File name:

15342_35965949_be6c151cc94797e2dafbc9000565678da00257421b3d8b355c06050881823f47_cyberjack kartenleser setup mit rechtklick als admin ausführen bc_7_8_10.exe

Full analysis: https://app.any.run/tasks/390afe12-c523-4fd7-a862-664503de4b01
Verdict: Malicious activity
Analysis date: May 14, 2024, 10:45:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

248EE3C92E4F58E0ACAE99BA54890218

SHA1:

607E66A19C716A0554193D5D66EC3561A5101B4F

SHA256:

BE6C151CC94797E2DAFBC9000565678DA00257421B3D8B355C06050881823F47

SSDEEP:

196608:CoOI8qsnbrlqPtWB6zbR2TgBO9rwK0ivFs:OIGnNe/B2/rL0ii

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • rundll32.exe (PID: 3956)
      • 15342_35965949_be6c151cc94797e2dafbc9000565678da00257421b3d8b355c06050881823f47_cyberjack kartenleser setup mit rechtklick als admin ausführen bc_7_8_10.exe (PID: 2752)
      • DPInst.exe (PID: 3912)
      • drvinst.exe (PID: 3776)

    • Creates a writable file in the system directory

      • 15342_35965949_be6c151cc94797e2dafbc9000565678da00257421b3d8b355c06050881823f47_cyberjack kartenleser setup mit rechtklick als admin ausführen bc_7_8_10.exe (PID: 2752)
      • drvinst.exe (PID: 3776)

  • SUSPICIOUS

    • Reads the Internet Settings

      • rundll32.exe (PID: 3956)

    • Searches for installed software

      • 15342_35965949_be6c151cc94797e2dafbc9000565678da00257421b3d8b355c06050881823f47_cyberjack kartenleser setup mit rechtklick als admin ausführen bc_7_8_10.exe (PID: 2752)

    • Executable content was dropped or overwritten

      • 15342_35965949_be6c151cc94797e2dafbc9000565678da00257421b3d8b355c06050881823f47_cyberjack kartenleser setup mit rechtklick als admin ausführen bc_7_8_10.exe (PID: 2752)
      • DPInst.exe (PID: 3912)
      • drvinst.exe (PID: 3776)

    • Reads the Windows owner or organization settings

      • 15342_35965949_be6c151cc94797e2dafbc9000565678da00257421b3d8b355c06050881823f47_cyberjack kartenleser setup mit rechtklick als admin ausführen bc_7_8_10.exe (PID: 2752)

    • Executes as Windows Service

      • VSSVC.exe (PID: 2652)
      • cjpcsc.exe (PID: 1704)

    • Process drops legitimate windows executable

      • 15342_35965949_be6c151cc94797e2dafbc9000565678da00257421b3d8b355c06050881823f47_cyberjack kartenleser setup mit rechtklick als admin ausführen bc_7_8_10.exe (PID: 2752)

    • Adds/modifies Windows certificates

      • 15342_35965949_be6c151cc94797e2dafbc9000565678da00257421b3d8b355c06050881823f47_cyberjack kartenleser setup mit rechtklick als admin ausführen bc_7_8_10.exe (PID: 2752)

    • Creates or modifies Windows services

      • 15342_35965949_be6c151cc94797e2dafbc9000565678da00257421b3d8b355c06050881823f47_cyberjack kartenleser setup mit rechtklick als admin ausführen bc_7_8_10.exe (PID: 2752)

    • Drops a system driver (possible attempt to evade defenses)

      • 15342_35965949_be6c151cc94797e2dafbc9000565678da00257421b3d8b355c06050881823f47_cyberjack kartenleser setup mit rechtklick als admin ausführen bc_7_8_10.exe (PID: 2752)
      • DPInst.exe (PID: 3912)
      • drvinst.exe (PID: 3776)

    • Creates files in the driver directory

      • drvinst.exe (PID: 3776)

    • Checks Windows Trust Settings

      • drvinst.exe (PID: 3776)

