URL:

https://filebin.net/nnhz2npxeioybgqa

Full analysis: https://app.any.run/tasks/20678dff-3fd3-4692-b174-30bbf8d0bfdd
Verdict: Malicious activity
Analysis date: May 14, 2025, 17:57:15
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MD5:

CDC1C4842765C291709C89FAE34A9B14

SHA1:

42838EE3F73B5B792D2A440FCDFCCC3F764E4679

SHA256:

DFC60FEDB8E3BF61986666DA6A841783E68395255E94302D4550C740728FA8CA

SSDEEP:

3:N8wLd3pK2Un:2Dn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • DXSETUP.exe (PID: 7632)
      • DXSETUP.exe (PID: 5512)
      • infinst.exe (PID: 5404)
      • infinst.exe (PID: 1748)
      • infinst.exe (PID: 3016)
      • infinst.exe (PID: 5428)
      • infinst.exe (PID: 2776)
      • infinst.exe (PID: 2108)
      • infinst.exe (PID: 5344)
      • infinst.exe (PID: 8068)
      • infinst.exe (PID: 7960)
      • infinst.exe (PID: 5868)
      • infinst.exe (PID: 2192)
      • infinst.exe (PID: 5544)
      • infinst.exe (PID: 4284)
      • infinst.exe (PID: 3192)
      • infinst.exe (PID: 5232)
      • infinst.exe (PID: 3016)
      • infinst.exe (PID: 7052)
      • infinst.exe (PID: 5428)
      • infinst.exe (PID: 6108)
      • infinst.exe (PID: 5796)
      • infinst.exe (PID: 6740)
      • infinst.exe (PID: 6768)
      • infinst.exe (PID: 5156)
      • infinst.exe (PID: 8060)
      • infinst.exe (PID: 7104)
      • infinst.exe (PID: 7628)
      • infinst.exe (PID: 5044)
      • infinst.exe (PID: 6404)
      • infinst.exe (PID: 5244)
      • infinst.exe (PID: 7324)
      • infinst.exe (PID: 4212)
      • infinst.exe (PID: 4152)
      • infinst.exe (PID: 5800)
      • infinst.exe (PID: 8048)
      • infinst.exe (PID: 8068)
      • infinst.exe (PID: 7944)
      • infinst.exe (PID: 672)
      • infinst.exe (PID: 5960)
      • infinst.exe (PID: 5408)
      • infinst.exe (PID: 5232)
      • infinst.exe (PID: 6660)
      • infinst.exe (PID: 6592)
      • infinst.exe (PID: 6828)
      • infinst.exe (PID: 5156)
      • infinst.exe (PID: 8080)
      • infinst.exe (PID: 3100)
      • infinst.exe (PID: 7000)
      • infinst.exe (PID: 4268)
      • infinst.exe (PID: 1388)
      • infinst.exe (PID: 6940)
      • infinst.exe (PID: 4452)
      • infinst.exe (PID: 6620)
      • infinst.exe (PID: 8048)
      • infinst.exe (PID: 6488)
      • infinst.exe (PID: 5036)
      • infinst.exe (PID: 1164)
      • infinst.exe (PID: 6132)
      • infinst.exe (PID: 5416)
      • infinst.exe (PID: 2104)
      • infinst.exe (PID: 5228)
      • infinst.exe (PID: 5064)
      • infinst.exe (PID: 6892)
      • infinst.exe (PID: 6036)
      • infinst.exe (PID: 6592)
      • infinst.exe (PID: 8096)
      • infinst.exe (PID: 6404)
      • infinst.exe (PID: 5428)
      • infinst.exe (PID: 5892)
      • infinst.exe (PID: 2596)
      • infinst.exe (PID: 5232)
      • infinst.exe (PID: 6724)
      • infinst.exe (PID: 5668)
      • infinst.exe (PID: 4628)
      • infinst.exe (PID: 2088)

    • Registers / Runs the DLL via REGSVR32.EXE

      • DXSETUP.exe (PID: 5512)

  • SUSPICIOUS

    • Application launched itself

      • WinRAR.exe (PID: 6300)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6300)
      • ShellExperienceHost.exe (PID: 5048)
      • directx_Jun2010_redist.exe (PID: 8100)

    • Creates file in the systems drive root

      • directx_Jun2010_redist.exe (PID: 8100)

    • Starts a Microsoft application from unusual location

      • directx_Jun2010_redist.exe (PID: 8100)
      • DXSETUP.exe (PID: 5512)
      • DXSETUP.exe (PID: 7632)

