URL:

https://softmgr.adfilter.cn/

Full analysis: https://app.any.run/tasks/aca0d35a-f5ed-4df4-8e5c-bff1881178b4
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: July 15, 2025, 00:23:25
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
rust
Indicators:
MD5:

F3B27CF50A6391B040A20C2C2DDD5462

SHA1:

BEC63C7D914F5F19F9325BCB5239616C035E6D40

SHA256:

A973C726588298DDD9E81593F597031D064743F09B754E5AFDCE0CEFC5DD8F32

SSDEEP:

3:N8HJXnfyLG+:2pPyL7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • The process executes via Task Scheduler

      • updater.exe (PID: 6268)

    • Application launched itself

      • updater.exe (PID: 6268)
      • CefBrowser.exe (PID: 7344)

    • Process requests binary or script from the Internet

      • 微.信_bl185407590.exe (PID: 7680)
      • Ghall.exe (PID: 1732)

    • Searches for installed software

      • 微.信_bl185407590.exe (PID: 7680)
      • Ghall.exe (PID: 1732)

    • Potential Corporate Privacy Violation

      • 微.信_bl185407590.exe (PID: 7680)

    • Executable content was dropped or overwritten

      • 微.信_bl185407590.exe (PID: 7680)

    • Drops 7-zip archiver for unpacking

      • 微.信_bl185407590.exe (PID: 7680)

    • Process drops legitimate windows executable

      • 微.信_bl185407590.exe (PID: 7680)

    • Creates a software uninstall entry

      • 微.信_bl185407590.exe (PID: 7680)

    • Reads security settings of Internet Explorer

      • 微.信_bl185407590.exe (PID: 7680)
      • Gt.exe (PID: 6668)
      • Ghall.exe (PID: 1732)
      • CefBrowser.exe (PID: 7344)
      • CefBrowser.exe (PID: 4052)
      • CefBrowser.exe (PID: 480)

    • There is functionality for taking screenshot (YARA)

      • Gt.exe (PID: 6668)
      • Ghall.exe (PID: 1732)

    • Adds/modifies Windows certificates

      • CefBrowser.exe (PID: 7344)

  • INFO

    • Application launched itself

      • msedge.exe (PID: 6808)

    • Checks supported languages

      • identity_helper.exe (PID: 7664)
      • 微.信_bl185407590.exe (PID: 7680)
      • updater.exe (PID: 3980)
      • updater.exe (PID: 6268)
      • Ghall.exe (PID: 1732)
      • Gt.exe (PID: 6668)
      • CefBrowser.exe (PID: 4052)
      • CefBrowser.exe (PID: 480)
      • CefBrowser.exe (PID: 7344)

    • The sample compiled with english language support

      • msedge.exe (PID: 1520)
      • msedge.exe (PID: 6808)
      • 微.信_bl185407590.exe (PID: 7680)

    • Reads the computer name

      • identity_helper.exe (PID: 7664)
      • updater.exe (PID: 6268)
      • 微.信_bl185407590.exe (PID: 7680)
      • Gt.exe (PID: 6668)
      • Ghall.exe (PID: 1732)
      • CefBrowser.exe (PID: 7344)

    • Reads Environment values

      • identity_helper.exe (PID: 7664)

    • Reads the software policy settings

      • slui.exe (PID: 1324)
      • 微.信_bl185407590.exe (PID: 7680)
      • Gt.exe (PID: 6668)
      • CefBrowser.exe (PID: 4052)
      • CefBrowser.exe (PID: 480)
      • Ghall.exe (PID: 1732)
      • CefBrowser.exe (PID: 7344)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 1520)
      • msedge.exe (PID: 6808)

    • Checks proxy server information

      • slui.exe (PID: 1324)
      • 微.信_bl185407590.exe (PID: 7680)
      • Gt.exe (PID: 6668)
      • Ghall.exe (PID: 1732)
      • CefBrowser.exe (PID: 7344)

    • Process checks whether UAC notifications are on

      • updater.exe (PID: 6268)