    • Creates a software uninstall entry

      • 15342_35965949_be6c151cc94797e2dafbc9000565678da00257421b3d8b355c06050881823f47_cyberjack kartenleser setup mit rechtklick als admin ausführen bc_7_8_10.exe (PID: 2752)

  • INFO

    • Reads the computer name

      • wmpnscfg.exe (PID: 2648)
      • 15342_35965949_be6c151cc94797e2dafbc9000565678da00257421b3d8b355c06050881823f47_cyberjack kartenleser setup mit rechtklick als admin ausführen bc_7_8_10.exe (PID: 2752)
      • cjpcsc.exe (PID: 3488)
      • DPInst.exe (PID: 3912)
      • drvinst.exe (PID: 3776)
      • cJCC.exe (PID: 1756)
      • cjpcsc.exe (PID: 1704)

    • Checks supported languages

      • wmpnscfg.exe (PID: 2648)
      • 15342_35965949_be6c151cc94797e2dafbc9000565678da00257421b3d8b355c06050881823f47_cyberjack kartenleser setup mit rechtklick als admin ausführen bc_7_8_10.exe (PID: 2752)
      • SetupHBCI.exe (PID: 3724)
      • DPInst.exe (PID: 3912)
      • drvinst.exe (PID: 3776)
      • cjpcsc.exe (PID: 3488)
      • cJCC.exe (PID: 1756)
      • cjpcsc.exe (PID: 1704)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2648)
      • 15342_35965949_be6c151cc94797e2dafbc9000565678da00257421b3d8b355c06050881823f47_cyberjack kartenleser setup mit rechtklick als admin ausführen bc_7_8_10.exe (PID: 3000)
      • 15342_35965949_be6c151cc94797e2dafbc9000565678da00257421b3d8b355c06050881823f47_cyberjack kartenleser setup mit rechtklick als admin ausführen bc_7_8_10.exe (PID: 2752)

    • Application launched itself

      • msedge.exe (PID: 3976)

    • Reads the machine GUID from the registry

      • 15342_35965949_be6c151cc94797e2dafbc9000565678da00257421b3d8b355c06050881823f47_cyberjack kartenleser setup mit rechtklick als admin ausführen bc_7_8_10.exe (PID: 2752)
      • DPInst.exe (PID: 3912)
      • drvinst.exe (PID: 3776)
      • cjpcsc.exe (PID: 1704)

    • Create files in a temporary directory

      • 15342_35965949_be6c151cc94797e2dafbc9000565678da00257421b3d8b355c06050881823f47_cyberjack kartenleser setup mit rechtklick als admin ausführen bc_7_8_10.exe (PID: 2752)
      • DPInst.exe (PID: 3912)

    • Creates files in the program directory

      • 15342_35965949_be6c151cc94797e2dafbc9000565678da00257421b3d8b355c06050881823f47_cyberjack kartenleser setup mit rechtklick als admin ausführen bc_7_8_10.exe (PID: 2752)

    • Reads the software policy settings

      • drvinst.exe (PID: 3776)

