URL:

https://www.glarysoft.com/products/utilities/glary-utilities/download/

Full analysis: https://app.any.run/tasks/8727a811-9136-4a6f-9379-ffbd0342fc97
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: February 15, 2025, 17:11:15
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
Indicators:
MD5:

C81F8AEFAAB9FB76CA42927DC1F1D338

SHA1:

35BF26675B803BD34AFDDE0E9EF60AEF24933B06

SHA256:

DA4FE08EC379C326D6D92E16D6460FA54DFDD7D15F58AAD52060511EE85B92A1

SSDEEP:

3:N8DSL/KX9aQGRWLfRMz0Xz/zkCn:2OL/QQRWL5MYXLt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • gu6setup.exe (PID: 7840)

    • Starts NET.EXE for service management

      • gu6setup.exe (PID: 7840)
      • net.exe (PID: 7256)
      • net.exe (PID: 7176)
      • net.exe (PID: 7532)

    • Actions looks like stealing of personal data

      • Initialize.exe (PID: 4876)
      • Integrator.exe (PID: 5000)
      • Initialize.exe (PID: 1076)
      • Integrator.exe (PID: 6428)
      • TracksEraser.exe (PID: 3172)
      • Integrator.exe (PID: 6328)
      • DiskCleaner.exe (PID: 1864)

    • Steals credentials from Web Browsers

      • Initialize.exe (PID: 4876)
      • Integrator.exe (PID: 5000)
      • Initialize.exe (PID: 1076)
      • Integrator.exe (PID: 6428)
      • Integrator.exe (PID: 6328)
      • DiskCleaner.exe (PID: 1864)
      • TracksEraser.exe (PID: 3172)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • gu6setup.exe (PID: 7840)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • gu6setup.exe (PID: 7840)

    • Executable content was dropped or overwritten

      • gu6setup.exe (PID: 7840)
      • statisticsinfo.exe (PID: 7712)
      • StartupManager.exe (PID: 7548)

    • Process drops legitimate windows executable

      • gu6setup.exe (PID: 7840)

    • There is functionality for taking screenshot (YARA)

      • gu6setup.exe (PID: 7840)
      • MemfilesService.exe (PID: 4468)
      • Integrator.exe (PID: 5000)

    • The process drops C-runtime libraries

      • gu6setup.exe (PID: 7840)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 3420)
      • regsvr32.exe (PID: 6180)
      • regsvr32.exe (PID: 6176)

    • Creates a software uninstall entry

      • gu6setup.exe (PID: 7840)
      • statisticsinfo.exe (PID: 7712)

    • Searches for installed software

      • statisticsinfo.exe (PID: 7712)
      • gu6setup.exe (PID: 7840)
      • Integrator.exe (PID: 5000)
      • SoftwareUpdate.exe (PID: 7516)

    • Reads security settings of Internet Explorer

      • statisticsinfo.exe (PID: 7712)
      • StartupManager.exe (PID: 7548)
      • Initialize.exe (PID: 4876)
      • gu6setup.exe (PID: 7840)
      • AutoUpdate.exe (PID: 2624)
      • Integrator.exe (PID: 5000)
      • upgrade.exe (PID: 6424)
      • Initialize.exe (PID: 1076)
      • SoftwareUpdate.exe (PID: 7516)
      • TracksEraser.exe (PID: 3172)

    • Creates or modifies Windows services

      • DiskDefrag.exe (PID: 7744)

    • Creates files in the driver directory

      • StartupManager.exe (PID: 7548)

    • Drops a system driver (possible attempt to evade defenses)

      • StartupManager.exe (PID: 7548)

    • Executes as Windows Service

      • MemfilesService.exe (PID: 4468)
      • GUBootService.exe (PID: 8024)

    • Creates file in the systems drive root

      • MemfilesService.exe (PID: 4468)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 7688)

    • Reads Microsoft Outlook installation path

      • upgrade.exe (PID: 6424)
      • Integrator.exe (PID: 5000)

    • Reads Internet Explorer settings

      • upgrade.exe (PID: 6424)

    • Checks Windows Trust Settings

      • Integrator.exe (PID: 5000)
      • SoftwareUpdate.exe (PID: 7516)

  • INFO

    • Application launched itself

      • msedge.exe (PID: 1668)
      • msedge.exe (PID: 7936)
      • msedge.exe (PID: 7676)

