File name:

release.rar

Full analysis: https://app.any.run/tasks/10cd1d78-0ff1-4dd4-a6ba-6a48a906a524
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 26, 2023, 19:31:19
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
evasion
privateloader
g0njxa
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

CA97EB9111A3EAA8ADC0E0FE2DCA78DC

SHA1:

B6EB8B0CF67A5AF1CB6D2F5D9D783D43B71AD51C

SHA256:

B0BB0F9533C5D732876EFA73ECFFA6AD544D6656B20E0A9AD21455636DAEDCC1

SSDEEP:

98304:+23Xm683BGoMJa6dshS5n09MWi6AwUwNxCkoX3tjpzR522jVwvdHEm8/iOqk0/lD:IXSoahU3BdmNn7sLllN7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • PRIVATELOADER has been detected (SURICATA)

      • setup.exe (PID: 6768)

    • Actions looks like stealing of personal data

      • setup.exe (PID: 6768)

    • Connects to the CnC server

      • setup.exe (PID: 6768)

  • SUSPICIOUS

    • Reads Internet Explorer settings

      • winrar-x64-700b3.exe (PID: 7148)
      • winrar-x64-700b3.exe (PID: 5020)

    • Reads the BIOS version

      • setup.exe (PID: 6768)

    • Connects to the server without a host name

      • setup.exe (PID: 6768)

    • Checks for external IP

      • setup.exe (PID: 6768)

    • Reads security settings of Internet Explorer

      • setup.exe (PID: 6768)

    • Checks Windows Trust Settings

      • setup.exe (PID: 6768)

    • Executes application which crashes

      • m25wIOeQhkKkxoje9iTUZXhj.exe (PID: 5012)

  • INFO

    • Manual execution by a user

      • msedge.exe (PID: 1872)
      • winrar-x64-700b3.exe (PID: 6932)
      • WinRAR.exe (PID: 6660)
      • winrar-x64-700b3.exe (PID: 7148)
      • setup.exe (PID: 6768)

    • Application launched itself

      • msedge.exe (PID: 1872)

    • Checks supported languages

      • identity_helper.exe (PID: 6180)
      • TextInputHost.exe (PID: 2116)
      • winrar-x64-700b3.exe (PID: 5020)
      • Uninstall.exe (PID: 3776)
      • WinRAR.exe (PID: 6660)
      • winrar-x64-700b3.exe (PID: 7148)
      • setup.exe (PID: 6768)
      • m25wIOeQhkKkxoje9iTUZXhj.exe (PID: 5012)

    • Reads the computer name

      • TextInputHost.exe (PID: 2116)
      • identity_helper.exe (PID: 6180)
      • winrar-x64-700b3.exe (PID: 5020)
      • winrar-x64-700b3.exe (PID: 7148)
      • Uninstall.exe (PID: 3776)
      • WinRAR.exe (PID: 6660)
      • setup.exe (PID: 6768)
      • m25wIOeQhkKkxoje9iTUZXhj.exe (PID: 5012)

    • Drops the executable file immediately after the start

      • msedge.exe (PID: 4340)
      • msedge.exe (PID: 1872)
      • winrar-x64-700b3.exe (PID: 7148)
      • WinRAR.exe (PID: 6660)

    • The process uses the downloaded file

      • msedge.exe (PID: 1872)
      • msedge.exe (PID: 6884)

    • Process checks Internet Explorer phishing filters

      • winrar-x64-700b3.exe (PID: 5020)
      • winrar-x64-700b3.exe (PID: 7148)

    • Checks proxy server information

      • winrar-x64-700b3.exe (PID: 5020)
      • winrar-x64-700b3.exe (PID: 7148)
      • setup.exe (PID: 6768)
      • WerFault.exe (PID: 4716)

    • Creates files in the program directory

      • winrar-x64-700b3.exe (PID: 7148)
      • Uninstall.exe (PID: 3776)

