URL:

https://1drv.ms/b/s!Ao4nPevi4rSNgSqMK7nSmJfc4K-j

Full analysis: https://app.any.run/tasks/e9a41978-dd58-4fd2-81f0-2d02a718733f
Verdict: Malicious activity
Analysis date: October 22, 2023, 19:41:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
SHA1:

D3F3CE90ABC576AB1346467DC4E7E45E8A0079C8

SHA256:

ABAD611A8E72626D921D366E04B778F3031B47C5B1CCDD2722DB11BC9F0B7B2A

SSDEEP:

3:N8qDLIWKtYWQXMNbaIyn:2qXHiKn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • MicrosoftEdgeSetup.exe (PID: 2512)
      • MicrosoftEdgeUpdate.exe (PID: 3980)
      • MicrosoftEdgeUpdateSetup.exe (PID: 2984)
      • MicrosoftEdgeUpdate.exe (PID: 1904)
      • setup.exe (PID: 2620)
      • setup.exe (PID: 4912)

    • Loads dropped or rewritten executable

      • MicrosoftEdgeUpdate.exe (PID: 3980)
      • MicrosoftEdgeUpdate.exe (PID: 1904)
      • MicrosoftEdgeUpdate.exe (PID: 3656)
      • MicrosoftEdgeUpdate.exe (PID: 2476)
      • MicrosoftEdgeUpdate.exe (PID: 3324)
      • MicrosoftEdgeUpdate.exe (PID: 2516)
      • MicrosoftEdgeUpdate.exe (PID: 2732)

    • Drops the executable file immediately after the start

      • MicrosoftEdgeUpdateSetup.exe (PID: 2984)
      • MicrosoftEdgeSetup.exe (PID: 2512)
      • setup.exe (PID: 2620)
      • MicrosoftEdge_X86_109.0.1518.140.exe (PID: 3184)

    • Changes the autorun value in the registry

      • setup.exe (PID: 2620)

    • Creates a writable file the system directory

      • MicrosoftEdgeUpdate.exe (PID: 5692)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • iexplore.exe (PID: 1560)
      • iexplore.exe (PID: 3820)
      • MicrosoftEdgeSetup.exe (PID: 2512)
      • MicrosoftEdgeUpdate.exe (PID: 1904)
      • MicrosoftEdgeUpdateSetup.exe (PID: 2984)
      • setup.exe (PID: 2620)
      • MicrosoftEdge_X86_109.0.1518.140.exe (PID: 3184)

    • Disables SEHOP

      • MicrosoftEdgeUpdate.exe (PID: 1904)

    • Reads the Internet Settings

      • MicrosoftEdgeUpdate.exe (PID: 2732)

    • Executes as Windows Service

      • MicrosoftEdgeUpdate.exe (PID: 3324)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdate.exe (PID: 2476)
      • setup.exe (PID: 2620)

    • Creates a software uninstall entry

      • MicrosoftEdgeUpdate.exe (PID: 1904)
      • setup.exe (PID: 2620)

    • Reads security settings of Internet Explorer

      • MicrosoftEdgeUpdate.exe (PID: 2732)

    • Checks Windows Trust Settings

      • MicrosoftEdgeUpdate.exe (PID: 2732)
      • MicrosoftEdgeUpdate.exe (PID: 3324)
      • MicrosoftEdgeUpdate.exe (PID: 5692)

    • Reads settings of System Certificates

      • MicrosoftEdgeUpdate.exe (PID: 2732)

    • Searches for installed software

      • setup.exe (PID: 2620)

    • Application launched itself

      • MicrosoftEdgeUpdate.exe (PID: 3324)
      • setup.exe (PID: 2620)

  • INFO

    • The process uses the downloaded file

      • iexplore.exe (PID: 3820)
      • MicrosoftEdgeSetup.exe (PID: 2512)
      • chrome.exe (PID: 3880)
      • chrome.exe (PID: 2884)
      • chrome.exe (PID: 1912)
      • chrome.exe (PID: 2424)

    • Application launched itself

      • iexplore.exe (PID: 3820)
      • msedge.exe (PID: 2696)
      • chrome.exe (PID: 2748)
      • AcroRd32.exe (PID: 2004)
      • RdrCEF.exe (PID: 4676)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 1560)
      • iexplore.exe (PID: 3820)