    • Reads the computer name

      • identity_helper.exe (PID: 5640)
      • gu6setup.exe (PID: 7840)
      • identity_helper.exe (PID: 7624)
      • statisticsinfo.exe (PID: 7712)
      • DiskDefrag.exe (PID: 7744)
      • StartupManager.exe (PID: 7548)
      • GUAssistComSvc.exe (PID: 7364)
      • GUBootService.exe (PID: 7828)
      • procmgr.exe (PID: 7244)
      • GUPMService.exe (PID: 7808)
      • MemfilesService.exe (PID: 5920)
      • Initialize.exe (PID: 4876)
      • MemfilesService.exe (PID: 4468)
      • GUBootService.exe (PID: 6892)
      • GUAssistComSvc.exe (PID: 7908)
      • Integrator.exe (PID: 5000)
      • Initialize.exe (PID: 1076)
      • AutoUpdate.exe (PID: 2624)
      • upgrade.exe (PID: 6424)
      • GUAssistComSvc.exe (PID: 1944)
      • identity_helper.exe (PID: 6488)
      • Integrator.exe (PID: 6428)
      • SoftwareUpdate.exe (PID: 7516)
      • GUAssistComSvc.exe (PID: 7624)
      • GUBootService.exe (PID: 8024)
      • TracksEraser.exe (PID: 3172)
      • GUAssistComSvc.exe (PID: 5912)
      • Integrator.exe (PID: 6328)
      • DiskCleaner.exe (PID: 1864)

    • Reads Environment values

      • identity_helper.exe (PID: 5640)
      • identity_helper.exe (PID: 7624)
      • identity_helper.exe (PID: 6488)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 1668)
      • msedge.exe (PID: 6320)

    • Checks supported languages

      • identity_helper.exe (PID: 5640)
      • gu6setup.exe (PID: 7840)
      • identity_helper.exe (PID: 7624)
      • statisticsinfo.exe (PID: 7712)
      • DiskDefrag.exe (PID: 7744)
      • GUAssistComSvc.exe (PID: 7364)
      • MemfilesService.exe (PID: 4468)
      • StartupManager.exe (PID: 7548)
      • GUBootService.exe (PID: 7828)
      • GUPMService.exe (PID: 7808)
      • MemfilesService.exe (PID: 5920)
      • procmgr.exe (PID: 7244)
      • Initialize.exe (PID: 4876)
      • GUAssistComSvc.exe (PID: 7908)
      • GUBootService.exe (PID: 6892)
      • Integrator.exe (PID: 5000)
      • AutoUpdate.exe (PID: 2624)
      • upgrade.exe (PID: 6424)
      • Initialize.exe (PID: 1076)
      • GUAssistComSvc.exe (PID: 1944)
      • identity_helper.exe (PID: 6488)
      • Integrator.exe (PID: 6428)
      • SoftwareUpdate.exe (PID: 7516)
      • GUAssistComSvc.exe (PID: 5912)
      • GUBootService.exe (PID: 8024)
      • TracksEraser.exe (PID: 3172)
      • GUAssistComSvc.exe (PID: 7624)
      • Integrator.exe (PID: 6328)
      • DiskCleaner.exe (PID: 1864)

    • Create files in a temporary directory

      • gu6setup.exe (PID: 7840)
      • statisticsinfo.exe (PID: 7712)
      • Integrator.exe (PID: 5000)
      • AutoUpdate.exe (PID: 2624)
      • upgrade.exe (PID: 6424)

    • Creates files in the program directory

      • gu6setup.exe (PID: 7840)
      • StartupManager.exe (PID: 7548)
      • Integrator.exe (PID: 5000)
      • Initialize.exe (PID: 4876)
      • Initialize.exe (PID: 1076)
      • Integrator.exe (PID: 6428)
      • MemfilesService.exe (PID: 4468)
      • GUBootService.exe (PID: 8024)
      • TracksEraser.exe (PID: 3172)
      • DiskCleaner.exe (PID: 1864)

    • The sample compiled with chinese language support

      • gu6setup.exe (PID: 7840)

    • The sample compiled with english language support

      • gu6setup.exe (PID: 7840)
      • statisticsinfo.exe (PID: 7712)

    • The sample compiled with japanese language support

      • gu6setup.exe (PID: 7840)

    • The sample compiled with arabic language support

      • gu6setup.exe (PID: 7840)

    • Checks proxy server information

      • statisticsinfo.exe (PID: 7712)
      • Integrator.exe (PID: 5000)
      • AutoUpdate.exe (PID: 2624)
      • upgrade.exe (PID: 6424)
      • SoftwareUpdate.exe (PID: 7516)