    • Create files in a temporary directory

      • 微.信_bl185407590.exe (PID: 7680)
      • CefBrowser.exe (PID: 7344)

    • Reads the machine GUID from the registry

      • 微.信_bl185407590.exe (PID: 7680)
      • Gt.exe (PID: 6668)
      • Ghall.exe (PID: 1732)
      • CefBrowser.exe (PID: 7344)
      • CefBrowser.exe (PID: 4052)
      • CefBrowser.exe (PID: 480)

    • Creates files or folders in the user directory

      • 微.信_bl185407590.exe (PID: 7680)
      • Gt.exe (PID: 6668)
      • Ghall.exe (PID: 1732)
      • CefBrowser.exe (PID: 480)
      • CefBrowser.exe (PID: 7344)

    • The sample compiled with chinese language support

      • 微.信_bl185407590.exe (PID: 7680)

    • Creates files in the program directory

      • 微.信_bl185407590.exe (PID: 7680)
      • Ghall.exe (PID: 1732)
      • Gt.exe (PID: 6668)

    • Process checks computer location settings

      • 微.信_bl185407590.exe (PID: 7680)
      • Gt.exe (PID: 6668)
      • Ghall.exe (PID: 1732)

    • Disables trace logs

      • Ghall.exe (PID: 1732)
      • Gt.exe (PID: 6668)

    • Application based on Rust

      • Gt.exe (PID: 6668)
      • Ghall.exe (PID: 1732)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
205
Monitored processes
63
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs updater.exe no specs updater.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs 微.信_bl185407590.exe no specs 微.信_bl185407590.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs gt.exe ghall.exe cefbrowser.exe cefbrowser.exe no specs msedge.exe no specs msedge.exe no specs cefbrowser.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
72"C:\Users\admin\Downloads\微.信_bl185407590.exe" C:\Users\admin\Downloads\微.信_bl185407590.exe—msedge.exe
User:
admin
Integrity Level:
MEDIUM
Description:
应用程序
Exit code:
3221226540
Version:
6.1025.1275.411
Modules
Images
c:\users\admin\downloads\微.信_bl185407590.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
480"C:\Program Files (x86)\NStore\Utils\cef\CefBrowser.exe" --type=utility --channel="7344.1.2129120897\1948540660" --lang=en-US --no-sandbox --no-sandbox --lang=zh-CN --log-file=disable.log --log-severity=disable /prefetch:8C:\Program Files (x86)\NStore\Utils\cef\CefBrowser.exe—CefBrowser.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
2.5025.3190.509
Modules
Images
c:\program files (x86)\nstore\utils\cef\cefbrowser.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1324C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1392"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=6424,i,14043677293475586165,17737435432235173507,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1520"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=2256,i,14043677293475586165,17737435432235173507,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1728"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3652,i,14043677293475586165,17737435432235173507,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1732"C:\Program Files (x86)\NStore\Ghall.exe" --exg=1 --from=tray --show=3 --softid=24120301 --softname=微信 --sourceid=0 --webid=2105 C:\Program Files (x86)\NStore\Ghall.exe
Gt.exe
User:
admin
Integrity Level:
HIGH
Description:
疾风
Version:
1.2925.1130.311
Modules
Images
c:\program files (x86)\nstore\ghall.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1976"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --disable-quic --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=2232,i,14043677293475586165,17737435432235173507,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2064"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --field-trial-handle=7416,i,14043677293475586165,17737435432235173507,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2864"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --field-trial-handle=5856,i,14043677293475586165,17737435432235173507,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
42 182
Read events
41 991
Write events
183
Delete events
8

Modification events

(PID) Process:(6808) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6808) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6808) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(6808) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
0FDCC91183982F00
(PID) Process:(6808) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\459516
Operation:writeName:WindowTabManagerFileMappingId
Value:
{B7EEAA31-2248-4E53-923E-181D0ED07170}
(PID) Process:(6808) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(6808) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\459516
Operation:writeName:WindowTabManagerFileMappingId
Value:
{0DDB16DB-CB06-4288-9E74-6FB57EFB6E8A}
(PID) Process:(6808) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\459516
Operation:writeName:WindowTabManagerFileMappingId
Value:
{7F683D09-78B6-4966-9A64-81AFF0A4223E}
(PID) Process:(6808) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MicrosoftEdgeAutoLaunch_29EBC4579851B72EE312C449CF839B1A
Value:
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
(PID) Process:(6808) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\Commands\on-logon-autolaunch
Operation:writeName:Enabled
Value:
0
Executable files
56
Suspicious files
885
Text files
222
Unknown types
61