    • Checks supported languages

      • MicrosoftEdgeSetup.exe (PID: 2512)
      • MicrosoftEdgeUpdate.exe (PID: 3980)
      • MicrosoftEdgeUpdateSetup.exe (PID: 2984)
      • MicrosoftEdgeUpdate.exe (PID: 1904)
      • MicrosoftEdgeUpdate.exe (PID: 3656)
      • MicrosoftEdgeUpdate.exe (PID: 2516)
      • MicrosoftEdgeUpdate.exe (PID: 2476)
      • MicrosoftEdgeUpdate.exe (PID: 2732)
      • MicrosoftEdge_X86_109.0.1518.140.exe (PID: 3184)
      • MicrosoftEdgeUpdate.exe (PID: 3324)
      • setup.exe (PID: 2620)
      • setup.exe (PID: 4912)
      • MicrosoftEdgeUpdate.exe (PID: 5692)

    • Create files in a temporary directory

      • MicrosoftEdgeSetup.exe (PID: 2512)
      • MicrosoftEdgeUpdate.exe (PID: 2732)

    • Reads the computer name

      • MicrosoftEdgeUpdate.exe (PID: 3980)
      • MicrosoftEdgeUpdate.exe (PID: 1904)
      • MicrosoftEdgeUpdate.exe (PID: 3656)
      • MicrosoftEdgeUpdate.exe (PID: 2516)
      • MicrosoftEdgeUpdate.exe (PID: 3324)
      • MicrosoftEdgeUpdate.exe (PID: 2476)
      • MicrosoftEdgeUpdate.exe (PID: 2732)
      • setup.exe (PID: 2620)
      • MicrosoftEdge_X86_109.0.1518.140.exe (PID: 3184)
      • MicrosoftEdgeUpdate.exe (PID: 5692)
      • setup.exe (PID: 4912)

    • Reads the machine GUID from the registry

      • MicrosoftEdgeUpdate.exe (PID: 3980)
      • setup.exe (PID: 2620)

    • Creates files in the program directory

      • MicrosoftEdgeUpdateSetup.exe (PID: 2984)
      • setup.exe (PID: 2620)
      • MicrosoftEdge_X86_109.0.1518.140.exe (PID: 3184)
      • setup.exe (PID: 4912)

    • Reads Environment values

      • MicrosoftEdgeUpdate.exe (PID: 2732)
      • MicrosoftEdgeUpdate.exe (PID: 5692)

    • Checks proxy server information

      • MicrosoftEdgeUpdate.exe (PID: 2732)

    • Manual execution by a user

      • chrome.exe (PID: 2748)
      • msedge.exe (PID: 2696)
      • AcroRd32.exe (PID: 2004)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
113
Monitored processes
69
Malicious processes
9
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe microsoftedgesetup.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdatesetup.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe chrome.exe chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs microsoftedge_x86_109.0.1518.140.exe no specs chrome.exe no specs setup.exe chrome.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs acrord32.exe acrord32.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs rdrcef.exe rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs setup.exe no specs microsoftedgeupdate.exe chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
388"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3920 --field-trial-handle=984,i,1130805073018807432,5976761390880598356,131072 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
560"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1428 --field-trial-handle=984,i,1130805073018807432,5976761390880598356,131072 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
592"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --pdf-renderer --disable-gpu-compositing --lang=en-US --js-flags=--jitless --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=4452 --field-trial-handle=984,i,1130805073018807432,5976761390880598356,131072 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
820"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --field-trial-handle=1140,423157057720296761,12136664678514292670,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.13.20064 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --service-request-channel-token=6531807286587262482 --mojo-platform-channel-handle=1348 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
1
Version:
20.13.20064.405839
Modules
Images
c:\program files\adobe\acrobat reader dc\reader\acrocef\rdrcef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1560"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3820 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
1772"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4064 --field-trial-handle=984,i,1130805073018807432,5976761390880598356,131072 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
1792"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3712 --field-trial-handle=984,i,1130805073018807432,5976761390880598356,131072 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
1804"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2264 --field-trial-handle=1312,i,16762189898617854984,8715672472298469685,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1836"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x6b378b38,0x6b378b48,0x6b378b54C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
1876"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1604 --field-trial-handle=1312,i,16762189898617854984,8715672472298469685,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
54 617
Read events
51 271
Write events
3 225
Delete events
121

Modification events

(PID) Process:(3820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(3820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(3820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(3820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3820) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
390
Suspicious files
1 675
Text files
122
Unknown types
0