    • Process checks computer location settings

      • StartupManager.exe (PID: 7548)
      • Initialize.exe (PID: 4876)
      • Integrator.exe (PID: 5000)
      • Initialize.exe (PID: 1076)

    • Creates files or folders in the user directory

      • gu6setup.exe (PID: 7840)
      • Integrator.exe (PID: 5000)
      • Initialize.exe (PID: 4876)
      • AutoUpdate.exe (PID: 2624)
      • Initialize.exe (PID: 1076)
      • upgrade.exe (PID: 6424)
      • Integrator.exe (PID: 6428)
      • SoftwareUpdate.exe (PID: 7516)
      • TracksEraser.exe (PID: 3172)
      • Integrator.exe (PID: 6328)
      • DiskCleaner.exe (PID: 1864)

    • Process checks whether UAC notifications are on

      • Integrator.exe (PID: 5000)

    • Reads the software policy settings

      • Integrator.exe (PID: 5000)
      • SoftwareUpdate.exe (PID: 7516)

    • Reads the machine GUID from the registry

      • Integrator.exe (PID: 5000)
      • upgrade.exe (PID: 6424)
      • SoftwareUpdate.exe (PID: 7516)

    • Manual execution by a user

      • Integrator.exe (PID: 6328)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
258
Monitored processes
123
Malicious processes
12
Suspicious processes
3

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs gu6setup.exe no specs gu6setup.exe msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs guassistcomsvc.exe no specs statisticsinfo.exe diskdefrag.exe no specs startupmanager.exe gubootservice.exe no specs gupmservice.exe no specs procmgr.exe no specs memfilesservice.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs memfilesservice.exe no specs initialize.exe gubootservice.exe no specs guassistcomsvc.exe no specs schtasks.exe no specs conhost.exe no specs msedge.exe no specs integrator.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs initialize.exe autoupdate.exe upgrade.exe guassistcomsvc.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs integrator.exe softwareupdate.exe guassistcomsvc.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs gubootservice.exe no specs guassistcomsvc.exe no specs trackseraser.exe integrator.exe diskcleaner.exe

Process information

PID
CMD
Path
Indicators
Parent process
540\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
624"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2700 --field-trial-handle=2452,i,6368394878204155360,14038390508941951362,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
628"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4868 --field-trial-handle=2420,i,2511274482021384304,220415445079667129,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
3221226029
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\identity_helper.exe
c:\windows\system32\ntdll.dll
1076"C:\Program Files (x86)\Glary Utilities\Initialize.exe" C:\Program Files (x86)\Glary Utilities\Initialize.exe
Integrator.exe
User:
admin
Company:
Glarysoft Ltd
Integrity Level:
HIGH
Description:
Glary Utilities Initialize
Exit code:
0
Version:
6, 0, 0, 43
Modules
Images
c:\program files (x86)\glary utilities\initialize.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1668"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.glarysoft.com/products/utilities/glary-utilities/download/"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1864"C:\Program Files (x86)\Glary Utilities\DiskCleaner.exe" C:\Program Files (x86)\Glary Utilities\DiskCleaner.exe
Integrator.exe
User:
admin
Company:
Glarysoft Ltd
Integrity Level:
HIGH
Description:
Glary Utilities DiskCleaner
Version:
6.0.0.21
1944"C:\Program Files (x86)\Glary Utilities\x64\GUAssistComSvc.exe" -EmbeddingC:\Program Files (x86)\Glary Utilities\x64\GUAssistComSvc.exe—svchost.exe
User:
admin
Company:
Glarysoft Ltd
Integrity Level:
HIGH
Exit code:
0
Version:
6.0.0.4
Modules
Images
c:\program files (x86)\glary utilities\x64\guassistcomsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2076"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5160 --field-trial-handle=2452,i,6368394878204155360,14038390508941951362,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2136"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6164 --field-trial-handle=2512,i,16747503171800738551,13239418369655596443,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
3221226029
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\identity_helper.exe
c:\windows\system32\ntdll.dll
2600C:\WINDOWS\system32\net1 start GUMemfilesServiceC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
Total events
50 102
Read events
49 037
Write events
688
Delete events
377