    • Executable content was dropped or overwritten

      • directx_Jun2010_redist.exe (PID: 8100)
      • DXSETUP.exe (PID: 5512)
      • infinst.exe (PID: 5404)
      • infinst.exe (PID: 1748)
      • infinst.exe (PID: 3016)
      • infinst.exe (PID: 2108)
      • infinst.exe (PID: 5428)
      • infinst.exe (PID: 2776)
      • infinst.exe (PID: 5344)
      • infinst.exe (PID: 8068)
      • infinst.exe (PID: 7960)
      • infinst.exe (PID: 4284)
      • infinst.exe (PID: 5544)
      • infinst.exe (PID: 2192)
      • infinst.exe (PID: 3192)
      • infinst.exe (PID: 5868)
      • infinst.exe (PID: 7052)
      • infinst.exe (PID: 5232)
      • infinst.exe (PID: 3016)
      • infinst.exe (PID: 6108)
      • infinst.exe (PID: 5428)
      • infinst.exe (PID: 5796)
      • infinst.exe (PID: 6740)
      • infinst.exe (PID: 5156)
      • infinst.exe (PID: 8060)
      • infinst.exe (PID: 5044)
      • infinst.exe (PID: 7104)
      • infinst.exe (PID: 6768)
      • infinst.exe (PID: 7628)
      • infinst.exe (PID: 5244)
      • infinst.exe (PID: 6404)
      • infinst.exe (PID: 4212)
      • infinst.exe (PID: 7324)
      • infinst.exe (PID: 8068)
      • infinst.exe (PID: 8048)
      • infinst.exe (PID: 4152)
      • infinst.exe (PID: 5800)
      • infinst.exe (PID: 7944)
      • infinst.exe (PID: 672)
      • infinst.exe (PID: 5960)
      • infinst.exe (PID: 6828)
      • infinst.exe (PID: 5232)
      • infinst.exe (PID: 6660)
      • infinst.exe (PID: 5408)
      • infinst.exe (PID: 6592)
      • infinst.exe (PID: 7000)
      • infinst.exe (PID: 5156)
      • infinst.exe (PID: 8080)
      • infinst.exe (PID: 3100)
      • infinst.exe (PID: 4268)
      • infinst.exe (PID: 4452)
      • infinst.exe (PID: 6940)
      • infinst.exe (PID: 6620)
      • infinst.exe (PID: 1388)
      • infinst.exe (PID: 8048)
      • infinst.exe (PID: 1164)
      • infinst.exe (PID: 6132)
      • infinst.exe (PID: 6488)
      • infinst.exe (PID: 5036)
      • infinst.exe (PID: 5416)
      • infinst.exe (PID: 5228)
      • infinst.exe (PID: 2104)
      • infinst.exe (PID: 5064)
      • infinst.exe (PID: 6892)
      • infinst.exe (PID: 6036)
      • infinst.exe (PID: 6404)
      • infinst.exe (PID: 6592)
      • infinst.exe (PID: 8096)
      • infinst.exe (PID: 5892)
      • infinst.exe (PID: 2596)
      • infinst.exe (PID: 5232)
      • infinst.exe (PID: 5428)
      • infinst.exe (PID: 6724)
      • infinst.exe (PID: 5668)
      • infinst.exe (PID: 4628)
      • infinst.exe (PID: 2088)