Dropped files

PID
Process
Filename
Type
1560iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\main[1].pngimage
MD5:8D20CB2E557FDD5F321E3C62C0933A49
SHA256:68BA43E5B3B5B8656888FBFACFF588C9294A0A100667591BC69488130772DAFD
1560iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\redir[1].htmhtml
MD5:F8BD9F01F5F9F7145F6F133C98EEEDFB
SHA256:C395133175D9E7535EA2A6336C91D2A504F915CC061ED2B601BF3DA663A7E271
1560iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177binary
MD5:9EA3D39181B3239B6FA4CA27C0B72437
SHA256:76ED31F9B31A3818A4F2457A63EDA60C54C71111CFB93B586ED513A84D12426B
1560iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177binary
MD5:68E5B3E3B1B00B2A5396F3AEB326B74D
SHA256:35305571D52A5BEC5664113C58F54B85F19F4C20C1A44A21ECC85908503D24A7
1560iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\BQ0XZOGL.txttext
MD5:B971653BEC03F4DDC330164AD6DE4E54
SHA256:78FB8800E949A9E2A8A9D9D7ABC57E90D2AA2963AA349B06EA1502DC9496D74D
1560iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868binary
MD5:8582E43282BBF340EDF1340A22DE55F9
SHA256:441D7EE432E81A7CA2F6839A34E09AB232A1A34727C9BA7AC0A3AD1525802A92
1560iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868binary
MD5:7C13869487E7DFC15FEB87FA6EDFD339
SHA256:7877B482DE205A603DC6DA077544BA9A5CDCE23AD70A4ED05CE2B6CC3170F8E1
1560iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:A4FBAF9951E6FF79F12944A3AD53369D
SHA256:BCA2E18ABD4375B066A310DFB846F4FB1B7A54C1B9D376F9B1DFB38D68F6C021
3820iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Abinary
MD5:916715CFC14DE807913B118636E33BD7
SHA256:0DC2333D7451CAD1072AA728DAE33340BE0CC00912CADB035C4EEE321FEC3947
3820iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[1].icoimage
MD5:604ADFB53677B5CA4F910FFB131B3E7C
SHA256:24638331466A52BB66F912090E7A9CC9E3DF2236E39C187C9409104526B472B0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
19
TCP/UDP connections
132
DNS requests
143
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
864
svchost.exe
HEAD
200
8.253.207.121:80
http://msedge.f.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/d87a3bbd-7fe5-4ec3-b806-293cca78b363?P1=1698608555&P2=404&P3=2&P4=c0bttGp8ekgUvrnLoIYpP1xzd720fM%2bKAidoVhK8rAK6McZ213Jm03Id1DGod3UPNdlb8%2f03Cj7NhD1fAMTyDA%3d%3d
unknown
—
—
unknown
864
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad3rm3ciqs3fjr4bc4x5vwuildeq_9.49.1/gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.49.1_all_ixzyrcu7pvmgu5pjv6enfqq6wa.crx3
unknown
—
—
unknown
1560
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D
unknown
binary
471 b
unknown
1560
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8f869686e34b7eef
unknown
compressed
4.66 Kb
unknown
1560
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f8f3bf607e1d79ae
unknown
compressed
4.66 Kb
unknown
1560
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAqvpsXKY8RRQeo74ffHUxc%3D
unknown
binary
471 b
unknown
3820
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
3820
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
314 b
unknown
1560
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
binary
471 b
unknown
1560
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1560
iexplore.exe
13.107.42.12:443
api.onedrive.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1560
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted
1560
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1560
iexplore.exe
13.107.42.13:443
onedrive.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1560
iexplore.exe
51.105.104.217:443
p.sfx.ms
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
3820
iexplore.exe
51.105.104.217:443
p.sfx.ms
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
3820
iexplore.exe
104.126.37.170:443
www.bing.com
Akamai International B.V.
DE
unknown
3820
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
onedrive.live.com
  • 13.107.42.13
shared
p.sfx.ms
  • 51.105.104.217
  • 20.101.246.164
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.170
  • 104.126.37.123
  • 104.126.37.128
  • 104.126.37.185
  • 104.126.37.186
  • 104.126.37.129
  • 104.126.37.136
  • 104.126.37.171
  • 104.126.37.176
  • 2.19.120.29
  • 2.19.120.21
  • 204.79.197.200
  • 13.107.21.200
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
www.microsoft.com
  • 23.213.169.249
whitelisted
ajax.aspnetcdn.com
  • 152.199.19.160
whitelisted

Threats

PID
Process
Class
Message
864
svchost.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
560
chrome.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Downloading from a file sharing service is observed
560
chrome.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Downloading from a file sharing service is observed
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://1drv.ms/b/s!Ao4nPevi4rSNgSqMK7nSmJfc4K-j