    • Drops 7-zip archiver for unpacking

      • winrar-x64-700b3.exe (PID: 7148)

    • Creates files or folders in the user directory

      • WinRAR.exe (PID: 6660)
      • Uninstall.exe (PID: 3776)
      • setup.exe (PID: 6768)

    • Reads the machine GUID from the registry

      • WinRAR.exe (PID: 6660)
      • setup.exe (PID: 6768)
      • m25wIOeQhkKkxoje9iTUZXhj.exe (PID: 5012)

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 6660)

    • Reads the software policy settings

      • setup.exe (PID: 6768)
      • WerFault.exe (PID: 4716)

    • Process checks are UAC notifies on

      • setup.exe (PID: 6768)

    • Process checks computer location settings

      • setup.exe (PID: 6768)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
163
Monitored processes
40
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
start openwith.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs textinputhost.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs rundll32.exe no specs msedge.exe no specs winrar-x64-700b3.exe no specs winrar-x64-700b3.exe msedge.exe no specs msedge.exe no specs winrar-x64-700b3.exe no specs winrar-x64-700b3.exe msedge.exe no specs uninstall.exe no specs winrar.exe no specs #PRIVATELOADER setup.exe m25wioeqhkkkxoje9ituzxhj.exe filecoauth.exe no specs werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Program Files (x86)\Microsoft\Edge\Application\105.0.1343.27\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4216 --field-trial-handle=2072,i,12872677146425389077,866381486787071848,131072 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\105.0.1343.27\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
3221226029
Version:
105.0.1343.27
Modules
Images
c:\program files (x86)\microsoft\edge\application\105.0.1343.27\identity_helper.exe
c:\windows\system32\ntdll.dll
372"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 --field-trial-handle=2072,i,12872677146425389077,866381486787071848,131072 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
105.0.1343.27
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\105.0.1343.27\msedge_elf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptbase.dll
1272"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6804 --field-trial-handle=2072,i,12872677146425389077,866381486787071848,131072 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
105.0.1343.27
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\105.0.1343.27\msedge_elf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptbase.dll
1716C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1872"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=DefaultC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
105.0.1343.27
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\105.0.1343.27\msedge_elf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptbase.dll
2116"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
121.9202.4105.0
Modules
Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
2288"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5208 --field-trial-handle=2072,i,12872677146425389077,866381486787071848,131072 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
105.0.1343.27
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\105.0.1343.27\msedge_elf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptbase.dll
2352C:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013_1\FileCoAuth.exe -EmbeddingC:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013_1\FileCoAuth.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft OneDriveFile Co-Authoring Executable
Exit code:
0
Version:
19.043.0304.0013
Modules
Images
c:\users\admin\appdata\local\microsoft\onedrive\19.043.0304.0013_1\filecoauth.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
2388"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 --field-trial-handle=2072,i,12872677146425389077,866381486787071848,131072 /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
105.0.1343.27
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\105.0.1343.27\msedge_elf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptbase.dll
3160"C:\WINDOWS\System32\OpenWith.exe" "C:\Users\admin\Desktop\release.rar"C:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
24 839
Read events
24 644
Write events
149
Delete events
46