    • Process drops legitimate windows executable

      • directx_Jun2010_redist.exe (PID: 8100)
      • DXSETUP.exe (PID: 5512)
      • infinst.exe (PID: 5404)
      • infinst.exe (PID: 1748)
      • infinst.exe (PID: 3016)
      • infinst.exe (PID: 5428)
      • infinst.exe (PID: 2776)
      • infinst.exe (PID: 2108)
      • infinst.exe (PID: 7960)
      • infinst.exe (PID: 4284)
      • infinst.exe (PID: 5344)
      • infinst.exe (PID: 8068)
      • infinst.exe (PID: 2192)
      • infinst.exe (PID: 3192)
      • infinst.exe (PID: 5544)
      • infinst.exe (PID: 5868)
      • infinst.exe (PID: 5232)
      • infinst.exe (PID: 3016)
      • infinst.exe (PID: 7052)
      • infinst.exe (PID: 5428)
      • infinst.exe (PID: 6108)
      • infinst.exe (PID: 8060)
      • infinst.exe (PID: 6740)
      • infinst.exe (PID: 5796)
      • infinst.exe (PID: 5156)
      • infinst.exe (PID: 7628)
      • infinst.exe (PID: 5044)
      • infinst.exe (PID: 7104)
      • infinst.exe (PID: 6768)
      • infinst.exe (PID: 4212)
      • infinst.exe (PID: 7324)
      • infinst.exe (PID: 5244)
      • infinst.exe (PID: 6404)
      • infinst.exe (PID: 8068)
      • infinst.exe (PID: 4152)
      • infinst.exe (PID: 8048)
      • infinst.exe (PID: 7944)
      • infinst.exe (PID: 672)
      • infinst.exe (PID: 5800)
      • infinst.exe (PID: 5960)
      • infinst.exe (PID: 6592)
      • infinst.exe (PID: 6828)
      • infinst.exe (PID: 6660)
      • infinst.exe (PID: 5408)
      • infinst.exe (PID: 5232)
      • infinst.exe (PID: 7000)
      • infinst.exe (PID: 5156)
      • infinst.exe (PID: 8080)
      • infinst.exe (PID: 4268)
      • infinst.exe (PID: 3100)
      • infinst.exe (PID: 1388)
      • infinst.exe (PID: 6940)
      • infinst.exe (PID: 6620)
      • infinst.exe (PID: 4452)
      • infinst.exe (PID: 6132)
      • infinst.exe (PID: 8048)
      • infinst.exe (PID: 6488)
      • infinst.exe (PID: 1164)
      • infinst.exe (PID: 5036)
      • infinst.exe (PID: 5416)
      • infinst.exe (PID: 5228)
      • infinst.exe (PID: 2104)
      • infinst.exe (PID: 5064)
      • infinst.exe (PID: 6892)
      • infinst.exe (PID: 6036)
      • infinst.exe (PID: 6404)
      • infinst.exe (PID: 8096)
      • infinst.exe (PID: 5892)
      • infinst.exe (PID: 2596)
      • infinst.exe (PID: 5232)
      • infinst.exe (PID: 5428)
      • infinst.exe (PID: 6592)
      • infinst.exe (PID: 2088)
      • infinst.exe (PID: 6724)
      • infinst.exe (PID: 5668)
      • infinst.exe (PID: 4628)

    • Executes as Windows Service

      • VSSVC.exe (PID: 4304)

  • INFO

    • Checks supported languages

      • identity_helper.exe (PID: 3900)
      • ShellExperienceHost.exe (PID: 5048)
      • directx_Jun2010_redist.exe (PID: 8100)
      • DXSETUP.exe (PID: 5512)

    • Application launched itself

      • msedge.exe (PID: 7180)

    • Reads the computer name

      • identity_helper.exe (PID: 3900)
      • ShellExperienceHost.exe (PID: 5048)
      • directx_Jun2010_redist.exe (PID: 8100)
      • DXSETUP.exe (PID: 5512)

    • Reads Environment values

      • identity_helper.exe (PID: 3900)

    • Reads Microsoft Office registry keys

      • msedge.exe (PID: 7180)

    • Reads the software policy settings

      • slui.exe (PID: 6768)

    • Manual execution by a user

      • directx_Jun2010_redist.exe (PID: 8100)
      • DXSETUP.exe (PID: 7632)
      • DXSETUP.exe (PID: 5512)
      • WinRAR.exe (PID: 4268)
      • WinRAR.exe (PID: 4452)
      • WinRAR.exe (PID: 4028)
      • GameSenseFree.exe (PID: 240)
      • GameSenseFree.exe (PID: 6036)

