URL:

https://graph.org/Fl-Studio-25-Producer-Edition--Download-FL-Dtudio-25-Free---Flstudioxcom-11-17

Full analysis: https://app.any.run/tasks/eb803d59-a023-4122-a231-bd9c829175ad
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: December 03, 2025, 19:46:57
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
telegram
autoit
aura
stealer
Indicators:
MD5:

77FC85504CEC50E52F6A771DFE5D775D

SHA1:

937418A2C10C89E3927F3CDB86922D8F99CA85DF

SHA256:

AAC470D98E3CE1F53C0B4F4ED5BC33EB81408CF9D57F6414305DB04B3D4C334C

SSDEEP:

3:N82EnijwhrIdKm96MKL1cjE+VVBLrIdKjo:22cijg1c4YrLqso

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AURA has been detected

      • cmd.exe (PID: 4620)

    • Uses Task Scheduler to autorun other applications

      • Kid.scr (PID: 6444)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • FL.Studio.v25.1.6.4997.exe (PID: 6872)
      • Kid.scr (PID: 3448)

    • Get information on the list of running processes

      • cmd.exe (PID: 4620)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 4620)

    • Executing commands from a ".bat" file

      • FL.Studio.v25.1.6.4997.exe (PID: 6872)

    • Starts application with an unusual extension

      • cmd.exe (PID: 4620)
      • cmd.exe (PID: 4380)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 4620)
      • cmd.exe (PID: 4380)

    • The executable file from the user directory is run by the CMD process

      • Kid.scr (PID: 3448)
      • Kid.scr (PID: 6444)

    • Reads security settings of Internet Explorer

      • Kid.scr (PID: 3448)

    • Executable content was dropped or overwritten

      • Kid.scr (PID: 6444)
      • Stem extractor Windows.exe (PID: 7876)
      • Edison Declipper Windows.exe (PID: 1656)

    • The process drops C-runtime libraries

      • Edison Declipper Windows.exe (PID: 1656)
      • Stem extractor Windows.exe (PID: 7876)

    • Process drops legitimate windows executable

      • Edison Declipper Windows.exe (PID: 1656)
      • Stem extractor Windows.exe (PID: 7876)

  • INFO

    • Checks supported languages

      • identity_helper.exe (PID: 1568)
      • FL.Studio.v25.1.6.4997.exe (PID: 6872)
      • extrac32.exe (PID: 148)
      • Edison Declipper Windows.exe (PID: 1656)
      • Kid.scr (PID: 6444)
      • Kid.scr (PID: 3448)
      • FL Cloud mastering v2 Windows.exe (PID: 8060)
      • Stem extractor Windows.exe (PID: 7876)

    • Reads Environment values

      • identity_helper.exe (PID: 1568)

    • Application launched itself

      • msedge.exe (PID: 7288)

    • Reads the computer name

      • identity_helper.exe (PID: 1568)
      • extrac32.exe (PID: 148)
      • Kid.scr (PID: 3448)
      • Kid.scr (PID: 6444)
      • Edison Declipper Windows.exe (PID: 1656)
      • FL Cloud mastering v2 Windows.exe (PID: 8060)
      • Stem extractor Windows.exe (PID: 7876)

    • Manual execution by a user

      • FL.Studio.v25.1.6.4997.exe (PID: 6872)
      • Edison Declipper Windows.exe (PID: 6176)
      • Edison Declipper Windows.exe (PID: 1656)
      • FL Cloud mastering v2 Windows.exe (PID: 7944)
      • FL Cloud mastering v2 Windows.exe (PID: 8060)
      • Stem extractor Windows.exe (PID: 744)
      • Stem extractor Windows.exe (PID: 7876)

    • Checks proxy server information

      • slui.exe (PID: 3568)

    • Create files in a temporary directory

      • FL.Studio.v25.1.6.4997.exe (PID: 6872)
      • extrac32.exe (PID: 148)