Dropped files

PID
Process
Filename
Type
6808msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old~RF17567c.TMP —
MD5:—
SHA256:—
6808msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old —
MD5:—
SHA256:—
6808msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF17568c.TMP —
MD5:—
SHA256:—
6808msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF17568c.TMP —
MD5:—
SHA256:—
6808msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
6808msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
6808msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF17568c.TMP —
MD5:—
SHA256:—
6808msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
6808msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF17569c.TMP —
MD5:—
SHA256:—
6808msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
312
TCP/UDP connections
526
DNS requests
192
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1520
msedge.exe
GET
200
150.171.27.11:80
http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:-KuA2T13djvuSXXUpiSXf8OFm1TgJr8SScXaCLTFBSE&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
4320
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.55.110.193:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
8048
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7412
svchost.exe
GET
200
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/4c4fdee0-d69c-42b7-bf5c-3ec046e9dfc9?P1=1752942208&P2=404&P3=2&P4=C9ssY3RTluMNiHJBTQrLl62uqM9VGXjwWPG1WE2MloFLj%2fMdW0D%2bzIGMoOG3s%2fbtrOnmp9dyz2R%2b6Ne1bX9Kiw%3d%3d
unknown
—
—
whitelisted
7412
svchost.exe
HEAD
200
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1752866590&P2=404&P3=2&P4=HVXPj%2b2kIZP0SJHJ3eslltdHkBWhEAdihQjNpGK%2foCsGbZfD%2ffwzT9ySkKW5P9gk2kYfZ5Agg1%2btLZiPDXNqeQ%3d%3d
unknown
—
—
whitelisted
7412
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1752866590&P2=404&P3=2&P4=HVXPj%2b2kIZP0SJHJ3eslltdHkBWhEAdihQjNpGK%2foCsGbZfD%2ffwzT9ySkKW5P9gk2kYfZ5Agg1%2btLZiPDXNqeQ%3d%3d
unknown
—
—
whitelisted
7412
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1752866590&P2=404&P3=2&P4=HVXPj%2b2kIZP0SJHJ3eslltdHkBWhEAdihQjNpGK%2foCsGbZfD%2ffwzT9ySkKW5P9gk2kYfZ5Agg1%2btLZiPDXNqeQ%3d%3d
unknown
—
—
whitelisted
7412
svchost.exe
HEAD
200
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9244b52a-55cc-41a2-b7c4-7f4983d8753c?P1=1752942205&P2=404&P3=2&P4=iRAZwGaLTnu4R8eOgsl%2b1%2bPPth2MWPvfOZlSTc%2fWZafvicvo9kLqZVsKWmpXdePdTggb2U9%2ftl5PPiFWV892mg%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1352
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1520
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1520
msedge.exe
150.171.27.11:80
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1520
msedge.exe
150.171.27.11:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1520
msedge.exe
2.23.227.211:443
copilot.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
1520
msedge.exe
121.41.131.49:443
softmgr.adfilter.cn
Hangzhou Alibaba Advertising Co.,Ltd.
CN
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
google.com
  • 142.250.186.78
whitelisted
edge.microsoft.com
  • 150.171.27.11
  • 150.171.28.11
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
softmgr.adfilter.cn
  • 121.41.131.49
unknown
copilot.microsoft.com
  • 2.23.227.211
  • 2.23.227.199
whitelisted
www.bing.com
  • 2.16.241.201
  • 2.16.241.218
  • 92.123.104.34
  • 92.123.104.32
  • 92.123.104.38
  • 92.123.104.63
  • 2.23.227.208
  • 2.23.227.215
whitelisted
png.masyunrui.com
  • 101.226.28.241
  • 101.226.28.237
  • 101.226.28.236
  • 101.226.28.239
  • 101.226.28.234
  • 101.226.28.238
  • 101.226.28.240
  • 101.226.28.235
  • 180.163.148.216
  • 61.170.80.221
  • 101.226.27.75
  • 61.170.81.214
  • 101.89.125.241
  • 61.170.80.222
  • 222.73.33.9
  • 180.163.147.216
  • 114.80.179.169
  • 180.163.147.217
  • 61.170.81.223
  • 61.170.81.224
  • 101.226.27.74
  • 222.73.33.10
  • 61.170.79.110
  • 61.170.79.109
unknown
bat.bing.com
  • 150.171.27.10
  • 150.171.28.10
whitelisted
fxgate.baidu.com
  • 110.242.68.204
whitelisted