    • The sample compiled with english language support

      • directx_Jun2010_redist.exe (PID: 8100)
      • DXSETUP.exe (PID: 5512)
      • infinst.exe (PID: 5404)
      • infinst.exe (PID: 1748)
      • infinst.exe (PID: 3016)
      • infinst.exe (PID: 5428)
      • infinst.exe (PID: 2776)
      • infinst.exe (PID: 2108)
      • infinst.exe (PID: 8068)
      • infinst.exe (PID: 4284)
      • infinst.exe (PID: 5344)
      • infinst.exe (PID: 3192)
      • infinst.exe (PID: 2192)
      • infinst.exe (PID: 5868)
      • infinst.exe (PID: 5544)
      • infinst.exe (PID: 7960)
      • infinst.exe (PID: 7052)
      • infinst.exe (PID: 5232)
      • infinst.exe (PID: 3016)
      • infinst.exe (PID: 5428)
      • infinst.exe (PID: 6108)
      • infinst.exe (PID: 6740)
      • infinst.exe (PID: 5796)
      • infinst.exe (PID: 5156)
      • infinst.exe (PID: 8060)
      • infinst.exe (PID: 7628)
      • infinst.exe (PID: 5044)
      • infinst.exe (PID: 7104)
      • infinst.exe (PID: 6768)
      • infinst.exe (PID: 4212)
      • infinst.exe (PID: 7324)
      • infinst.exe (PID: 5244)
      • infinst.exe (PID: 6404)
      • infinst.exe (PID: 8068)
      • infinst.exe (PID: 4152)
      • infinst.exe (PID: 8048)
      • infinst.exe (PID: 7944)
      • infinst.exe (PID: 672)
      • infinst.exe (PID: 5800)
      • infinst.exe (PID: 5960)
      • infinst.exe (PID: 6592)
      • infinst.exe (PID: 6828)
      • infinst.exe (PID: 5232)
      • infinst.exe (PID: 6660)
      • infinst.exe (PID: 5408)
      • infinst.exe (PID: 7000)
      • infinst.exe (PID: 5156)
      • infinst.exe (PID: 8080)
      • infinst.exe (PID: 4268)
      • infinst.exe (PID: 3100)
      • infinst.exe (PID: 1388)
      • infinst.exe (PID: 6940)
      • infinst.exe (PID: 4452)
      • infinst.exe (PID: 6620)
      • infinst.exe (PID: 6132)
      • infinst.exe (PID: 8048)
      • infinst.exe (PID: 1164)
      • infinst.exe (PID: 6488)
      • infinst.exe (PID: 5036)
      • infinst.exe (PID: 5228)
      • infinst.exe (PID: 2104)
      • infinst.exe (PID: 5064)
      • infinst.exe (PID: 5416)
      • infinst.exe (PID: 6892)
      • infinst.exe (PID: 6036)
      • infinst.exe (PID: 6404)
      • infinst.exe (PID: 6592)
      • infinst.exe (PID: 8096)
      • infinst.exe (PID: 2596)
      • infinst.exe (PID: 5892)
      • infinst.exe (PID: 5232)
      • infinst.exe (PID: 5428)
      • infinst.exe (PID: 6724)
      • infinst.exe (PID: 5668)
      • infinst.exe (PID: 4628)
      • infinst.exe (PID: 2088)
      • msedge.exe (PID: 8032)

    • Manages system restore points

      • SrTasks.exe (PID: 6416)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4028)
      • msedge.exe (PID: 8032)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
327
Monitored processes
184
Malicious processes
75
Suspicious processes
2

