) MicrosoftEdgeWebview2Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Synaptics Pointing Device Driver
Value:
C:\ProgramData\Synaptics\Synaptics.exe
(PID) Process:(6572) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\TypeLib
Operation:writeName:Version
Value:
1.1
(PID) Process:(6572) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\TypeLib
Operation:writeName:Version
Value:
1.1
(PID) Process:(6572) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Volatile\00\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{03022430-ABC4-11D0-BDE2-00AA001A1953}\TypeLib
Operation:writeName:Version
Value:
1.1
(PID) Process:(6572) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Volatile\00\MACHINE\SOFTWARE\Classes\Interface\{03022430-ABC4-11D0-BDE2-00AA001A1953}\TypeLib
Operation:writeName:Version
Value:
1.1
(PID) Process:(6572) MicrosoftEdgeUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{FA72EC4F-EC17-4F12-AEC6-5EC51531EBB4}
Operation:delete keyName:(default)
Value:
Executable files
204
Suspicious files
5
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
6428._cache_MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUA1B2.tmp\MicrosoftEdgeUpdateOnDemand.exeexecutable
MD5:811502B10ADFDF17AC87F8CE1D26628A
SHA256:20B612E7E9FEA100DD2C25F476C1BDD19223C77C642495158FE9640E28B76F45
6336MicrosoftEdgeWebview2Setup.exeC:\Users\admin\Desktop\._cache_MicrosoftEdgeWebview2Setup.exeexecutable
MD5:EC5B2A3126F46E01E1FCBB215D4F9EC8
SHA256:09C2A441A22186CBCC90E0A79556C4C696446740955C9031F8B52E84C7CD4EC1
6428._cache_MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUA1B2.tmp\msedgeupdate.dllexecutable
MD5:3F84AC83FA44FB5E069640648E1660E7
SHA256:17C62E9ED5BEBDCCE2AC0CB41A255C5F63F6544FB5AB148B6810617B854F6319
6428._cache_MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUA1B2.tmp\MicrosoftEdgeUpdateBroker.exeexecutable
MD5:6513BF6501B147F7A6BB78F543C4A104
SHA256:829FE05CCF8C87A8B428BAE43CAFCA9434551EE5C80718C737D22548C9E7F342
6428._cache_MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUA1B2.tmp\psmachine.dllexecutable
MD5:7B2941EC175F5ABB34BE6E3F95F2E782
SHA256:32C94C3747EA83F0D880C4239911CF03796A6876C97F647EE9E798543A1889DA
6336MicrosoftEdgeWebview2Setup.exeC:\ProgramData\Synaptics\Synaptics.exeexecutable
MD5:A61250A4CA592CA4DF63A735A9FACC0E
SHA256:A280044F416E832E17C5525334ED096F4714F0450EA9EB1526EAC9BBBFE9B541
6336MicrosoftEdgeWebview2Setup.exeC:\ProgramData\Synaptics\RCXA173.tmpexecutable
MD5:FFB7BABFB8CE697CED00CD0CAD70C0C4
SHA256:491D5C52E200C57D608F907CF4FB8D5DCE0F09524D2C767D192F3F568950D8DF
6428._cache_MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUA1B2.tmp\psuser.dllexecutable
MD5:7B617E1CD1288FBED8AB3602157DF86E
SHA256:9C6CD49F5881E10310DA448040DAAC8059D00CB5D75A0F0ABA590AABBDEC64AC
6428._cache_MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUA1B2.tmp\MicrosoftEdgeUpdateCore.exeexecutable
MD5:DB5CF5B7795B922A9F07561E7213BA01
SHA256:A8CE896D4E64A0246B1CFBBA3D3F39A11350C017C7DC19E5BC4DABF0109FB0EF
6428._cache_MicrosoftEdgeWebview2Setup.exeC:\Program Files (x86)\Microsoft\Temp\EUA1B2.tmp\psuser_64.dllexecutable
MD5:87241A9DEE0BE74059BF0F7820FE6AF8
SHA256:3E0A8D3D9055F28A7F7454E17E1CD27C704560DB8411A6E7EDA8CCB5F311ACA2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
25
DNS requests
9
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6456
Synaptics.exe
GET
200
69.42.215.252:80
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
unknown
—
—
whitelisted
—
—
GET
304
13.107.42.16:443
https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.195.39?clientId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&appChannel_webview=5&appConsentState_webview=0&appDayOfInstall_webview=0&appInactivityBadgeApplied_webview=0&appInactivityBadgeCleared_webview=0&appInactivityBadgeDuration_webview=0&appInstallTimeDiffSec_webview=0&appIsPinnedSystem_webview=false&appLastLaunchCount_webview=0&appLastLaunchTime_webview=0&appLastLaunchTimeJson_webview=0&appLastLaunchTimeDaysAgo_webview=0&appUpdateCheckIsUpdateDisabled_webview=false&appUpdatesAllowedForMeteredNetworks_webview=false&hwDiskType=2&hwHasSsse3=true&hwLogicalCpus=4&hwPhysmemory=4&isCTADevice=false&isMsftDomainJoined=false&oemProductManufacturer=DELL&oemProductName=DELL&osArch=x64&osIsDefaultNetworkConnectionMetered=false&osIsInLockdownMode=false&osIsWIP=false&osPlatform=win&osProductType=48&osVersion=10.0.19045.4046&requestCheckPeriodSec=-1&requestDomainJoined=false&requestInstallSource=taggedmi&requestIsMachine=true&requestOmahaShellVersion=1.3.147.37&requestOmahaVersion=1.3.195.39