Modification events

(PID) Process:(1668) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(1668) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(1668) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(1668) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(1668) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
4798B4A9C78C2F00
(PID) Process:(1668) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
77B0C2A9C78C2F00
(PID) Process:(1668) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\328532
Operation:writeName:WindowTabManagerFileMappingId
Value:
{11449437-1D04-491B-A285-A43758072324}
(PID) Process:(1668) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\328532
Operation:writeName:WindowTabManagerFileMappingId
Value:
{30804A0E-1644-433F-84D8-2EBE86662FAA}
(PID) Process:(1668) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\328532
Operation:writeName:WindowTabManagerFileMappingId
Value:
{93E512A5-0ACB-48C0-B3DE-336994E16112}
(PID) Process:(1668) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\328532
Operation:writeName:WindowTabManagerFileMappingId
Value:
{DB500207-E1CE-44F9-9881-D6417D5ABD92}
Executable files
190
Suspicious files
430
Text files
864
Unknown types
2

Dropped files

PID
Process
Filename
Type
1668msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF134d48.TMP —
MD5:—
SHA256:—
1668msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF134d48.TMP —
MD5:—
SHA256:—
1668msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
1668msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
1668msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF134d48.TMP —
MD5:—
SHA256:—
1668msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF134d48.TMP —
MD5:—
SHA256:—
1668msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
1668msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
1668msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF134d48.TMP —
MD5:—
SHA256:—
1668msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
35
TCP/UDP connections
170
DNS requests
176
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5064
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7028
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6908
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6908
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5000
Integrator.exe
POST
200
188.114.97.3:80
http://myaccount.glarysoft.com/openapi.php/lr/expire_time
unknown
—
—
unknown
5000
Integrator.exe
POST
200
23.23.198.31:80
http://gu.glarysoft.com/boottime/service.php
unknown
—
—
unknown
6424
upgrade.exe
GET
200
188.114.96.3:80
http://www_orig.glarysoft.com/update/glary-utilities/pro/upgradetopro.ini?src=10000&id=1&v=6.0.0.1
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6320
msedge.exe
188.114.97.3:443
www.glarysoft.com
—
—
whitelisted
1668
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
6320
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6320
msedge.exe
13.107.246.45:443
edge-mobile-static.azureedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6320
msedge.exe
13.107.6.158:443
business.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6320
msedge.exe
13.107.21.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6320
msedge.exe
2.22.242.11:443
bzib.nelreports.net
Akamai International B.V.
DE
whitelisted
—
—
142.250.185.163:443
fonts.gstatic.com
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
  • 51.104.136.2
whitelisted
google.com
  • 142.250.185.78
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
www.glarysoft.com
  • 188.114.97.3
  • 188.114.96.3
whitelisted
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.45
whitelisted
bzib.nelreports.net
  • 2.22.242.11
  • 2.22.242.105
  • 23.50.131.78
  • 23.50.131.74
whitelisted
www.bing.com
  • 2.19.122.38
  • 2.19.122.30
  • 2.19.122.25
  • 2.19.122.39
  • 2.19.122.36
  • 2.19.122.32
  • 2.19.122.20
  • 2.19.122.33
  • 2.19.122.26
whitelisted
fonts.googleapis.com
  • 142.250.181.234
whitelisted

Threats

PID
Process
Class
Message
7712
statisticsinfo.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
5000
Integrator.exe
Potentially Bad Traffic
ET USER_AGENTS Suspicious User-Agent (Microsoft-ATL-Native/9.00)
5000
Integrator.exe
Potentially Bad Traffic
ET USER_AGENTS Suspicious User-Agent (Microsoft-ATL-Native/9.00)
5000
Integrator.exe
Potentially Bad Traffic
ET USER_AGENTS Suspicious User-Agent (Microsoft-ATL-Native/9.00)
5000
Integrator.exe
Potentially Bad Traffic
ET USER_AGENTS Suspicious User-Agent (Microsoft-ATL-Native/9.00)
5000
Integrator.exe
Potentially Bad Traffic
ET USER_AGENTS Suspicious User-Agent (Microsoft-ATL-Native/9.00)
5000
Integrator.exe
Potentially Bad Traffic
ET USER_AGENTS Suspicious User-Agent (Microsoft-ATL-Native/9.00)
5000
Integrator.exe
Potentially Bad Traffic
ET USER_AGENTS Suspicious User-Agent (Microsoft-ATL-Native/9.00)
5000
Integrator.exe
Potentially Bad Traffic
ET USER_AGENTS Suspicious User-Agent (Microsoft-ATL-Native/9.00)
5000
Integrator.exe
Potentially Bad Traffic
ET USER_AGENTS Suspicious User-Agent (Microsoft-ATL-Native/9.00)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.glarysoft.com/products/utilities/glary-utilities/download/