File name:

DumpBrowserSecrets.exe

Full analysis: https://app.any.run/tasks/c8bd2700-ee3f-45f5-ab06-42c2cfeeee79
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 13, 2026, 06:32:41
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 7 sections
MD5:

0E51138EF195AC755F052BABB761A1E7

SHA1:

3C7BBEABC56110D3463E6002CD0FF5C9A168D64B

SHA256:

C934A2DB58A1A64EE245A7627843508C6C517FCB06EA6855D26A72B41AE6753B

SSDEEP:

12288:9C7coIYwNk0xVerb0rNQjKwUJ7koaxr5R3+5+tvfmRLLfh+:9GccwNk0x8rl274R3+5+0h+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • DumpBrowserSecrets.exe (PID: 8820)

  • SUSPICIOUS

    • Browser headless start

      • msedge.exe (PID: 6156)
      • msedge.exe (PID: 8196)
      • msedge.exe (PID: 7748)

    • Executable content was dropped or overwritten

      • DumpBrowserSecrets.exe (PID: 8820)

    • Browser launch with unusual user-data-dir

      • msedge.exe (PID: 8196)

  • INFO

    • Reads Microsoft Office registry keys

      • DumpBrowserSecrets.exe (PID: 8820)

    • Checks supported languages

      • DumpBrowserSecrets.exe (PID: 8820)
      • identity_helper.exe (PID: 8608)

    • Create files in a temporary directory

      • DumpBrowserSecrets.exe (PID: 8820)

    • Application launched itself

      • msedge.exe (PID: 6156)
      • msedge.exe (PID: 8196)

    • Reads Environment values

      • identity_helper.exe (PID: 8608)

    • Reads the computer name

      • identity_helper.exe (PID: 8608)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2026:02:14 14:15:26+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.44
CodeSize: 247808
InitializedDataSize: 156160
UninitializedDataSize: -
EntryPoint: 0x20f40
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
195
Monitored processes
48
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start dumpbrowsersecrets.exe conhost.exe no specs msedge.exe msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs slui.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
468"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=7464,i,540421427214105805,5789077952473359185,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=8040 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
664"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=6004,i,540421427214105805,5789077952473359185,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1068"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=6496,i,540421427214105805,5789077952473359185,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1136"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --disable-background-timer-throttling --remote-debugging-port=9222 --disable-databases --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --field-trial-handle=5632,i,540421427214105805,5789077952473359185,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1200"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=7468,i,540421427214105805,5789077952473359185,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1572"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --disable-background-timer-throttling --remote-debugging-port=9222 --disable-databases --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=4768,i,540421427214105805,5789077952473359185,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
1600"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=7424,i,540421427214105805,5789077952473359185,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.92\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
3221226029
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\identity_helper.exe
c:\windows\system32\ntdll.dll
1760"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=8044,i,540421427214105805,5789077952473359185,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=8052 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1876"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=7688,i,540421427214105805,5789077952473359185,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=7684 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2360"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --disable-background-timer-throttling --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --field-trial-handle=6352,i,540421427214105805,5789077952473359185,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
704
Read events
704
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
140
Text files
268
Unknown types
0