    • Reads mouse settings

      • Kid.scr (PID: 3448)
      • Kid.scr (PID: 6444)

    • Process checks computer location settings

      • Kid.scr (PID: 3448)

    • The sample compiled with english language support

      • Kid.scr (PID: 6444)
      • Edison Declipper Windows.exe (PID: 1656)
      • Stem extractor Windows.exe (PID: 7876)

    • Creates files or folders in the user directory

      • Kid.scr (PID: 6444)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
203
Monitored processes
51
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs winrar.exe no specs fl.studio.v25.1.6.4997.exe no specs convert.exe no specs conhost.exe no specs #AURA cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs extrac32.exe no specs findstr.exe no specs kid.scr no specs cmd.exe conhost.exe no specs kid.scr waitfor.exe no specs schtasks.exe no specs conhost.exe no specs edison declipper windows.exe no specs edison declipper windows.exe fl cloud mastering v2 windows.exe no specs fl cloud mastering v2 windows.exe stem extractor windows.exe no specs stem extractor windows.exe

Process information

PID
CMD
Path
Indicators
Parent process
148extrac32 /Y Minor.docx *.*C:\Windows\System32\extrac32.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® CAB File Extract Utility
Exit code:
0
Version:
5.00 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\extrac32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
660"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=5612,i,12300088378270631712,1191910143725829306,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
744"C:\Users\admin\Desktop\FL-Studio-Producer-Edition 25.1.6.4997-All-Plugins-Flstudiox.xom\FL Studio Producer Edition 25.1.6.4997 All Plugins\FL Studio Producer Edition 25.1.6.4997 All Plugins\FL.Studio.Addons.v250901\Stem extractor Windows.exe" C:\Users\admin\Desktop\FL-Studio-Producer-Edition 25.1.6.4997-All-Plugins-Flstudiox.xom\FL Studio Producer Edition 25.1.6.4997 All Plugins\FL Studio Producer Edition 25.1.6.4997 All Plugins\FL.Studio.Addons.v250901\Stem extractor Windows.exe—explorer.exe
User:
admin
Company:
KpoJIuK
Integrity Level:
MEDIUM
Description:
SFX
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\fl-studio-producer-edition 25.1.6.4997-all-plugins-flstudiox.xom\fl studio producer edition 25.1.6.4997 all plugins\fl studio producer edition 25.1.6.4997 all plugins\fl.studio.addons.v250901\stem extractor windows.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1148\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1508"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=6532,i,12300088378270631712,1191910143725829306,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1568"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=6256,i,12300088378270631712,1191910143725829306,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\identity_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\rpcrt4.dll
1656"C:\Users\admin\Desktop\FL-Studio-Producer-Edition 25.1.6.4997-All-Plugins-Flstudiox.xom\FL Studio Producer Edition 25.1.6.4997 All Plugins\FL Studio Producer Edition 25.1.6.4997 All Plugins\FL.Studio.Addons.v250901\Edison Declipper Windows.exe" C:\Users\admin\Desktop\FL-Studio-Producer-Edition 25.1.6.4997-All-Plugins-Flstudiox.xom\FL Studio Producer Edition 25.1.6.4997 All Plugins\FL Studio Producer Edition 25.1.6.4997 All Plugins\FL.Studio.Addons.v250901\Edison Declipper Windows.exe
explorer.exe
User:
admin
Company:
KpoJIuK
Integrity Level:
HIGH
Description:
SFX
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\fl-studio-producer-edition 25.1.6.4997-all-plugins-flstudiox.xom\fl studio producer edition 25.1.6.4997 all plugins\fl studio producer edition 25.1.6.4997 all plugins\fl.studio.addons.v250901\edison declipper windows.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.3996_none_d954cb49e10154a6\gdiplus.dll
1948"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --disable-quic --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=1428,i,12300088378270631712,1191910143725829306,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2104findstr /V "attending" Gmt C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
2376"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=5596,i,12300088378270631712,1191910143725829306,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
6 419
Read events
6 400
Write events
19
Delete events
0