Modification events

(PID) Process:(3160) OpenWith.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
(PID) Process:(3160) OpenWith.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:MRUListEx
Value:
04000000030000000B000000000000000A00000005000000080000000900000001000000070000000600000002000000FFFFFFFF
(PID) Process:(3160) OpenWith.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\0
Operation:writeName:MRUListEx
Value:
0600000005000000040000000100000007000000000000000200000003000000FFFFFFFF
(PID) Process:(3160) OpenWith.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\40\Shell
Operation:writeName:SniffedFolderType
Value:
Generic
(PID) Process:(3160) OpenWith.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:GlobalAssocChangedCounter
Value:
35
(PID) Process:(3160) OpenWith.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\CIDSizeMRU
Operation:delete valueName:1
Value:
4F00700065006E0057006900740068002E00650078006500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080020000E0010000000000000000000000000000000000000100000000000000
(PID) Process:(3160) OpenWith.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\CIDSizeMRU
Operation:writeName:MRUListEx
Value:
00000000FFFFFFFF
(PID) Process:(3160) OpenWith.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\40\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}
Operation:writeName:Mode
Value:
4
(PID) Process:(3160) OpenWith.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CIDOpen\Modules\GlobalSettings\ProperTreeModuleInner
Operation:writeName:ProperTreeModuleInner
Value:
9C000000980000003153505305D5CDD59C2E1B10939708002B2CF9AE3B0000002A000000004E0061007600500061006E0065005F004300460044005F0046006900720073007400520075006E0000000B000000000000004100000030000000004E0061007600500061006E0065005F00530068006F0077004C00690062007200610072007900500061006E00650000000B000000FFFF00000000000000000000
(PID) Process:(3160) OpenWith.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Modules\NavPane
Operation:writeName:ExpandedState
Value:
04000000160014001F80CB859F6720028040B29B5540CC05AAB60000010000004D0000001C00000031535053A66A63283D95D211B5D600C04FD918D0000000002D00000031535053357EC777E31B5043A48C7563D727776D1100000002000000000B000000FFFF00000000000000000000160014001F60983FFBB4EAC18D42A78AD1F5659CBA930000010000004D0000001C00000031535053A66A63283D95D211B5D600C04FD918D0000000002D00000031535053357EC777E31B5043A48C7563D727776D1100000002000000000B000000FFFF00000000000000000000160014001F580D1A2CF021BE504388B07367FC96EF3C0000010000004D0000001C00000031535053A66A63283D95D211B5D600C04FD918D0000000002D00000031535053357EC777E31B5043A48C7563D727776D1100000002000000000B000000000000000000000000000000160014001F50E04FD020EA3A6910A2D808002B30309D0000010000004D0000001C00000031535053A66A63283D95D211B5D600C04FD918D0000000002D00000031535053357EC777E31B5043A48C7563D727776D1100000002000000000B000000000000000000000000000000
Executable files
34
Suspicious files
312
Text files
54
Unknown types
0