Threats

PID
Process
Class
Message
1520
msedge.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
1520
msedge.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
1520
msedge.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
7680
微.信_bl185407590.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7680
微.信_bl185407590.exe
Misc activity
ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
7680
微.信_bl185407590.exe
Unknown Traffic
ET HUNTING Suspicious Empty Accept-Encoding Header
Process
Message
CefBrowser.exe
Message: Source: https://g.alicdn.com/AWSC/et/1.83.8/et_f.js Line: 1 -----------------------
CefBrowser.exe
Message: 客户端触发事件 Source: zip://57bd02b1-dfa1-4029-92b7-0f7539cf4b72|C:\Program Files (x86)\NStore\skin\soft-market-web.dat|/build/static/js/index.4f7b1608.js Line: 2 -----------------------
CefBrowser.exe
Message: Unhandled promise rejection Source: zip://57bd02b1-dfa1-4029-92b7-0f7539cf4b72|C:\Program Files (x86)\NStore\skin\soft-market-web.dat|/build/static/js/index.4f7b1608.js Line: 2 -----------------------
CefBrowser.exe
Message: 客户端触发事件 Source: zip://57bd02b1-dfa1-4029-92b7-0f7539cf4b72|C:\Program Files (x86)\NStore\skin\soft-market-web.dat|/build/static/js/index.4f7b1608.js Line: 2 -----------------------
CefBrowser.exe
Message: 客户端触发事件 Source: zip://57bd02b1-dfa1-4029-92b7-0f7539cf4b72|C:\Program Files (x86)\NStore\skin\soft-market-web.dat|/build/static/js/index.4f7b1608.js Line: 2 -----------------------
CefBrowser.exe
Message: 客户端触发事件 Source: zip://57bd02b1-dfa1-4029-92b7-0f7539cf4b72|C:\Program Files (x86)\NStore\skin\soft-market-web.dat|/build/static/js/index.4f7b1608.js Line: 2 -----------------------
CefBrowser.exe
Message: 客户端触发事件 Source: zip://57bd02b1-dfa1-4029-92b7-0f7539cf4b72|C:\Program Files (x86)\NStore\skin\soft-market-web.dat|/build/static/js/index.4f7b1608.js Line: 2 -----------------------
CefBrowser.exe
Message: 客户端触发事件 Source: zip://57bd02b1-dfa1-4029-92b7-0f7539cf4b72|C:\Program Files (x86)\NStore\skin\soft-market-web.dat|/build/static/js/index.4f7b1608.js Line: 2 -----------------------
CefBrowser.exe
Message: 客户端触发事件 Source: zip://57bd02b1-dfa1-4029-92b7-0f7539cf4b72|C:\Program Files (x86)\NStore\skin\soft-market-web.dat|/build/static/js/index.4f7b1608.js Line: 2 -----------------------
CefBrowser.exe
Message: 客户端触发事件 Source: zip://57bd02b1-dfa1-4029-92b7-0f7539cf4b72|C:\Program Files (x86)\NStore\skin\soft-market-web.dat|/build/static/js/index.4f7b1608.js Line: 2 -----------------------
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://softmgr.adfilter.cn/