Dropped files

PID
Process
Filename
Type
8820DumpBrowserSecrets.exeC:\Users\admin\AppData\Local\Temp\tmp4E2E.tmpbinary
MD5:9354520741EBDFB3142C07C6CBC20A35
SHA256:1440E81F80958229541B1DA9D33A03E9AA5848545033C98EFF59E332AA2B59E9
8196msedge.exeC:\Users\admin\AppData\Local\Temp\HeadlessEdge81961986328\FirstLaunchAfterInstallation —
MD5:—
SHA256:—
8820DumpBrowserSecrets.exeC:\Users\admin\AppData\Local\Temp\tmp4E2D.tmpbinary
MD5:D9ABF2641D30BDF0939D239F642A5D30
SHA256:C48FED35F4D357663E5266A4477C2F8D6D007D07893BDDC8A07854E8F112721B
8820DumpBrowserSecrets.exeC:\Users\admin\AppData\Local\Temp\tmp4E40.tmpbinary
MD5:EBBC802F3BC61B4350134E595337F997
SHA256:845DE58DF0FF490E3F313972A4A033E37EEE98FD4E4372A83DCFAB3946ACE16C
8820DumpBrowserSecrets.exeC:\Users\admin\AppData\Local\Temp\tmp4E2F.tmpbinary
MD5:9A3C0EA5FC8794835816DFF607FE34B9
SHA256:A0687E511FD1D257757C52C938FFF59327BF0890FB54F892B02B9FD028E57EE1
8820DumpBrowserSecrets.exeC:\Users\admin\AppData\Local\Temp\tmp4E41.tmptext
MD5:0312680203F9EA053E6928282EEDADB3
SHA256:70C886EAD56F3C33DF565BB2B99452A98751F51ABA31DCC2C5C239F1957887B0
8196msedge.exeC:\Users\admin\AppData\Local\Temp\HeadlessEdge81961986328\Last Versiontext
MD5:BAC9FEB21F102B8ED4CD3E469213E59B
SHA256:84ACD485899333CBDF5AD1F68D8C31658D5ECC9EE8DDDF62098A2218687D7E77
8196msedge.exeC:\Users\admin\AppData\Local\Temp\HeadlessEdge81961986328\Default\Sync Data\LevelDB\MANIFEST-000001binary
MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
SHA256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
8196msedge.exeC:\Users\admin\AppData\Local\Temp\HeadlessEdge81961986328\Default\Code Cache\js\indexbinary
MD5:54CB446F628B2EA4A5BCE5769910512E
SHA256:FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
8196msedge.exeC:\Users\admin\AppData\Local\Temp\HeadlessEdge81961986328\Default\READMEtext
MD5:643E00B0186AA80523F8A6BED550A925
SHA256:A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
53
TCP/UDP connections
49
DNS requests
46
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
8852
msedge.exe
GET
302
23.52.181.141:443
https://go.microsoft.com/fwlink/?linkid=2133855&bucket=15
US
—
—
whitelisted
—
—
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQ3L3%2F%2Fa6ADK8NraY2GXzVaYrHG4AQUb6t%2B2v%2BXQ3LsO2d33oJhNYhHQoUCEzMAAAAGb6JMMcOVb6sAAAAAAAY%3D
US
binary
960 b
whitelisted
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAjTxtAB8my1oj8MfWpz%2F7Y%3D
US
binary
312 b
whitelisted
8852
msedge.exe
GET
200
150.171.28.11:443
https://edge.microsoft.com/extensionwebstorebase/v1/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=edgecrx&prodchannel=&prodversion=133.0.3065.92&lang=en-US&acceptformat=crx3,puff&x=id%3Djmjflgjpcpepeafmmgdpfkogkghcpiha%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1
US
xml
774 b
whitelisted
8852
msedge.exe
GET
200
150.171.28.11:80
http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:bK7y6mUqApkY7R17VSkbCkSbCU6ZWBHgK1xJzcwZDvc&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
US
text
102 b
whitelisted
8852
msedge.exe
GET
200
150.171.22.17:443
https://config.edge.skype.com/config/v1/Edge/133.0.3065.92?clientId=4253448494794070603&agents=EdgeFirstRun%2CEdgeFirstRunConfig&osname=win&client=edge&channel=stable&scpfre=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=0&mngd=0&installdate=1773383567&edu=0&soobedate=1504771245&bphint=2&fg=1&lbfgdate=0&lafgdate=0
US
text
935 b
unknown
8852
msedge.exe
GET
200
150.171.28.11:443
https://edge.microsoft.com/serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.19045&devicefamily=desktop&installdate=1773383567&clientversion=133.0.3065.92&experimentationmode=2&scpguard=0&scpfull=0&scpver=0
US
text
295 b
whitelisted
8852
msedge.exe
GET
200
142.251.141.46:443
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromiumcrx&prodchannel=&prodversion=133.0.3065.92&lang=en-US&acceptformat=crx3,puff&x=id%3Dghbmnnjooekpmoecnnnilnnbdlolhkhi%26v%3D0.0.0.0%26installedby%3Dexternal%26uc
US
xml
795 b
whitelisted
8852
msedge.exe
GET
200
104.18.22.222:443
https://copilot.microsoft.com/c/api/user/eligibility
US
text
25 b
whitelisted
8852
msedge.exe
GET
200
150.171.28.11:443
https://edge.microsoft.com/neededge/v1?bucket=15
US
xml
742 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
1352
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6768
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4936
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
2.16.241.222:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
—
—
204.79.197.203:80
oneocsp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
8852
msedge.exe
150.171.28.11:80
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
8852
msedge.exe
104.18.22.222:443
copilot.microsoft.com
CLOUDFLARENET
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
  • 4.231.128.59
whitelisted
www.bing.com
  • 2.16.241.222
  • 2.16.241.201
  • 2.16.241.206
  • 2.16.241.205
  • 2.16.241.207
  • 2.16.241.216
  • 2.16.241.225
  • 92.123.104.56
  • 92.123.104.45
  • 92.123.104.41
  • 92.123.104.47
  • 92.123.104.57
  • 92.123.104.42
  • 92.123.104.39
  • 92.123.104.51
  • 92.123.104.53
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
google.com
  • 172.217.19.174
whitelisted
self.events.data.microsoft.com
  • 13.69.116.109
whitelisted
oneocsp.microsoft.com
  • 204.79.197.203
whitelisted
edge.microsoft.com
  • 150.171.28.11
  • 150.171.27.11
whitelisted
config.edge.skype.com
  • 150.171.22.17
whitelisted
client.wns.windows.com
  • 20.59.87.225
whitelisted
clients2.google.com
  • 142.251.141.46
whitelisted

Threats

PID
Process
Class
Message
4936
svchost.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
Process
Message
msedge.exe
[02:32:47.012-msedge.exe-6156] [+] Detected Browser: Msedge
msedge.exe
[02:32:47.012-msedge.exe-6156] [v] Starting Msedge Keys Extraction...
msedge.exe
RecursiveDirectoryCreate( C:\Users\admin\AppData\Local\Temp\HeadlessEdge81961986328 directory exists )
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DumpBrowserSecrets.exe