    • Adds/modifies Windows certificates

      • drvinst.exe (PID: 3776)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.ax | DirectShow filter (37.6)
.exe | Win32 EXE PECompact compressed (v2.x) (11)
.exe | InstallShield setup (8)
.exe | Win32 EXE PECompact compressed (generic) (7.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:10:02 04:08:55+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 421888
InitializedDataSize: 389632
UninitializedDataSize: -
EntryPoint: 0x40181
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 7.8.10.0
ProductVersionNumber: 7.8.10.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: REINER SCT
FileDescription: InstallScript Setup Launcher Unicode
FileVersion: 7.8.10
InternalName: Setup
LegalCopyright: Copyright (c) 2013 Flexera Software LLC. All Rights Reserved.
OriginalFileName: InstallShield Setup.exe
ProductName: cyberJack Base Components
ProductVersion: 7.8.10
InternalBuildNumber: 133442
ISInternalVersion: 20.0.496
ISInternalDescription: InstallScript Setup Launcher Unicode
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
76
Monitored processes
34
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rundll32.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs wmpnscfg.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs 15342_35965949_be6c151cc94797e2dafbc9000565678da00257421b3d8b355c06050881823f47_cyberjack kartenleser setup mit rechtklick als admin ausführen bc_7_8_10.exe no specs 15342_35965949_be6c151cc94797e2dafbc9000565678da00257421b3d8b355c06050881823f47_cyberjack kartenleser setup mit rechtklick als admin ausführen bc_7_8_10.exe vssvc.exe no specs cjpcsc.exe no specs setuphbci.exe no specs dpinst.exe drvinst.exe cjcc.exe no specs cjpcsc.exe no specs subinacl.exe no specs subinacl.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
124"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1312 --field-trial-handle=1332,i,15279215443564931177,7947119790802769850,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
524"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --first-renderer-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2200 --field-trial-handle=1332,i,15279215443564931177,7947119790802769850,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
904"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4076 --field-trial-handle=1332,i,15279215443564931177,7947119790802769850,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
924"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4212 --field-trial-handle=1332,i,15279215443564931177,7947119790802769850,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
936"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4220 --field-trial-handle=1332,i,15279215443564931177,7947119790802769850,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1056"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2224 --field-trial-handle=1332,i,15279215443564931177,7947119790802769850,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1280"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4220 --field-trial-handle=1332,i,15279215443564931177,7947119790802769850,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1552"C:\Program Files\REINER SCT\cyberJack\subinacl.exe" /subdirectories "C:\ProgramData\REINER SCT\*" /grant="S-1-1-0"=FC:\Program Files\REINER SCT\cyberJack\subinacl.exe—15342_35965949_be6c151cc94797e2dafbc9000565678da00257421b3d8b355c06050881823f47_cyberjack kartenleser setup mit rechtklick als admin ausführen bc_7_8_10.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
SubInAcl
Version:
5.2.3790.1180
Modules
Images
c:\program files\reiner sct\cyberjack\subinacl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
1704C:\Windows\system32\cjpcsc.exeC:\Windows\System32\cjpcsc.exe—services.exe
User:
SYSTEM
Company:
REINER SCT
Integrity Level:
SYSTEM
Description:
cyberJack PC/SC COM Service
Version:
7.8.6.0
Modules
Images
c:\windows\system32\cjpcsc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winspool.drv
1756"C:\Program Files\REINER SCT\cyberJack\cJCC.exe" /TRFREG /SC:\Program Files\REINER SCT\cyberJack\cJCC.exe—15342_35965949_be6c151cc94797e2dafbc9000565678da00257421b3d8b355c06050881823f47_cyberjack kartenleser setup mit rechtklick als admin ausführen bc_7_8_10.exe
User:
admin
Company:
REINER SCT
Integrity Level:
HIGH
Description:
cyberJack Gerätemanager
Exit code:
0
Version:
7.8.6.1
Modules
Images
c:\program files\reiner sct\cyberjack\cjcc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msimg32.dll
Total events
15 170
Read events
14 850
Write events
297
Delete events
23

Modification events

(PID) Process:(3976) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3976) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3976) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(3976) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(3976) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3976) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:dr
Value:
1
(PID) Process:(3976) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(3976) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1302019708-1500728564-335382590-1000
Value:
71D8E6FDFD762F00
(PID) Process:(3976) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\FirstNotDefault
Operation:delete valueName:S-1-5-21-1302019708-1500728564-335382590-1000
Value:
(PID) Process:(3976) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge
Operation:writeName:UsageStatsInSample
Value:
1
Executable files
56
Suspicious files
235
Text files
116
Unknown types
2