Modification events

(PID) Process:(4444) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4444) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4444) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4444) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Downloads\FL-Studio-Producer-Edition 25.1.6.4997-All-Plugins-Flstudiox.xom.zip
(PID) Process:(4444) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4444) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4444) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4444) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4444) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(4444) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
Executable files
39
Suspicious files
321
Text files
69
Unknown types
0

Dropped files

PID
Process
Filename
Type
7288msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old~RF16209c.TMP —
MD5:—
SHA256:—
7288msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old —
MD5:—
SHA256:—
7288msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF1620bb.TMP —
MD5:—
SHA256:—
7288msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
7288msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF1620bb.TMP —
MD5:—
SHA256:—
7288msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
7288msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF1620bb.TMP —
MD5:—
SHA256:—
7288msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
7288msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF1620cb.TMP —
MD5:—
SHA256:—
7288msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
84
DNS requests
72
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2292
svchost.exe
GET
200
162.159.142.9:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
2800
SIHClient.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
US
binary
408 b
whitelisted
2800
SIHClient.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
US
binary
419 b
whitelisted
2800
SIHClient.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.3.crl
US
binary
813 b
whitelisted
2800
SIHClient.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.3.crl
US
binary
401 b
whitelisted
2800
SIHClient.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
US
binary
813 b
whitelisted
2800
SIHClient.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl
US
binary
814 b
whitelisted
2800
SIHClient.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
US
binary
402 b
whitelisted
804
svchost.exe
HEAD
200
184.86.251.132:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ddbf4492-d475-4fe4-bcde-6cbac56f6034?P1=1765358037&P2=404&P3=2&P4=AHLQTYmRLBl6F0J4n%2fsEBxy4n6ALwhAgpXozkAXksNXrLp%2fR7btxS44BsK2yuE6IhR9dO2jksbTB9JbSRgjR5w%3d%3d
NL
—
—
whitelisted
804
svchost.exe
GET
206
184.86.251.132:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ddbf4492-d475-4fe4-bcde-6cbac56f6034?P1=1765358037&P2=404&P3=2&P4=AHLQTYmRLBl6F0J4n%2fsEBxy4n6ALwhAgpXozkAXksNXrLp%2fR7btxS44BsK2yuE6IhR9dO2jksbTB9JbSRgjR5w%3d%3d
NL
binary
1.09 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
224
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5596
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2292
svchost.exe
40.126.31.129:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7088
SearchApp.exe
2.16.241.218:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
7620
msedge.exe
150.171.28.11:80
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
7620
msedge.exe
150.171.22.17:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7620
msedge.exe
149.154.164.13:443
graph.org
TELEGRAM
VG
whitelisted
7620
msedge.exe
150.171.27.11:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
login.live.com
  • 40.126.31.129
  • 40.126.31.0
  • 20.190.159.128
  • 20.190.159.75
  • 20.190.159.2
  • 20.190.159.71
  • 40.126.31.128
  • 40.126.31.69
whitelisted
google.com
  • 142.251.140.174
whitelisted
www.bing.com
  • 2.16.241.218
  • 2.16.241.205
  • 2.16.241.201
whitelisted
edge.microsoft.com
  • 150.171.28.11
  • 150.171.27.11
whitelisted
config.edge.skype.com
  • 150.171.22.17
whitelisted
graph.org
  • 149.154.164.13
whitelisted
copilot.microsoft.com
  • 104.18.22.222
  • 104.18.23.222
whitelisted
t.me
  • 149.154.167.99
whitelisted
edit.graph.org
  • 149.154.164.13
whitelisted

Threats

PID
Process
Class
Message
7620
msedge.exe
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
7620
msedge.exe
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
7620
msedge.exe
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
7620
msedge.exe
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://graph.org/Fl-Studio-25-Producer-Edition--Download-FL-Dtudio-25-Free---Flstudioxcom-11-17