Behavior graph

Click at the process to see the details
start iexplore.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs sppextcomobj.exe no specs slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs winrar.exe no specs winrar.exe no specs msedge.exe no specs shellexperiencehost.exe no specs msedge.exe no specs systemsettingsbroker.exe no specs slui.exe directx_jun2010_redist.exe msedge.exe no specs msedge.exe no specs dxsetup.exe no specs dxsetup.exe SPPSurrogate no specs vssvc.exe no specs msedge.exe no specs srtasks.exe no specs conhost.exe no specs msedge.exe no specs infinst.exe infinst.exe infinst.exe infinst.exe infinst.exe infinst.exe infinst.exe regsvr32.exe no specs infinst.exe infinst.exe regsvr32.exe no specs infinst.exe infinst.exe regsvr32.exe no specs infinst.exe infinst.exe regsvr32.exe no specs infinst.exe infinst.exe regsvr32.exe no specs infinst.exe infinst.exe infinst.exe regsvr32.exe no specs infinst.exe regsvr32.exe no specs infinst.exe infinst.exe infinst.exe regsvr32.exe no specs infinst.exe infinst.exe msedge.exe no specs infinst.exe infinst.exe regsvr32.exe no specs infinst.exe infinst.exe rundll32.exe no specs infinst.exe regsvr32.exe no specs infinst.exe infinst.exe infinst.exe winrar.exe no specs infinst.exe regsvr32.exe no specs infinst.exe infinst.exe infinst.exe infinst.exe regsvr32.exe no specs winrar.exe no specs infinst.exe regsvr32.exe no specs infinst.exe infinst.exe infinst.exe infinst.exe regsvr32.exe no specs infinst.exe regsvr32.exe no specs infinst.exe infinst.exe infinst.exe regsvr32.exe no specs infinst.exe regsvr32.exe no specs infinst.exe winrar.exe infinst.exe regsvr32.exe no specs infinst.exe regsvr32.exe no specs msedge.exe no specs infinst.exe infinst.exe infinst.exe msedge.exe no specs infinst.exe regsvr32.exe no specs infinst.exe regsvr32.exe no specs infinst.exe infinst.exe infinst.exe infinst.exe infinst.exe infinst.exe msedge.exe no specs msedge.exe no specs infinst.exe infinst.exe regsvr32.exe no specs infinst.exe regsvr32.exe no specs infinst.exe infinst.exe regsvr32.exe no specs infinst.exe regsvr32.exe no specs infinst.exe infinst.exe infinst.exe infinst.exe infinst.exe infinst.exe regsvr32.exe no specs infinst.exe regsvr32.exe no specs SPPSurrogate no specs msedge.exe no specs msedge.exe no specs gamesensefree.exe no specs msedge.exe no specs msedge.exe no specs gamesensefree.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs conhost.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
240C:\WINDOWS\system32\regsvr32.exe /s C:\WINDOWS\system32\xactengine2_0.dllC:\Windows\System32\regsvr32.exe—DXSETUP.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
240"C:\Users\admin\Downloads\nnhz2npxeioybgqa\fr\Genshin\GameSenseFree.exe" C:\Users\admin\Downloads\nnhz2npxeioybgqa\fr\Genshin\GameSenseFree.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\downloads\nnhz2npxeioybgqa\fr\genshin\gamesensefree.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
664"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6252 --field-trial-handle=2344,i,15288988775801439071,8690261775723119718,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
672C:\Users\admin\AppData\Local\Temp\DX8370.tmp\infinst.exe XAudio2_0_x64.infC:\Users\admin\AppData\Local\Temp\DX8370.tmp\infinst.exe
DXSETUP.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\dx8370.tmp\infinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
812C:\WINDOWS\system32\regsvr32.exe /s C:\WINDOWS\system32\xactengine2_3.dllC:\Windows\System32\regsvr32.exe—DXSETUP.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1004C:\WINDOWS\system32\regsvr32.exe /s C:\WINDOWS\system32\XAudio2_1.dllC:\Windows\System32\regsvr32.exe—DXSETUP.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1052C:\WINDOWS\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
1164C:\Users\admin\AppData\Local\Temp\DX8370.tmp\infinst.exe D3DX9_41_x64.infC:\Users\admin\AppData\Local\Temp\DX8370.tmp\infinst.exe
DXSETUP.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\dx8370.tmp\infinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1180"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=1676 --field-trial-handle=2344,i,15288988775801439071,8690261775723119718,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1228"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=7084 --field-trial-handle=2344,i,15288988775801439071,8690261775723119718,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
30 623
Read events
30 194
Write events
392
Delete events
37

Modification events

(PID) Process:(7180) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\197386
Operation:writeName:WindowTabManagerFileMappingId
Value:
{D608525F-DCD5-4B39-9AD0-46B65904F75B}
(PID) Process:(7180) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\197386
Operation:writeName:WindowTabManagerFileMappingId
Value:
{5E809891-0CF1-4BC7-933B-A04CC3806F58}
(PID) Process:(7180) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\197386
Operation:writeName:WindowTabManagerFileMappingId
Value:
{0C869671-9CEA-41E9-A478-7EACF30DF05A}
(PID) Process:(7180) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\197386
Operation:writeName:WindowTabManagerFileMappingId
Value:
{C603AFBF-B7D0-4A02-A11A-A53ACF7BF62B}
(PID) Process:(4380) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4380) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4380) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4380) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(4380) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(4380) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:DisableFirstRunCustomize
Value:
1
Executable files
661
Suspicious files
1 301
Text files
158
Unknown types
0

Dropped files

PID
Process
Filename
Type
7180msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF10b325.TMP —
MD5:—
SHA256:—
7180msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF10b325.TMP —
MD5:—
SHA256:—
7180msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
7180msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
7180msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF10b325.TMP —
MD5:—
SHA256:—
7180msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
7180msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF10b344.TMP —
MD5:—
SHA256:—
7180msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
7180msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF10b344.TMP —
MD5:—
SHA256:—
7180msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
57
TCP/UDP connections
84
DNS requests
73
Threats
17