Dropped files

PID
Process
Filename
Type
1872msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old —
MD5:—
SHA256:—
1872msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RFf49c1.TMP —
MD5:—
SHA256:—
1872msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
1872msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old~RFf49f0.TMP —
MD5:—
SHA256:—
1872msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RFf4a3e.TMP —
MD5:—
SHA256:—
1872msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old —
MD5:—
SHA256:—
1872msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old~RFf49c1.TMPtext
MD5:547620D929EDE8D5E347CF977232D297
SHA256:2D2BB13A4BDF44AA6A987BEE96A50D73974F05CB60C553F44ECCAA1F77918728
1872msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RFf4ca0.TMP —
MD5:—
SHA256:—
1872msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old~RFf49b2.TMPtext
MD5:972D26A5FA0BA9ABCBD1E26C70C31036
SHA256:773F4F52034D63204C420B54E59D4BF9C873D6515CE6E0AF306B7E6484D15922
1872msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:4F1D77A6CC0D809E902E51D9C028EC94
SHA256:B80316DACB2F80086B6268A627DD74C69A64F160D2370D2457C497D8C1926AAE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
664
TCP/UDP connections
130
DNS requests
41
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
HEAD
200
23.213.164.137:443
https://fs.microsoft.com/fs/windows/config.json
unknown
—
—
—
2508
svchost.exe
GET
200
2.16.164.9:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
binary
1.11 Kb
unknown
2508
svchost.exe
GET
200
88.221.125.143:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.3.crl
unknown
binary
813 b
unknown
2508
svchost.exe
GET
200
2.16.164.9:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
binary
824 b
unknown
2508
svchost.exe
GET
200
88.221.125.143:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
binary
418 b
unknown
2508
svchost.exe
GET
200
88.221.125.143:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl
unknown
binary
814 b
unknown
2508
svchost.exe
GET
200
88.221.125.143:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.3.crl
unknown
binary
400 b
unknown
2508
svchost.exe
GET
200
88.221.125.143:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
binary
813 b
unknown
2836
svchost.exe
GET
206
184.24.77.173:80
http://au.download.windowsupdate.com/d/msdownload/update/software/defu/2022/11/am_engine_a13d0f0a32e2ba218a67afd0e3cb522012eac063.exe
unknown
text
2 b
unknown
2836
svchost.exe
GET
206
184.24.77.173:80
http://au.download.windowsupdate.com/d/msdownload/update/software/defu/2022/11/am_engine_a13d0f0a32e2ba218a67afd0e3cb522012eac063.exe
unknown
binary
333 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2508
svchost.exe
2.16.164.9:80
crl.microsoft.com
Akamai International B.V.
NL
unknown
2508
svchost.exe
88.221.125.143:80
www.microsoft.com
AKAMAI-AS
DE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
2836
svchost.exe
52.184.216.246:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
2836
svchost.exe
184.24.77.173:80
au.download.windowsupdate.com
Akamai International B.V.
DE
unknown
2836
svchost.exe
184.24.77.187:80
au.download.windowsupdate.com
Akamai International B.V.
DE
unknown
2508
svchost.exe
20.12.23.50:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1872
msedge.exe
51.104.176.40:443
ping-edge.smartscreen.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4340
msedge.exe
204.79.197.203:443
ntp.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.16.164.9
  • 2.16.164.49
  • 2.16.164.72
  • 2.16.164.106
whitelisted
www.microsoft.com
  • 88.221.125.143
  • 184.30.21.171
whitelisted
au.download.windowsupdate.com
  • 184.24.77.173
  • 184.24.77.187
  • 184.24.77.205
  • 184.24.77.200
  • 184.24.77.208
  • 184.24.77.207
  • 184.24.77.194
  • 93.184.221.240
whitelisted
ping-edge.smartscreen.microsoft.com
  • 51.104.176.40
whitelisted
ntp.msn.com
  • 204.79.197.203
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
www.bing.com
  • 2.23.209.187
  • 2.23.209.133
  • 2.23.209.130
  • 2.23.209.182
whitelisted
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
data-edge.smartscreen.microsoft.com
  • 20.103.180.120
whitelisted
th.bing.com
  • 2.19.96.34
  • 2.19.96.25
  • 2.19.96.10
  • 2.19.96.8
  • 2.19.96.26
  • 2.19.96.24
  • 2.19.96.35
  • 2.19.96.40
  • 2.19.96.42
whitelisted

Threats

PID
Process
Class
Message
6768
setup.exe
Device Retrieving External IP Address Detected
ET INFO Observed External IP Lookup Domain in TLS SNI (api .myip .com)
6768
setup.exe
Device Retrieving External IP Address Detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
6768
setup.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup SSL Cert Observed (ipinfo .io)
6768
setup.exe
A Network Trojan was detected
LOADER [ANY.RUN] PrivateLoader Check-in
6768
setup.exe
A Network Trojan was detected
LOADER [ANY.RUN] PrivateLoader Check-in
6768
setup.exe
A Network Trojan was detected
LOADER [ANY.RUN] PrivateLoader Check-in
2120
svchost.exe
Potential Corporate Privacy Violation
ET POLICY IP Check Domain (iplogger .org in DNS Lookup)
6768
setup.exe
Potential Corporate Privacy Violation
ET POLICY IP Check Domain (iplogger .org in TLS SNI)
Process
Message
m25wIOeQhkKkxoje9iTUZXhj.exe
CLR: Managed code called FailFast, saying "
m25wIOeQhkKkxoje9iTUZXhj.exe
System requirements not met.
m25wIOeQhkKkxoje9iTUZXhj.exe
"
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
release.rar