Dropped files

PID
Process
Filename
Type
3976msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\0037fab4-f90f-4aaf-b7a4-09f7a8b22a9b.tmp —
MD5:—
SHA256:—
3976msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF10c65f.TMP —
MD5:—
SHA256:—
3976msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
3976msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF10c68e.TMP —
MD5:—
SHA256:—
3976msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
3976msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF10c778.TMP —
MD5:—
SHA256:—
3976msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old —
MD5:—
SHA256:—
3976msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old~RF10c853.TMPtext
MD5:C2F5F0CF3799AE7C49D5998928742D2B
SHA256:9A3A3979C14C0FE3187A2054464DB6F42D9C27ACBC6E1863EE24BAEB1A084985
4000msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics.pma~RF10bdd3.TMPbinary
MD5:886E82F2CA62ECCCE64601B30592078A
SHA256:E5E13D53601100FF3D6BB71514CBCCC4C73FE9B7EF5E930100E644187B42948E
3976msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datbinary
MD5:A6EBC0D32A7B9304824D19DB63B4E37A
SHA256:E991057C2B1718A151C5FD06E1C153F57130D195454A1F94C8C4C20971697093
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
97
DNS requests
117
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
302
74.125.34.46:80
http://www.virustotal.com/
unknown
—
—
unknown
2032
msedge.exe
GET
302
2.18.97.227:80
http://go.microsoft.com/fwlink/?LinkId=57426&Ext=ax
unknown
—
—
unknown
2032
msedge.exe
GET
301
88.221.110.226:80
http://shell.windows.com/fileassoc/fileassoc.asp?Ext=ax
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
3976
msedge.exe
239.255.255.250:1900
—
—
—
unknown
2032
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2032
msedge.exe
2.18.97.227:80
go.microsoft.com
Akamai International B.V.
FR
unknown
2032
msedge.exe
204.79.197.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
2032
msedge.exe
88.221.110.226:80
shell.windows.com
Akamai International B.V.
DE
unknown
2032
msedge.exe
92.123.104.28:443
www.bing.com
Akamai International B.V.
DE
unknown
2032
msedge.exe
92.123.104.23:443
www.bing.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
config.edge.skype.com
  • 13.107.42.16
whitelisted
go.microsoft.com
  • 2.18.97.227
whitelisted
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
shell.windows.com
  • 88.221.110.226
  • 88.221.110.186
whitelisted
www.bing.com
  • 92.123.104.28
  • 92.123.104.31
  • 92.123.104.19
  • 92.123.104.20
  • 92.123.104.22
  • 92.123.104.23
  • 92.123.104.24
  • 92.123.104.29
  • 92.123.104.30
  • 92.123.104.50
  • 92.123.104.56
  • 92.123.104.51
  • 92.123.104.43
  • 92.123.104.47
  • 92.123.104.45
  • 92.123.104.53
  • 92.123.104.46
  • 92.123.104.52
  • 104.126.37.170
  • 104.126.37.177
  • 104.126.37.171
  • 104.126.37.155
  • 104.126.37.160
  • 104.126.37.163
  • 104.126.37.178
  • 104.126.37.162
  • 104.126.37.161
  • 104.126.37.153
  • 104.126.37.139
  • 104.126.37.146
  • 104.126.37.152
  • 104.126.37.154
whitelisted
r.bing.com
  • 92.123.104.30
  • 92.123.104.20
  • 92.123.104.28
  • 92.123.104.19
  • 92.123.104.29
  • 92.123.104.22
  • 92.123.104.23
  • 92.123.104.24
  • 92.123.104.31
whitelisted
th.bing.com
  • 92.123.104.23
  • 92.123.104.22
  • 92.123.104.29
  • 92.123.104.20
  • 92.123.104.31
  • 92.123.104.19
  • 92.123.104.28
  • 92.123.104.24
  • 92.123.104.30
  • 104.126.37.163
  • 104.126.37.162
  • 104.126.37.160
  • 104.126.37.177
  • 104.126.37.170
  • 104.126.37.161
  • 104.126.37.155
  • 104.126.37.171
  • 104.126.37.178
whitelisted
login.microsoftonline.com
  • 40.126.32.74
  • 40.126.32.136
  • 20.190.160.17
  • 40.126.32.133
  • 40.126.32.138
  • 20.190.160.22
  • 40.126.32.76
  • 40.126.32.72
whitelisted
aefd.nelreports.net
  • 2.16.164.99
  • 2.16.164.83
whitelisted
services.bingapis.com
  • 13.107.5.80
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
15342_35965949_be6c151cc94797e2dafbc9000565678da00257421b3d8b355c06050881823f47_cyberjack kartenleser setup mit rechtklick als admin ausführen bc_7_8_10.exe