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5556
svchost.exe
HEAD
200
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1747705107&P2=404&P3=2&P4=ZU9ozsA%2bfoZVmlyKFAc0HZpuIy1xlaEKpBsgRm9Rl1KL%2fvEYMOOLccixlJC2iq9qs4Z4D1JhZ9dvVBYKqqXcUQ%3d%3d
unknown
—
—
whitelisted
5376
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.158:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5556
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1747705107&P2=404&P3=2&P4=ZU9ozsA%2bfoZVmlyKFAc0HZpuIy1xlaEKpBsgRm9Rl1KL%2fvEYMOOLccixlJC2iq9qs4Z4D1JhZ9dvVBYKqqXcUQ%3d%3d
unknown
—
—
whitelisted
5376
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5556
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1747705107&P2=404&P3=2&P4=ZU9ozsA%2bfoZVmlyKFAc0HZpuIy1xlaEKpBsgRm9Rl1KL%2fvEYMOOLccixlJC2iq9qs4Z4D1JhZ9dvVBYKqqXcUQ%3d%3d
unknown
—
—
whitelisted
5556
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9530bc3d-28ec-4dca-8d8d-874a68b1b861?P1=1747705108&P2=404&P3=2&P4=CCpbZbHBWIwKYb3y3C97OlZM5ZzrUQm8fsw7HvfLhRBJuyr%2bgmvTsfqxuPn1j%2ffrWEQ71LXQRccaUKep3D2sbg%3d%3d
unknown
—
—
whitelisted
5556
svchost.exe
HEAD
200
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9530bc3d-28ec-4dca-8d8d-874a68b1b861?P1=1747705108&P2=404&P3=2&P4=CCpbZbHBWIwKYb3y3C97OlZM5ZzrUQm8fsw7HvfLhRBJuyr%2bgmvTsfqxuPn1j%2ffrWEQ71LXQRccaUKep3D2sbg%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.158:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7416
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7180
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
7416
msedge.exe
88.99.137.18:443
filebin.net
Hetzner Online GmbH
DE
suspicious
7416
msedge.exe
150.171.27.11:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.48.23.158
  • 23.48.23.143
  • 23.48.23.159
  • 23.48.23.150
  • 23.48.23.193
  • 23.48.23.146
  • 23.48.23.161
  • 23.48.23.194
  • 23.48.23.138
  • 23.48.23.163
  • 23.48.23.145
  • 23.48.23.154
  • 23.48.23.151
  • 23.48.23.164
  • 23.48.23.157
  • 23.48.23.149
  • 23.48.23.148
  • 23.48.23.160
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 23.219.150.101
whitelisted
google.com
  • 142.250.185.142
whitelisted
filebin.net
  • 88.99.137.18
unknown
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 150.171.27.11
  • 150.171.28.11
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.45
whitelisted
www.bing.com
  • 104.126.37.185
  • 104.126.37.131
  • 104.126.37.137
  • 104.126.37.153
  • 104.126.37.139
  • 104.126.37.128
  • 104.126.37.178
  • 104.126.37.147
  • 104.126.37.136
  • 104.126.37.171
  • 104.126.37.163
  • 104.126.37.162
  • 104.126.37.179
  • 104.126.37.177
  • 104.126.37.160
  • 104.126.37.161
  • 104.126.37.176
whitelisted
xpaywalletcdn.azureedge.net
  • 13.107.246.45
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET FILE_SHARING Observed DNS Query to Abused File Sharing Domain in DNS Lookup (filebin .net)
7416
msedge.exe
Misc activity
ET FILE_SHARING Observed DNS Query to Abused File Sharing Domain in DNS Lookup (filebin .net)
7416
msedge.exe
Misc activity
ET FILE_SHARING Observed DNS Query to Abused File Sharing Domain in DNS Lookup (filebin .net)
7416
msedge.exe
Misc activity
ET INFO Observed Abused File Sharing Domain in TLS SNI (filebin .net)
7416
msedge.exe
Misc activity
ET INFO Observed Abused File Sharing Domain in TLS SNI (filebin .net)
7416
msedge.exe
Misc activity
ET INFO Observed Abused File Sharing Domain in TLS SNI (filebin .net)
7416
msedge.exe
Misc activity
ET INFO Observed Abused File Sharing Domain in TLS SNI (filebin .net)
7416
msedge.exe
Misc activity
ET INFO Observed Abused File Sharing Domain in TLS SNI (filebin .net)
7416
msedge.exe
Misc activity
ET INFO Observed Abused File Sharing Domain in TLS SNI (filebin .net)
7416
msedge.exe
Misc activity
ET FILE_SHARING Observed DNS Query to Abused File Sharing Domain in DNS Lookup (filebin .net)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://filebin.net/nnhz2npxeioybgqa