unknown
—
—
unknown
—
—
GET
303
108.177.127.84:443
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
unknown
—
—
unknown
—
—
GET
303
108.177.127.84:443
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
unknown
—
—
unknown
—
—
GET
303
108.177.127.84:443
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
unknown
—
—
unknown
—
—
GET
200
13.107.42.16:443
https://config.edge.skype.com/config/v1/EdgeUpdate/1.3.195.39?clientId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&appChannel_edgeupdate=6&appConsentState_edgeupdate=0&appDayOfInstall_edgeupdate=0&appInactivityBadgeApplied_edgeupdate=0&appInactivityBadgeCleared_edgeupdate=0&appInactivityBadgeDuration_edgeupdate=0&appInstallTimeDiffSec_edgeupdate=0&appIsPinnedSystem_edgeupdate=false&appLastLaunchCount_edgeupdate=0&appLastLaunchTime_edgeupdate=0&appLastLaunchTimeJson_edgeupdate=0&appLastLaunchTimeDaysAgo_edgeupdate=0&appVersion_edgeupdate=1.3.195.39&appUpdateCheckIsUpdateDisabled_edgeupdate=false&appUpdatesAllowedForMeteredNetworks_edgeupdate=false&hwDiskType=2&hwHasSsse3=true&hwLogicalCpus=4&hwPhysmemory=4&isCTADevice=false&isMsftDomainJoined=false&oemProductManufacturer=DELL&oemProductName=DELL&osArch=x64&osIsDefaultNetworkConnectionMetered=false&osIsInLockdownMode=false&osIsWIP=false&osPlatform=win&osProductType=48&osVersion=10.0.19045.4046&requestCheckPeriodSec=-1&requestDomainJoined=false&requestInstallSource=taggedmi&requestIsMachine=true&requestOmahaShellVersion=1.3.147.37&requestOmahaVersion=1.3.195.39
unknown
binary
446 b
whitelisted
—
—
GET
404
142.250.186.129:443
https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
unknown
html
1.61 Kb
whitelisted
—
—
GET
404
142.250.186.129:443
https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
unknown
html
1.61 Kb
whitelisted
—
—
GET
404
142.250.186.129:443
https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
unknown
html
1.61 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3976
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6072
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2192
svchost.exe
224.0.0.251:5353
—
—
—
unknown
6456
Synaptics.exe
69.42.215.252:80
freedns.afraid.org
AWKNET
US
whitelisted
2192
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6572
MicrosoftEdgeUpdate.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6804
wermgr.exe
13.89.179.12:443
watson.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
xred.mooo.com
  • —
whitelisted
freedns.afraid.org
  • 69.42.215.252
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
watson.events.data.microsoft.com
  • 13.89.179.12
whitelisted
docs.google.com
  • 142.250.185.110
whitelisted
drive.usercontent.google.com
  • 216.58.206.65
whitelisted
self.events.data.microsoft.com
  • 104.208.16.91
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to Abused Domain *.mooo.com
—
—
A Network Trojan was detected
ET HUNTING Suspicious User-Agent Containing .exe
—
—
A Network Trojan was detected
ET MALWARE Snake Keylogger Payload Request (GET)
—
—
A Network Trojan was detected
ET HUNTING Suspicious User-Agent Containing .exe
—
—
A Network Trojan was detected
ET HUNTING Suspicious User-Agent Containing .exe
—
—
A Network Trojan was detected
ET HUNTING Suspicious User-Agent Containing .exe
—
—
A Network Trojan was detected
ET HUNTING Suspicious User-Agent Containing .exe
—
—
A Network Trojan was detected
ET HUNTING Suspicious User-Agent Containing .exe
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MicrosoftEdgeWebview2Setup.exe