File name:

release.rar

Full analysis: https://app.any.run/tasks/10cd1d78-0ff1-4dd4-a6ba-6a48a906a524
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 26, 2023, 19:31:19
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
evasion
privateloader
g0njxa
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

CA97EB9111A3EAA8ADC0E0FE2DCA78DC

SHA1:

B6EB8B0CF67A5AF1CB6D2F5D9D783D43B71AD51C

SHA256:

B0BB0F9533C5D732876EFA73ECFFA6AD544D6656B20E0A9AD21455636DAEDCC1

SSDEEP:

98304:+23Xm683BGoMJa6dshS5n09MWi6AwUwNxCkoX3tjpzR522jVwvdHEm8/iOqk0/lD:IXSoahU3BdmNn7sLllN7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • setup.exe (PID: 6768)

    • PRIVATELOADER has been detected (SURICATA)

      • setup.exe (PID: 6768)

    • Connects to the CnC server

      • setup.exe (PID: 6768)

  • SUSPICIOUS

    • Reads Internet Explorer settings

      • winrar-x64-700b3.exe (PID: 5020)
      • winrar-x64-700b3.exe (PID: 7148)

    • Reads the BIOS version

      • setup.exe (PID: 6768)

    • Connects to the server without a host name

      • setup.exe (PID: 6768)

    • Reads security settings of Internet Explorer

      • setup.exe (PID: 6768)

    • Checks for external IP

      • setup.exe (PID: 6768)

    • Checks Windows Trust Settings

      • setup.exe (PID: 6768)

    • Executes application which crashes

      • m25wIOeQhkKkxoje9iTUZXhj.exe (PID: 5012)

  • INFO

    • Reads the computer name

      • TextInputHost.exe (PID: 2116)
      • identity_helper.exe (PID: 6180)
      • winrar-x64-700b3.exe (PID: 5020)
      • winrar-x64-700b3.exe (PID: 7148)
      • setup.exe (PID: 6768)
      • m25wIOeQhkKkxoje9iTUZXhj.exe (PID: 5012)
      • Uninstall.exe (PID: 3776)
      • WinRAR.exe (PID: 6660)

    • Manual execution by a user

      • msedge.exe (PID: 1872)
      • winrar-x64-700b3.exe (PID: 6932)
      • winrar-x64-700b3.exe (PID: 7148)
      • WinRAR.exe (PID: 6660)
      • setup.exe (PID: 6768)

    • Checks supported languages

      • identity_helper.exe (PID: 6180)
      • TextInputHost.exe (PID: 2116)
      • winrar-x64-700b3.exe (PID: 5020)
      • winrar-x64-700b3.exe (PID: 7148)
      • Uninstall.exe (PID: 3776)
      • setup.exe (PID: 6768)
      • m25wIOeQhkKkxoje9iTUZXhj.exe (PID: 5012)
      • WinRAR.exe (PID: 6660)

    • Drops the executable file immediately after the start

      • msedge.exe (PID: 4340)
      • msedge.exe (PID: 1872)
      • winrar-x64-700b3.exe (PID: 7148)
      • WinRAR.exe (PID: 6660)

    • The process uses the downloaded file

      • msedge.exe (PID: 6884)
      • msedge.exe (PID: 1872)

    • Checks proxy server information

      • winrar-x64-700b3.exe (PID: 5020)
      • winrar-x64-700b3.exe (PID: 7148)
      • setup.exe (PID: 6768)
      • WerFault.exe (PID: 4716)

    • Process checks Internet Explorer phishing filters

      • winrar-x64-700b3.exe (PID: 5020)
      • winrar-x64-700b3.exe (PID: 7148)

    • Application launched itself

      • msedge.exe (PID: 1872)

    • Creates files or folders in the user directory

      • Uninstall.exe (PID: 3776)
      • WinRAR.exe (PID: 6660)
      • setup.exe (PID: 6768)

    • Reads the machine GUID from the registry

      • WinRAR.exe (PID: 6660)
      • setup.exe (PID: 6768)
      • m25wIOeQhkKkxoje9iTUZXhj.exe (PID: 5012)

    • Creates files in the program directory

      • winrar-x64-700b3.exe (PID: 7148)
      • Uninstall.exe (PID: 3776)

    • Drops 7-zip archiver for unpacking

      • winrar-x64-700b3.exe (PID: 7148)

    • Process checks are UAC notifies on

      • setup.exe (PID: 6768)

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 6660)

    • Process checks computer location settings

      • setup.exe (PID: 6768)

    • Reads the software policy settings

      • setup.exe (PID: 6768)
      • WerFault.exe (PID: 4716)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
163
Monitored processes
40
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
start openwith.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs textinputhost.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs rundll32.exe no specs msedge.exe no specs winrar-x64-700b3.exe no specs winrar-x64-700b3.exe msedge.exe no specs msedge.exe no specs winrar-x64-700b3.exe no specs winrar-x64-700b3.exe msedge.exe no specs uninstall.exe no specs winrar.exe no specs #PRIVATELOADER setup.exe m25wioeqhkkkxoje9ituzxhj.exe filecoauth.exe no specs werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Program Files (x86)\Microsoft\Edge\Application\105.0.1343.27\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4216 --field-trial-handle=2072,i,12872677146425389077,866381486787071848,131072 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\105.0.1343.27\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
3221226029
Version:
105.0.1343.27
Modules
Images
c:\program files (x86)\microsoft\edge\application\105.0.1343.27\identity_helper.exe
c:\windows\system32\ntdll.dll
372"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 --field-trial-handle=2072,i,12872677146425389077,866381486787071848,131072 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
105.0.1343.27
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\105.0.1343.27\msedge_elf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptbase.dll
1272"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6804 --field-trial-handle=2072,i,12872677146425389077,866381486787071848,131072 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
105.0.1343.27
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\105.0.1343.27\msedge_elf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptbase.dll
1716C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1872"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=DefaultC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
105.0.1343.27
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\105.0.1343.27\msedge_elf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptbase.dll
2116"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
121.9202.4105.0
Modules
Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
2288"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5208 --field-trial-handle=2072,i,12872677146425389077,866381486787071848,131072 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
105.0.1343.27
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\105.0.1343.27\msedge_elf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptbase.dll
2352C:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013_1\FileCoAuth.exe -EmbeddingC:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013_1\FileCoAuth.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft OneDriveFile Co-Authoring Executable
Exit code:
0
Version:
19.043.0304.0013
Modules
Images
c:\users\admin\appdata\local\microsoft\onedrive\19.043.0304.0013_1\filecoauth.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
2388"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 --field-trial-handle=2072,i,12872677146425389077,866381486787071848,131072 /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
105.0.1343.27
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\105.0.1343.27\msedge_elf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptbase.dll
3160"C:\WINDOWS\System32\OpenWith.exe" "C:\Users\admin\Desktop\release.rar"C:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
24 839
Read events
24 644
Write events
149
Delete events
46

Modification events

(PID) Process:(3160) OpenWith.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
(PID) Process:(3160) OpenWith.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:MRUListEx
Value:
04000000030000000B000000000000000A00000005000000080000000900000001000000070000000600000002000000FFFFFFFF
(PID) Process:(3160) OpenWith.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0
Operation:writeName:MRUListEx
Value:
0600000005000000040000000100000007000000000000000200000003000000FFFFFFFF
(PID) Process:(3160) OpenWith.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\40\Shell
Operation:writeName:SniffedFolderType
Value:
Generic
(PID) Process:(3160) OpenWith.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:GlobalAssocChangedCounter
Value:
35
(PID) Process:(3160) OpenWith.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\CIDSizeMRU
Operation:delete valueName:1
Value:
4F00700065006E0057006900740068002E00650078006500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080020000E0010000000000000000000000000000000000000100000000000000
(PID) Process:(3160) OpenWith.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\CIDSizeMRU
Operation:writeName:MRUListEx
Value:
00000000FFFFFFFF
(PID) Process:(3160) OpenWith.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\40\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}
Operation:writeName:Mode
Value:
4
(PID) Process:(3160) OpenWith.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CIDOpen\Modules\GlobalSettings\ProperTreeModuleInner
Operation:writeName:ProperTreeModuleInner
Value:
9C000000980000003153505305D5CDD59C2E1B10939708002B2CF9AE3B0000002A000000004E0061007600500061006E0065005F004300460044005F0046006900720073007400520075006E0000000B000000000000004100000030000000004E0061007600500061006E0065005F00530068006F0077004C00690062007200610072007900500061006E00650000000B000000FFFF00000000000000000000
(PID) Process:(3160) OpenWith.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Modules\NavPane
Operation:writeName:ExpandedState
Value:
04000000160014001F80CB859F6720028040B29B5540CC05AAB60000010000004D0000001C00000031535053A66A63283D95D211B5D600C04FD918D0000000002D00000031535053357EC777E31B5043A48C7563D727776D1100000002000000000B000000FFFF00000000000000000000160014001F60983FFBB4EAC18D42A78AD1F5659CBA930000010000004D0000001C00000031535053A66A63283D95D211B5D600C04FD918D0000000002D00000031535053357EC777E31B5043A48C7563D727776D1100000002000000000B000000FFFF00000000000000000000160014001F580D1A2CF021BE504388B07367FC96EF3C0000010000004D0000001C00000031535053A66A63283D95D211B5D600C04FD918D0000000002D00000031535053357EC777E31B5043A48C7563D727776D1100000002000000000B000000000000000000000000000000160014001F50E04FD020EA3A6910A2D808002B30309D0000010000004D0000001C00000031535053A66A63283D95D211B5D600C04FD918D0000000002D00000031535053357EC777E31B5043A48C7563D727776D1100000002000000000B000000000000000000000000000000
Executable files
34
Suspicious files
312
Text files
54
Unknown types
0

Dropped files

PID
Process
Filename
Type
1872msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old —
MD5:—
SHA256:—
1872msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RFf49c1.TMP —
MD5:—
SHA256:—
1872msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
1872msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old~RFf49f0.TMP —
MD5:—
SHA256:—
1872msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RFf4a3e.TMP —
MD5:—
SHA256:—
1872msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old —
MD5:—
SHA256:—
1872msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old~RFf49b2.TMPtext
MD5:2F58D7AADB6797F54FB74445ECB3B140
SHA256:2A742591827FF457B0B7240A2AF917AF56171F0A7C01F2AE3AFF4C7E5E0C139D
1872msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RFf4ca0.TMP —
MD5:—
SHA256:—
1872msedge.exeC:\USERS\ADMIN\APPDATA\LOCAL\MICROSOFT\EDGE\USER DATA\CRASHPAD\SETTINGS.DATbinary
MD5:F031F91FDE71CDF88D17A4F61F978C6D
SHA256:373A3DDC2064369794624ACC2FB61A4196CD7B0C05532879B2B80860DF7E7A62
1872msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Last Versiontext
MD5:BE8F261C28760A40087E9917A434D688
SHA256:3BFDF4421C179EFF12CB51B407C7FE6324671355FEB03F648416A8F431AD4C8F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
664
TCP/UDP connections
130
DNS requests
41
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
HEAD
200
23.213.164.137:443
https://fs.microsoft.com/fs/windows/config.json
unknown
—
—
unknown
2508
svchost.exe
GET
200
2.16.164.9:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
binary
1.11 Kb
unknown
2508
svchost.exe
GET
200
88.221.125.143:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.3.crl
unknown
binary
813 b
unknown
2508
svchost.exe
GET
200
2.16.164.9:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
binary
824 b
unknown
2508
svchost.exe
GET
200
88.221.125.143:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl
unknown
binary
814 b
unknown
2508
svchost.exe
GET
200
88.221.125.143:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.3.crl
unknown
binary
400 b
unknown
2508
svchost.exe
GET
200
88.221.125.143:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
binary
813 b
unknown
2508
svchost.exe
GET
200
88.221.125.143:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
binary
400 b
unknown
2836
svchost.exe
GET
206
184.24.77.173:80
http://au.download.windowsupdate.com/d/msdownload/update/software/defu/2022/11/am_engine_a13d0f0a32e2ba218a67afd0e3cb522012eac063.exe
unknown
text
2 b
unknown
2836
svchost.exe
GET
206
184.24.77.173:80
http://au.download.windowsupdate.com/d/msdownload/update/software/defu/2022/11/am_engine_a13d0f0a32e2ba218a67afd0e3cb522012eac063.exe
unknown
binary
1.00 Mb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2508
svchost.exe
2.16.164.9:80
crl.microsoft.com
Akamai International B.V.
NL
unknown
2508
svchost.exe
88.221.125.143:80
www.microsoft.com
AKAMAI-AS
DE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
2836
svchost.exe
52.184.216.246:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
2836
svchost.exe
184.24.77.173:80
au.download.windowsupdate.com
Akamai International B.V.
DE
unknown
2836
svchost.exe
184.24.77.187:80
au.download.windowsupdate.com
Akamai International B.V.
DE
unknown
2508
svchost.exe
20.12.23.50:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1872
msedge.exe
51.104.176.40:443
ping-edge.smartscreen.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4340
msedge.exe
204.79.197.203:443
ntp.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.16.164.9
  • 2.16.164.49
  • 2.16.164.72
  • 2.16.164.106
whitelisted
www.microsoft.com
  • 88.221.125.143
  • 184.30.21.171
whitelisted
au.download.windowsupdate.com
  • 184.24.77.173
  • 184.24.77.187
  • 184.24.77.205
  • 184.24.77.200
  • 184.24.77.208
  • 184.24.77.207
  • 184.24.77.194
  • 93.184.221.240
whitelisted
ping-edge.smartscreen.microsoft.com
  • 51.104.176.40
whitelisted
ntp.msn.com
  • 204.79.197.203
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
www.bing.com
  • 2.23.209.187
  • 2.23.209.133
  • 2.23.209.130
  • 2.23.209.182
whitelisted
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
data-edge.smartscreen.microsoft.com
  • 20.103.180.120
whitelisted
th.bing.com
  • 2.19.96.34
  • 2.19.96.25
  • 2.19.96.10
  • 2.19.96.8
  • 2.19.96.26
  • 2.19.96.24
  • 2.19.96.35
  • 2.19.96.40
  • 2.19.96.42
whitelisted

Threats

PID
Process
Class
Message
6768
setup.exe
Device Retrieving External IP Address Detected
ET INFO Observed External IP Lookup Domain in TLS SNI (api .myip .com)
6768
setup.exe
Device Retrieving External IP Address Detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
6768
setup.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup SSL Cert Observed (ipinfo .io)
6768
setup.exe
A Network Trojan was detected
LOADER [ANY.RUN] PrivateLoader Check-in
6768
setup.exe
A Network Trojan was detected
LOADER [ANY.RUN] PrivateLoader Check-in
6768
setup.exe
A Network Trojan was detected
LOADER [ANY.RUN] PrivateLoader Check-in
2120
svchost.exe
Potential Corporate Privacy Violation
ET POLICY IP Check Domain (iplogger .org in DNS Lookup)
6768
setup.exe
Potential Corporate Privacy Violation
ET POLICY IP Check Domain (iplogger .org in TLS SNI)
Process
Message
m25wIOeQhkKkxoje9iTUZXhj.exe
CLR: Managed code called FailFast, saying "
m25wIOeQhkKkxoje9iTUZXhj.exe
System requirements not met.
m25wIOeQhkKkxoje9iTUZXhj.exe
"
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
release.rar